Editing Password Authentication Protocol (section)

'''Password Authentication Protocol''' ('''PAP''') is a [[password]]-based [[authentication protocol]] used by [[Point-to-Point Protocol]] (PPP) to validate users.<ref>{{Cite web|date=2018-07-17|title=Password Authentication Protocol (PAP)|url=https://www.geeksforgeeks.org/password-authentication-protocol-pap/|access-date=2020-11-08|website=GeeksforGeeks|language=en-US}}</ref> PAP is specified in {{IETF RFC|1334}}.

Almost all [[network operating system]]s support PPP with PAP, as do most [[network access server]]s. PAP is also used in [[PPPoE]], for authenticating DSL users.

As the [[Point-to-Point Protocol]] (PPP) sends data unencrypted and "in the clear", PAP is vulnerable to any attacker who can observe the PPP session.  An attacker can see the users name, password, and any other information associated with the PPP session. Some additional security can be gained on the PPP link by using [[Challenge-Handshake Authentication Protocol|CHAP]] or [[Extensible Authentication Protocol|EAP]]. However, there are always tradeoffs when choosing an authentication method, and there is no single answer for which is more secure.

When PAP is used in PPP, it is considered a weak authentication scheme. Weak schemes are simpler and have lighter [[overhead (computing)|computational overhead]] than more complex schemes, such as [[Transport Layer Security]] (TLS), but they are much more vulnerable to attack. Weak schemes are used where the transport layer is expected to be physically secure, such as a home [[DSL]] link. Where the transport layer is not physically secure a system such as TLS or [[Internet Protocol Security]] (IPsec) is used instead.