🚀 go-pugleaf

mhump@sparky.msfc.nasa.gov (Mark Humphries) writes:
someone else had written:
> > Could someone explain to me the benefit of PAP/CHAP authentication ...
> 
> Password Athentication Protocol (PAP) uses a username and password pair
> for user validation.  ...
> 
> Challenge-Handshake Authentication Protocol (CHAP) uses a "secret" that
> is known by the peer (the host attempting to dial in) and the authenticator
> (PPP server/host being dialed into).  ...

An important issue here has to do with what level connections are being
made at (application vs. session or transport) and whether or not human
intervention is appropriate or convenient each time a connectio is made.

I am new to protocols, new to this newsgroup, and know little about PPP,
but here is my two cents on this matter.

I got interested in protocols because I recently built my a session level
message protocol over Unix sockets (TCP/IP) and an RPC protocol
over that.  This was in the context of an Emacs/Lisp interface.  In this
application, new connections are being made at the session level, and
are often made by processes without the intervention of a human.  The
nature of the connection permits complete access to a Lisp address space
by a different Lisp or Emacs running anywhere on the internet.  Although
we have not exported this facility yet, we initially put in a very simple
'password' scheme, consisting of an integer, which the server end of a
new connection knows and which the client end must send to connect.  (Once a
connection is made, the server and client have completely symmetrice roles).
Typically, we just use the integer 0, inhouse, since we trust each other.

In considering how to provide a more secure connection mechanism, I was
intriqued to see this discussion in this newsgroup, which, I repeat, I
just joined.  I will follow this with interest and try to learn more
about PPP.  Maybe that's what I should be using.

Dennis
allard@isi.edu