I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised database.
Unfortunately there are a number of services that I would like to point at this server that only support MS-CHAPv2 for authentication (specifically wireless equipment). MS-CHAPv2 doesn't send the password to the authentication server, instead it applies MD4 to the password to derive an encryption key and then uses that to DES encrypt a challenge hash consisting of a random values chosen by both the client and server and the user's password.
My initial feeling is in order to support MS-CHAPv2 I would have to store either the user's password in plaintext or the MD4 of the user's password. Neither of these are acceptable to me.
Is there a way to store user's passwords securely and still be able to support MS-CHAPv2?