Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure?

I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in certain usage scenarios, MD5 is still technically secure (HMAC-MD5 for example).

I should say that I appreciate it's almost always a good idea to just use an algorithm that is known to be secure in all cases, rather than attempting to pick and choose when a partially broken algorithm can and can't still be used securely. This is more of an intellectual curiosity.


MD5 is broken with regards to creating collisions. That means that it is possible to construct a message M1 in such a way that you can also generate a message M2 so that H(M1) = H(M2). For this the messages M1 and M2 must be pre-constructed in a certain way.

So in case of CHAP M1 would be the nonce | password combination. The vulnerabilities of interest to an attacker are to find the password or to create a hash value without knowing the password. Unfortunately for the attacker the MD5 vulnerability doesn't leak information about the input - it's still a one way function. Neither lets it construct a value X where X = H(nonce | password) with just the nonce as input.

So basically CHAP is as (in)secure as it was before. See the post of Niklas for more information on issues with the scheme. The vulnerability of MD5 is the least of the concerns about this authentication scheme.


It depends what you mean by "secure" :)


  1. Client authentication request send its user name to the server
  2. Server responds with a nonce
  3. Client calculates hash(nonce|password) and send to the server
  4. Server verifies the password


  1. All data is transmitted in clear text i.e. it possible for an attacker to eavesdrop and brute-force the hash offline
  2. The server needs to store the password in clear text
  • The server doesn't have to store the password in clear text. Passwords can still be stored as SHA1 hashes. – OMA Apr 27 '18 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.