RADIUS Authentication Methods Compared: PAP vs CHAP vs MS-CHAPv2 vs EAP


RADIUS only carries credentials. The method you choose decides who gets to see the password along the way and how your AAA server has to store it. Both questions matter more in 2026 than they have in years, because the IETF is now moving to retire some of the oldest methods still running in operator networks.

Our new guide compares the four main RADIUS authentication methods side by side and explains where each one still belongs.

It starts with PAP and CHAP, the two methods inherited from PPP that still dominate PPPoE broadband. CHAP keeps the password off the wire, so it has long been treated as the safer option. To verify a login, though, the AAA server must keep every password in reversible form, which means one stolen password store exposes every subscriber. PAP lets you keep salted hashes instead. That’s why the latest IETF RADEXT draft now recommends PAP over CHAP when you judge the system as a whole, as long as the RADIUS link is protected.

MS-CHAPv2 gets a harder verdict. Its response is built from an unsalted MD4 hash of the password, and a single captured exchange is enough to search for what an attacker needs to log in. Revision 10 of the RADEXT draft, dated July 3, 2026, tells implementers to treat it like a clear-text password and bars it unless RadSec, IPsec or a TLS tunnel protects it. The draft is still a work in progress, but the direction is clear.

EAP is where the guide points operators next. Because EAP is a framework, you can adopt a stronger method by changing only the AAA server and the devices, with no new code on the NAS. EAP-TLS uses certificates and EAP-AKA’ uses the keys on the SIM, so no reusable password ever reaches the AAA server or a roaming proxy.

The guide closes with a practical table that maps each access network, from PPPoE and IPoE broadband to carrier Wi-Fi, enterprise 802.1X and VoWiFi, to the method it usually runs today and the one it should move toward. A worked example shows how a regional ISP can delete its reversible password store and shift Wi-Fi users to EAP-TLS, EAP-TTLS with inner PAP, or EAP-AKA’.

Comments

Post a Comment

Popular posts from this blog

The advantages of 5G service-based architecture (SBA)

Image
  An introduction to 5G service-based architecture 5G brings transformational changes to the core network with a modular and cloud-native approach. One key advancement is that it upgrades the traditional telco architecture to Service-Based Architecture (SBA), enabling more flexible service development. Introduced to improve the modularity of the network system, SBA le t s network elements or network functions (NFs) in 5G communicate with each other over a service-based interface. It allows the decoupling of NFs with more precise functionalities. Each NF provides a set of services to another NF in the SBA. These NFs communicate with each other using a more open REST-based interface rather than traditional telco protocols such as Diameter. What does this integral change in network architecture mean for telcos? The SBA offers a host of benefits, including: Deploys as containers orchestrated by Kubernetes, allowing the core to run on non-proprietary infrastructure Lets new software ven...
Read more

Navigating AAA Transformation: How Alepo Empowers Broadband Operators

Image
  The Importance of Broadband AAA Transformation Broadband operators play a crucial role in today’s digital landscape, serving as the backbone of modern communication. To provide reliable and secure services to their customers, these operators must maintain a robust and scalable network infrastructure that complies with various regulatory requirements. At the heart of this infrastructure lies the AAA (Authentication, Authorization, and Accounting) system, which manages user access, enforces policies, and tracks network usage. Challenges of AAA Vendor Discontinuation for Broadband Networks Collaborating with well-established AAA vendors is essential for ensuring the smooth functioning of broadband networks. However, the recent trend of leading AAA vendors discontinuing their product lines has left many operators in a precarious position. The end-of-life (EOL) of a significant AAA product or the withdrawal of vendor support can be a daunting challenge, requiring operators to find a s...
Read more

How telcos can redefine CX with a zero-touch network strategy

Image
  Introduction Telcos have been trying to keep up with increasingly digital lifestyles for years now. The pandemic has further amplified the demand for digitization, significantly impacting the way customers interact. More customers today prefer interacting with their service providers using digital touchpoints instead of visiting physical stores, and operators have already started to replace their conventional outposts. To remain relevant, MNOs need to fully digitize customer experience (CX). Having a digital-first strategy and building zero-touch networks enables them to move all customer interactions online while automating back-end processes. Why zero-touch networks? Zero-touch ne t works help operators minimize the need for physical touchpoints and support staff by ensuring all customer interactions take place through a website or mobile app using automation and AI chatbots. Operators can drastically reduce their investments of time, resources, and money by overcoming the cons...
Read more