## Authentication

RAS in Windows NT supports the following protocols for PPP authentication:

- Password Authentication Protocol (PAP) is the most basic authentication; Password sent in clear text.
- Shiva Password Authentication Protocol (SPAP) is a Shiva-specific version of PAP that encrypts password.
- Challenge Handshake Authentication Protocol (CHAP) encrypts password with RSA MD5.
- Microsoft CHAP (MS-CHAP) is a Microsoft-specific version of CHAP that uses RSA MD4.
- Data Encryption Standard (DES) provides compatibility with previous versions of RAS for Windows NT clients, such as Microsoft Windows® for Workgroups.

Windows NT can also encrypt the PPP link using the RC-4 standard.

In addition to PPP authentication protocols, remote-access servers usually support authentication servers, such as Remote Authentication Dial In User Service (RADIUS) and Terminal Access Controller Access Control System (TACAS/TACAS+). These servers authenticate a RAS user on a computer or remote-access server other than the one to which he or she is connected, indicating a Windows NT server could handle authentication for a RAS user connecting to a dedicated remote-access server. The win-win scenario here is that both local users and remote users can be managed from the same user database regardless of platform. This technology originated from access-server vendors, but Windows NT includes RADIUS as an add-on to the Routing and Remote Access Service (RRAS). Third-party Windows TACACS servers are also available.

©1997 Microsoft Corporation. All rights reserved. Legal Notices.
Last Updated: December 1, 1997