When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password.

However, I recently found Citrix states " storing passwords using reversible encryption is essentially the same as storing plaintext versions of the passwords." (http://support.citrix.com/static/oldkc/CTX114488.html)

So what is security best practices for storing plaintext during CHAP authentication ?


The CHAP authentication schemes requires both client and server to share a common plain text secret. However, the secret never enters the network.

So it is the responsibility of the client and server to ensure the confidentiality of the password.

The article you link is saying that password should not be stored encrypted as it does not add any additional layer of security, unless you have some specific needs for it to be encrypted (company policy, regulation, ...). The fact that CHAP cannot use a password which have been encrypted makes the encryption void anyway.

  • Normally you would hash the PW somehow on the server for safe storage. Couldn't the server tell the client how it was hashed, then the client could apply the same procedure to the cleartext password and then use the derivative to create the CHAP response? Would using the hash somehow compromise the secrecy of the password itself? – Chris Apr 11 '18 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.