PAP uses a two-way handshake to establish the identity of the remote peer. This simple authentication
protocol does not encrypt the username or password, making it somewhat insecure and
subject to a playback attack. Because of this security problem, it is recommended that you use
CHAP authentication instead.
After the PPP link establishment, the optional Authentication-Protocol Configuration
Option packet is sent. An Authentication-Protocol Configuration Option packet for PAP has
three fields: Type, Length, and Authentication-Protocol. The Type field is 8 bits long with a
value of 3, Length is 8 bits long with a value of 4, and Authentication-Protocol is 16 bits long
with a value of c023.