Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised database.

Unfortunately there are a number of services that I would like to point at this server that only support MS-CHAPv2 for authentication (specifically wireless equipment). MS-CHAPv2 doesn't send the password to the authentication server, instead it applies MD4 to the password to derive an encryption key and then uses that to DES encrypt a challenge hash consisting of a random values chosen by both the client and server and the user's password.

My initial feeling is in order to support MS-CHAPv2 I would have to store either the user's password in plaintext or the MD4 of the user's password. Neither of these are acceptable to me.

Is there a way to store user's passwords securely and still be able to support MS-CHAPv2?

share|improve this question
Is this a custom service or a commercial/off the shelf solution you're trying to use? If its COTS whats the product name? – NULLZ Nov 14 '13 at 6:56
It is not a COTS. – Askford Nov 14 '13 at 14:12
up vote 1 down vote accepted


As a challenge-response protocol, MS-CHAP2 restricts how you can store the password server-side. And it is somewhat weaker than bcrypt.

You could provide a configuration option like: Support MS-CHAP2? (warning: enabling this stores passwords insecurely)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.