Windows 98 Dial-Up Network Security Protocols

Microsoft Windows 98 supported several authentication and data encryption protocols designed to secure remote access connections over Dial-Up Networking (DUN). Operating primarily over the Point-to-Point Protocol (PPP), these security mechanisms allowed users to connect securely to Internet Service Providers (ISPs) and corporate remote access servers (RAS) using standard telephone lines and modems, offering options ranging from plaintext verification to challenge-response handshakes and encrypted tunnels.

Authentication Protocols

Windows 98 Dial-Up Networking supported four primary authentication protocols to verify user credentials before granting network access:

  • PAP (Password Authentication Protocol): The most basic form of authentication. PAP transmits user credentials in unencrypted, clear text across the dial-up connection. It provided low security and was primarily used for compatibility with legacy mainframe systems and older ISP servers.
  • SPAP (Shiva Password Authentication Protocol): A proprietary, two-way authentication mechanism developed by Shiva Corporation. It allowed Windows 98 clients to connect to Shiva remote access servers using reversibly encrypted passwords, offering slightly more protection than plaintext PAP.
  • CHAP (Challenge Handshake Authentication Protocol): An industry-standard challenge-response protocol using MD5 hashing. The server sends a unique challenge phrase, and the Windows 98 client responds with an encrypted hash of the password combined with the challenge. The actual password is never transmitted across the wire, preventing eavesdropping and replay attacks.
  • MS-CHAP (Microsoft Challenge Handshake Authentication Protocol): Microsoft’s proprietary implementation of CHAP, designed for integration with Windows NT domains. It utilizes standard Windows NT and LAN Manager password hashing algorithms. With updates like Dial-Up Networking 1.3 and 1.4, Windows 98 gained support for MS-CHAP v2, which introduced mutual authentication and stronger cryptographic keys.

Data Encryption Protocols

For securing data payloads transmitted across a dial-up connection, Windows 98 relied on:

  • MPPE (Microsoft Point-to-Point Encryption): MPPE works in conjunction with MS-CHAP authentication to encrypt PPP and PPTP traffic. By default, Windows 98 supported 40-bit MPPE encryption (using the RSA RC4 stream cipher) to comply with U.S. export regulations of that era. Users could install the Windows 98 Dial-Up Networking 1.3/1.4 updates alongside the High Encryption Pack to upgrade to 128-bit encryption.

Tunneling and VPN Protocols

Windows 98 included built-in support for establishing virtual private network (VPN) tunnels directly over an established dial-up connection:

  • PPTP (Point-to-Point Tunneling Protocol): PPTP encapsulated standard network traffic within IP packets. When dialed into an ISP, users could initiate a PPTP tunnel over the dial-up link to access corporate intranets securely, relying on MS-CHAP for authentication and MPPE for payload encryption.