In MS-CHAP, the ________ creates the response message.

• A. Supplicant
• B. Verifier
• C. Both A and B
• D. Neither A nor B

Answer: (A)

In MS-CHAP, the response is created by the party seeking access—the supplicant. The server (verifier) first sends a challenge to the client. The client uses that challenge plus the user’s password (hashed) to compute a response and sends it back. The server then checks the response against its own calculation using the stored password hash. Since generating the response requires the user’s password information and the challenge, it’s the supplicant that creates the response message.