PAP and clear text

[Stefan.Neis at t-online.de]

        Hi,

> You must have missed the information in RFC 2865 (RADIUS), which is also 
> a Fine Manual.  The PAP password is XOR'd with the MD5 hash of the 
> shared secret and the authenticator.

Yes, that's a bit clearer than saying "the password is hashed", since it
also shows that the process is reversible and you can easily obtain the
cleartext password from the "obfuscated" password.

> You've been reading about the protocol prior to the RADIUS client's 
> involvment. The same thing applies to CHAP, just to head you off.

No, not quite. Here, the password is (essentially) used as a key to compute
the hash value of a challenge. Most notably, this means you (or the server) have
no way whatsoever to get back to the clear text password from what is transmitted
to the server.

        Regards,
	        Stefan