One thing to keep in mind since some of the letters in this thread don't
seem clear on it - no matter how the CHAP password is stored it MUST be
able to be reversed to cleartext. So any one way encryption is right out.
While keeping them in MD5 hashed format will prevent casual observers, any
malicious attacks aimed at getting them will not be stopped. Since the
hash key MUST be stored in a readable format for the server to be able to
dehash the stored password, anyone who has hacked the privs to get the users
file can easily grab the hash key too. And then you may as well have stored
them in cleartext for all the good it does.
This is a well known limitation of using CHAP. It is a tradeoff. PAP sends
the password in the clear over the link, but can store it encrypted on the
server. CHAP does not send the password over the link, but requires it to
be stored in the clear. So you decide - do you worry more about your phone
line being tapped or the server being hacked?
Really it is a moot point since most dialers don't do CHAP anyway.
-MZ
-- Livingston Enterprises - Chair, Department of Interstitial Affairs Phone: 800-458-9966 510-426-0770 FAX: 510-426-8951 megazone@livingston.com For support requests: support@livingston.com <http://www.livingston.com/> Snail mail: 6920 Koll Center Parkway #220, Pleasanton, CA 94566 See me in person: Internet Expo, Boston, MA, October 16-17, Booth 422 ;-)