Simple definition
CHAP is a challenge-response authentication mechanism used notably with PPP and iSCSI.
Technical definition
The authenticating peer sends a random challenge and the other party computes a response from that challenge and a shared secret. The secret itself is not sent across the network.
What is it used for?
Verify that an initiator or peer knows the expected secret before the session is authorized.
Practical example
An iSCSI initiator returns a CHAP response to a storage target before it can access the LUNs.
Common issues
- Different secrets configured on the initiator and target
- Mutual authentication enabled on only one side
- Weak, reused, or poorly protected shared secrets
How it works / role
The server or target sends a challenge. The client computes a response using the challenge and the shared secret and sends the result back. The server performs the same calculation and accepts the session only when the values match; mutual CHAP performs authentication in both directions.
Key takeaway: Exact behavior can vary by version, product, and architecture; always validate on the environment actually deployed.