Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a sister question of Is EAP-MSCHAP v2 secure?.

Based on my understanding, IPsec should have authenticated the server (we're using PKI) and secured the rest of the protocols before the user authentication takes place, so there's no need to use PEAP (for L2TP/IPsec) right? (I.e. plain MSCHAPv2 should provide adequate protection for the passwords in this case?)

share|improve this question
up vote 1 down vote accepted

I think you are correct but it would be nice to know for sure. Microsoft KB article (2743314) dealing with MS-CHAP in PPTP-

Unencapsulated MS-CHAP v2 Authentication Could Allow Information Disclosure

Expand Suggested Actions and it says:

Or, as an alternative to implementing PEAP-MS-CHAP v2 Authentication for Microsoft VPNs, use a more secure VPN tunnel

If the tunnel technology used is flexible, and a password-based authentication method is still required, then Microsoft recommends using L2TP, IKEv2, or SSTP VPN tunnels in conjunction with MS-CHAP v2 or EAP-MS-CHAP v2 for authentication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.