0

I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised database.

Unfortunately there are a number of services that I would like to point at this server that only support MS-CHAPv2 for authentication (specifically wireless equipment). MS-CHAPv2 doesn't send the password to the authentication server, instead it applies MD4 to the password to derive an encryption key and then uses that to DES encrypt a challenge hash consisting of a random values chosen by both the client and server and the user's password.

My initial feeling is in order to support MS-CHAPv2 I would have to store either the user's password in plaintext or the MD4 of the user's password. Neither of these are acceptable to me.

Is there a way to store user's passwords securely and still be able to support MS-CHAPv2?

|improve this question
  • Is this a custom service or a commercial/off the shelf solution you're trying to use? If its COTS whats the product name? – NULLZ Nov 14 '13 at 6:56
  • It is not a COTS. – Askford Nov 14 '13 at 14:12
1

Yes

As a challenge-response protocol, MS-CHAP2 restricts how you can store the password server-side. And it is somewhat weaker than bcrypt.

You could provide a configuration option like: Support MS-CHAP2? (warning: enabling this stores passwords insecurely)

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.