{
  "slug": "iscsi-chap",
  "term": "CHAP authentication (iSCSI)",
  "aliases": [
    "iSCSI CHAP",
    "iSCSI mutual CHAP"
  ],
  "definition": "iSCSI CHAP is a shared-secret challenge-response authentication method used during iSCSI login.",
  "note": "The response is computed from a challenge, an identifier and a shared secret; the secret itself is not transmitted in the exchange. This verifies knowledge of a secret, not the trustworthiness of a device. [chap] Captured unencrypted exchanges can still enable offline password guessing. [security]\n\nAuthenticating the initiator does not automatically authenticate the target. Mutual authentication adds the reverse check, and iSCSI requires different secrets for the two directions. [iscsi] [security]\n\nAuthentication alone does not protect subsequent storage traffic against observation or modification. Packet protection is a separate requirement. An IPsec association can use NULL encryption, so IPsec presence alone does not establish confidentiality. [security] [ipsec]",
  "status": "shipping",
  "advantages": [],
  "limitations": [],
  "related": [
    "iscsi",
    "iscsi-node-name",
    "iscsi-session",
    "iscsi-digest"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "chap",
      "title": "RFC 1994: challenge-response mechanism, sections 2 and 4.1",
      "url": "https://www.rfc-editor.org/rfc/rfc1994.html",
      "accessed": "2026-10-20"
    },
    {
      "id": "iscsi",
      "title": "RFC 7143: CHAP login exchange, section 12.1.3",
      "url": "https://www.rfc-editor.org/rfc/rfc7143.html#section-12.1.3",
      "accessed": "2026-10-20"
    },
    {
      "id": "security",
      "title": "RFC 3723: iSCSI authentication and threats, sections 2.4 and 3.1",
      "url": "https://www.rfc-editor.org/rfc/rfc3723.html",
      "accessed": "2026-10-20"
    },
    {
      "id": "ipsec",
      "title": "RFC 7146: confidentiality transforms and NULL encryption, section 2.2",
      "url": "https://www.rfc-editor.org/rfc/rfc7146.html#section-2.2",
      "accessed": "2026-10-20"
    },
    {
      "id": "analysis",
      "title": "Hesela: iSCSI identity, sessions and recovery",
      "url": "https://hesela.com/analyses/iscsi-identity-sessions-recovery/",
      "accessed": "2026-10-20"
    }
  ],
  "provenance": [
    "Specification review, not an authentication or encryption deployment test. Historical algorithm requirements are not a current cipher-selection guide."
  ],
  "updated": "2026-10-20"
}