Which of the following statements pertaining to PPTP (Point-to-Point Tunneling Protocol) is incorrect?

PPTP predates L2TP. L2TP was produced by combining features of Cisco’s L2F with Microsoft’s PPTP, not the reverse. Therefore the statement that “PPTP is derived from L2TP” is false.

• A is true because PPTP simply encapsulates an ordinary PPP session inside GRE; any network-layer protocol that PPP can carry (IP, IPX, NetBEUI, etc.) is therefore tunnelable.

• B is true because PPTP relies on MPPE with 40- or 128-bit RC4 keys, which current cryptographic guidance classifies as weak.

• C is true in the context of the original PPTP specification, whose authentication options are limited to PAP, CHAP and MS-CHAP; none of these are token-based.

A. Correct statement—PPP-encapsulated GRE tunnel allows any PPP-carried protocol.

B. Correct statement—MPPE/RC4 (40/128-bit) is no longer considered strong.

C. Correct statement—RFC 2637 lists only PAP/CHAP/MS-CHAP; hardware-token OTP methods are outside the spec.

D. Incorrect—chronology is reversed; L2TP was derived from PPTP (plus L2F).

1. RFC 2637 “Point-to-Point Tunneling Protocol (PPTP)” (IETF

Jul 1999)

– Sec. 1

para 3: “PPTP was developed … to tunnel PPP.”

– Sec. 4.2: only PAP

CHAP

MS-CHAP mentioned (no token methods).

2. Microsoft “Point-to-Point Tunneling Protocol (PPTP) Overview

” Microsoft Learn

ID ms817829

– Section “Relationship to L2TP”: “L2TP combines the best features of PPTP and L2F.”

– Section “Encryption”: MPPE uses RC4 40-/128-bit keys.

3. Cisco Systems

“VPN and Network Security” course notes

v6.2

Module 9

p. 9-7

– Notes weak encryption strength of PPTP/MPPE.