In telecommunications, a handshake is an automated process of negotiation between two participants through the exchange of information that establishes the protocols of a communication link at the start of the communication, before full communication begins.

What is meant by a handshaking protocol?•

The process when one device sends a message to another device by initiating the communications with the use of communication channels. • The handshake protocols begin to establish a connection between a computer and a device.

How does a handshake protocol work?

The SSL handshake process is as under: … Both parties agree on a single cipher suite and generate the session keys (symmetric keys) to encrypt and decrypt the information during an SSL session. Finally, both client and server exchanges encrypted message to ensure that the future messages will be encrypted.

TYPES OF HANDSHAKE IN NETWORKING

• TCP three-way handshake. Example of three way handshaking. …
• SMTP. The Simple Mail Transfer Protocol (SMTP) is the key Internet standard for email transmission. …
• TLS handshake. Main article: Transport Layer Security § TLS handshake. …
• WPA2 wireless. …
• Dial-up access modems. …
• Serial “Hardware Handshaking“

WHAT IS CHALLENGE HANDSHAKE AUTHENTICATION PROTOCOL

Challenge-Handshake Authentication Protocol (CHAP) is an identity verification protocol that does not rely on sending a shared secret between the access-requesting party and the identity-verifying party (the authenticator). CHAP is based on a shared secret, but in order to authenticate, the authenticator sends a “challenge” message to the access-requesting party, which responds with a value calculated using a “one-way hash” function that takes as inputs the challenge and the shared secret. The authenticator checks the response against its own calculation of the expected hash value.  If the values match, the authentication succeeds, otherwise it fails.  Following the establishment of an authenticated connection, the authenticator may send a challenge to the access-requesting party at random intervals, to which the access-requesting party will have to produce the correct response.

CHAP has built in measures to protect against playback attack by requiring the access-requesting party to use an incrementally changing identifier and a variable    challenge value. The authenticator is in control of the frequency and timing of the challenges. The use of repeated challenges is intended to limit the time of exposure to any single attack.

In computing, the Challenge-Handshake Authentication Protocol authenticates a user or network host to an authenticating entity. That entity may be, for example, an Internet service provider.

The Challenge-Handshake Authentication Protocol (CHAP) is used to
   periodically verify the identity of the peer using a 3-way handshake.
   This is done upon initial link establishment, and MAY be repeated
   anytime after the link has been established.

   1.    After the Link Establishment phase is complete, the
         authenticator sends a "challenge" message to the peer.

   2.    The peer responds with a value calculated using a "one-way
         hash" function.

   3.    The authenticator checks the response against its own
         calculation of the expected hash value.  If the values match,
         the authentication is acknowledged; otherwise the connection
         SHOULD be terminated.

   4.    At random intervals, the authenticator sends a new challenge to
         the peer, and repeats steps 1 to 3.

How does CHAP authentication work?

CHAP is an authentication scheme used by Point-to-Point Protocol (PPP) servers to validate the identity of remote clients. CHAP periodically verifies the identity of the client by using a three-way handshake. … The authenticator checks the response against its own calculation of the expected hash value.

Design Requirements

   The CHAP algorithm requires that the length of the secret MUST be at
   least 1 octet.  The secret SHOULD be at least as large and
   unguessable as a well-chosen password.  It is preferred that the
   secret be at least the length of the hash value for the hashing
   algorithm chosen (16 octets for MD5).  This is to ensure a
   sufficiently large range for the secret to provide protection against
   exhaustive search attacks.

   The one-way hash algorithm is chosen such that it is computationally
   infeasible to determine the secret from the known challenge and
   response values.

   Each challenge value SHOULD be unique, since repetition of a
   challenge value in conjunction with the same secret would permit an
   attacker to reply with a previously intercepted response.  Since it
   is expected that the same secret MAY be used to authenticate with
   servers in disparate geographic regions, the challenge SHOULD exhibit
   global and temporal uniqueness.

   Each challenge value SHOULD also be unpredictable, least an attacker
   trick a peer into responding to a predicted future challenge, and
   then use the response to masquerade as that peer to an authenticator.

   Although protocols such as CHAP are incapable of protecting against
   realtime active wiretapping attacks, generation of unique
   unpredictable challenges can protect against a wide range of active
   attacks.

   A discussion of sources of uniqueness and probability of divergence
   is included in the Magic-Number Configuration Option [1].

Advantages

   CHAP provides protection against playback attack by the peer through
   the use of an incrementally changing identifier and a variable
   challenge value.  The use of repeated challenges is intended to limit
   the time of exposure to any single attack.  The authenticator is in
   control of the frequency and timing of the challenges.

   This authentication method depends upon a "secret" known only to the
   authenticator and that peer.  The secret is not sent over the link.

   Although the authentication is only one-way, by negotiating CHAP in
   both directions the same secret set may easily be used for mutual
   authentication.

   Since CHAP may be used to authenticate many different systems, name
   fields may be used as an index to locate the proper secret in a large
   table of secrets.  This also makes it possible to support more than
   one name/secret pair per system, and to change the secret in use at
   any time during the session.

.  Disadvantages

   CHAP requires that the secret be available in plaintext form.
   Irreversably encrypted password databases commonly available cannot
   be used.

   It is not as useful for large installations, since every possible
   secret is maintained at both ends of the link.

      Implementation Note: To avoid sending the secret over other links
      in the network, it is recommended that the challenge and response
      values be examined at a central server, rather than each network
      access server.  Otherwise, the secret SHOULD be sent to such
      servers in a reversably encrypted form.  Either case requires a
      trusted relationship, which is outside the scope of this
      specification.

Drop your comment