RADIUS attribute from rfc2869

---

ARAP-Challenge-Response

This attribute is sent in an Access-Accept packet with Framed-
      Protocol of ARAP, and contains the response to the dial-in
      client's challenge.

   A summary of the ARAP-Challenge-Response attribute format is shown
   below.  The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |     Value...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      84 for ARAP-Challenge-Response.

   Length

      10Value

      The Value field contains an 8 octet response to the dial-in
      client's challenge. The RADIUS server calculates this value by
      taking the dial-in client's challenge from the high order 8 octets
      of the ARAP-Password attribute and  performing DES encryption on
      this value with the authenticating user's password as the key. If
      the user's password is less than 8 octets in length, the password
      is padded at the end with NULL octets to a length of 8 before
      using it as a key.

---