What is the BEST way to establish identity over the internet?

CHAP provides challenge-response authentication but is primarily designed for point-to-point connections and does not scale well for internet-based identity; it also lacks a second authentication factor, making it weaker than MFA solutions.

IMAP is a mail retrieval protocol, not an authentication or identity framework, and pairing it with 3DES addresses email encryption rather than establishing user identity over the internet.

RADIUS is a proven, widely-supported AAA (Authentication, Authorization, and Accounting) protocol designed specifically for network access authentication. Combining it with hardware tokens introduces multi-factor authentication (MFA), requiring both something the user knows and something the user physically possesses, making credential theft or replay attacks significantly harder over the internet.

SOAP is an XML-based messaging protocol used for web services communication and is not designed or recommended as an authentication mechanism for establishing user identity.