... Size (4 bytes): A 32-bit unsigned integer that defines the length, in bytes, of the Value field in the structure. Z4 (4 bytes): A 32-bit integer value containing 0x00000000. CustomData (8 bytes): An 8-byte platform-specific blob containing info only relevant when the client and the server are on the same host.<19> MachineID (32 bytes): A 256-bit random number created at computer startup to identify the calling machine.<20> LM_RESPONSE The LM_RESPONSE structure defines the NTLM v1 authentication LmChallengeResponse in the . This response is used only when NTLM v1 authentication is configured. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 Response (24 bytes) ... ... Response (24 bytes): A 24-byte array of unsigned char that contains the client's LmChallengeResponse as defined in section . LMv2_RESPONSE The LMv2_RESPONSE structure defines the NTLM v2 authentication LmChallengeResponse in the . This response is used only when NTLM v2 authentication is configured. 0 1 2 3 4 5 6 7 8 9 1 0 1 2 3 4 5 6 7 8 9 2 0 1 2 3 4 5 6 7 8 9 3 0 1 Response (16 bytes) ... ... ChallengeFromClient ... Response (16 A 16-byte array of unsigned char that contains the client's LM This is the portion of the LmChallengeResponse field to which the HMAC_MD5 algorithm has been applied, as defined in section . Specifically, Response corresponds to the result of applying the HMAC_MD5 algorithm, using the key ResponseKeyLM, to a message consisting of the concatenation of the ResponseKeyLM, ServerChallenge and ClientChallenge.
Appendix A: Cryptographic Operations Reference In the algorithms provided in this documentation, pseudocode is provided to illustrate the process used to compute keys and perform other cryptographic operations prior to protocol exchange. The following table defines the general purpose functions and operations used in this pseudocode. Functions Description Section AddAVPair(T, Id, An auxiliary function that is used to manage AV pairs in NTLM messages. It is defined as follows. AddAvPair(T, Id, { STRING T USHORT Id STRING T = ConcatenationOf(T, Id) T = ConcatenationOf(T, Length(Value)) T = ConcatenationOf(T, Value) } ComputeResponse(...) A function that computes the NT response, LM responses, and key exchange key from the response keys and challenge. , , , ConcatenationOf(string1, string2, ... stringN) Indicates the left-to-right concatenation of the string parameters, from the first string to the Nnth. Any numbers are converted to strings and all numeric conversions to strings retain all digits, even nonsignificant ones. The result is a string. For example, ConcatenationOf(0x00122, "XYZ", "Client") results in the string "00122XYZClient." 3.3.1, 3.3.2, , , , , , CRC32(M) Indicates a 32-bit CRC calculated over M. 3.4.3, 3.4.4 DES(K, D) Indicates the encryption of an 8-byte data item D with the key K the Data Encryption Standard (DES) algorithm in Electronic Codebook (ECB) mode. The result is 8 bytes in length (). 3.3.1, 3.4.5.1 DESL(K, D) Indicates the encryption of an 8-byte data item D with the 16-byte key K using the Data Encryption Standard Long (DESL) algorithm. The result is 3.3.1
SIGNKEY(flag, K, string1) Produces a signing key from the session key as defined in sections KXKEY, SIGNKEY, and SEALKEY. 3.1.5.1.2, 3.4.5.2 Currenttime Indicates the retrieval of the current time as a 64-bit value, represented as the number of 100-nanosecond ticks elapsed since midnight of January 1st, 1601 (UTC). 3.1.5.1.2 UNICODE(string) Indicates the 2-byte byte order encoding of the Unicode UTF-16 representation of string. The Byte Order Mark (BOM) is not sent over the wire. 3.3.1, 3.3.2 UpperCase(string) Indicates the uppercase representation of string. 3.3.1, 3.3.2 Z(N) Indicates the creation of a byte array of length N. Each byte in the array is initialized to the value zero. 3.3.1, 3.3.2
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following table. For more information, please contact . Section Tracking number (if applicable) and description Major change (Y or N) Change type NEGOTIATE_MESSAGE 72259 : Replaced "present" with "populated". Y Content update. CHALLENGE_MESSAGE 72259 : Replaced "present" with "populated". Y Content update. AUTHENTICATE_MESSAGE 72259 : Replaced "present" with "populated". Y Content update. AV_PAIR 72298 : Added that MsvAvTimestamp structure is always included in CHALLENGE_MESSAGE. Y Content update. 2.2.2.1 AV_PAIR 71131 : Documented structures that use AV_PAIR structures. N Content update. Single_Host_Data 70729 : Removed DataPresent field, expanded CustomData field and updated description. Y Content update. NTLM v2: NTLMv2_CLIENT_CHALLENGE : Added product behavior note specifying how the variable-length section of the NTLMv2_CLIENT_CHALLENGE structure is handled. Y New product behavior note added. 2.2.2.7 NTLM v2: NTLMv2_CLIENT_CHALLENGE 71131 : Added reference text to clarify relationship to the NTLMv2_RESPONSE structure. N Content update. V2 Response: NTLMv2_RESPONSE 71131 : Added field definition reference for NTLMv2_CLIENT_CHALLENGE. N Content update. VERSION 72259 : Replaced "present" with "populated". Y Content update. 2.2.2.10 VERSION Updated content for Windows 10 and Windows Server 2016 Technical Preview operating systems. Y Content update. Client Receives a CHALLENGE_MESSAGE from the Server : Clarified information about sending LmChallengeResponse during NTLMv2 authentication, and Y Content update.
updated product behavior note associated with content. 3.1.5.1.2 Client Receives a CHALLENGE_MESSAGE from the Server 71131 : Revised syntax snippet for CHALLENGE MESSAGE element to match content. Y Protocol syntax updated. 3.1.5.1.2 Client Receives a CHALLENGE_MESSAGE from the Server 72261 : Revised algorithms\pseudocode to format correctly. N Protocol syntax updated. Client Receives a CHALLENGE_MESSAGE 71131 : Revised syntax snippet for CHALLENGE MESSAGE element to match content. Y Protocol syntax updated. Variables Internal to the Protocol 72291 : Specified that machines have a NULL value for DnsForestName. Y Content update. Server Receives a NEGOTIATE_MESSAGE from the Client : Revised algorithms\pseudocode to format correctly. N Protocol syntax updated. Server Receives an AUTHENTICATE_MESSAGE from the Client 72296 : Added condition in pseudocode If statement. Y Content update. 3.2.5.1.2 Server Receives an AUTHENTICATE_MESSAGE from the Client 72292 : Moved "Set MIC" pseudocode command outside If/Else block N Content update. 3.2.5.1.2 Server Receives an AUTHENTICATE_MESSAGE from the Client 72263 : Revised "NOT EQUAL" to "!=" for consistency within the pseudo code. N Protocol syntax updated. 3.2.5.1.2 Server Receives an AUTHENTICATE_MESSAGE from the Client 72261 : Revised algorithms\pseudo code to format correctly. N Protocol syntax updated. 3.2.5.1.2 Server Receives an AUTHENTICATE_MESSAGE from the Client : Added information regarding case sensitivity of user name. N Content update. Server Response Checking 72296 : Added condition in pseudocode If statement. Y Content update. 3.2.5.2.2 Server Response Checking 72261 : Revised algorithms\pseudocode to format correctly. N Protocol syntax updated. KXKEY 72284 : Updated description of how KeyExchangeKey value is generated for NTLM v2. Y Content update.
A Abstract data 39 39 variables 40 39 47 47 variables 48 47 59 15 22 Authentication 55 57 28 C Call flow 14 13 12 15 20 92 Client 39 39 variables 40 39 41 41 47 42 45 42 42 47 42 45 42 42 47 41 70 60 14 13 Cryptographic 82 70 D Data model - abstract 39 39 variables 40 39 47 47 variables 48 47 59 E Examples 70 70 69 NTLMv1 authentication 73 73 71 client challenge 76 75 74 NTLMv2 authentication 79 78 77 F 15 G 7 GSS_GetMICEx() 67 67 GSS_UnwrapEx() 66 66 GSS_VerifyMICEx() 67 68 GSS_WrapEx() 65 66
H Higher-layer triggered events 41 48 I 81 81 11 Initialization 41 48 7 K KXKEY ( 62, 62) L 30 30 Local events 47 55 M Message processing 42 45 42 42 49 54 49 49 Messages 16 16 N 31 17 10 NTLM 12 14 13 69 34 16 35 36 36 NTLMv1 55 71 73 73 client challenge 74 76 75 55 NTLMv2 57 77 79 78 55 34 35 O Other local events 47 55 11 P 81 15 15 85 Protocol Details 39 R 10 11 10 14 29 S SEALKEY ( 62, 64) Security 81 81 58 Sequencing rules