Captive Portal-MS-CHAPv2 Auth

Zyxel_Lynn

Secure Authentication with MS-CHAPv2 for Captive Portal

Zyxel has added support for the MS-CHAPv2 protocol for Captive Portal authentication when using an external RADIUS server, providing a significantly more secure option than the traditional PAP method. This security enhancement is specifically available for Cloud Managed APs.

Security Advantages

MS-CHAPv2 utilizes non-reversible cryptographic hashing, ensuring that user passwords are never transmitted in plain text. This makes the password attribute invisible in RADIUS request messages, protecting credentials even if the network traffic is intercepted by an attacker.

Verification via Packet Capture

The security benefits can be visually confirmed using tools like Wireshark. While the default PAP method allows an attacker with the shared secret to easily decrypt and view user passwords, MS-CHAPv2 only reveals the challenge and response attributes (MS-CHAP-Challenge and MS-CHAP-Response), keeping the actual password secure.