Supported Authentication Protocols

The following authentication protocols are supported for logon security for VPN connections in Windows 7:

• PAP Stands for Password Authentication Protocol; uses plaintext (unencrypted) passwords.
• CHAP Stands for Challenge Handshake Authentication Protocol; uses one-way MD5 hashing with challenge-response authentication.
• MSCHAPv2 Stands for Microsoft Challenge Handshake Authentication Protocol version 2; an extension by Microsoft of the CHAP authentication protocol that provides mutual authentication of Windows-based computers and stronger data encryption. MSCHAPv2 is an enhancement of the earlier MS-CHAP protocol that provided only one-way authentication of the client by the server.
• EAP Stands for Extensible Authentication Protocol; extends PPP by adding support for additional authentication methods including using smart cards and certificates.
• PEAP Stands for Protected Extensible Authentication Protocol, or Protected EAP; enhances the protection provided by EAP by using Transport Layer Security (TLS) to provide a secure channel for EAP negotiation. PEAP is also used in Windows 7 to support NAP scenarios.

Starting with Windows Vista, the following authentication protocols have been deprecated for use by VPN connections:

• SPAP (Shiva Password Authentication Protocol)
• MS-CHAP
• EAP using MD5

Note that by default PAP and CHAP are not enabled as authentication protocols on new VPN connections you create using the Set Up A Connection Or Network wizard. This is because PAP and CHAP are not considered secure; use them only when connecting to ISPs whose network access devices support only these older authentication schemes. And although PPTP in Windows 7 no longer supports MD5 for data integrity checking using L2TP/IPsecbased VPN connections, support for MD5 usage in CHAP has been maintained because of the continuing popularity of this authentication protocol with many broadband- and dial-up-based ISPs.

Table below summarizes the differences between Windows 7, Windows Vista, and Windows XP with regard to user authentication protocols used for VPN connections.

Note In addition to the user authentication protocols listed in Table below, L2TP/IPsec also supports machine-level authentication (using either pre-shared keys or machine certificates), and SSTP supports the client validating the server (using the certificate sent by the server to the client during the SSL negotiation phase).

Authentication Protocols Supported for VPN Connections in Windows 7, Windows Vista, and Windows XP