Revision Summary Date Revision History Revision Comments 2/22/2007 0.01 New Version 0.01 release 6/1/2007 1.0 Major Updated and revised the technical content. 7/3/2007 1.0.1 Editorial Changed language and formatting in the technical content. 7/20/2007 2.0 Major Updated and revised the technical content. 8/10/2007 3.0 Major Updated and revised the technical content. 9/28/2007 4.0 Major Updated and revised the technical content. 10/23/2007 5.0 Major Updated and revised the technical content. 11/30/2007 6.0 Major Updated and revised the technical content. 1/25/2008 6.0.1 Editorial Changed language and formatting in the technical content. 3/14/2008 6.0.2 Editorial Changed language and
formatting in the technical content. 5/16/2008 6.0.3 Editorial Changed language and formatting in the technical content. 6/20/2008 7.0 Updated and revised the technical content. 7/25/2008 8.0 Major Updated and revised the technical content. 8/29/2008 9.0 Major Updated and revised the technical content. 10/24/2008 9.0.1 Editorial Changed language and formatting in the technical content. 12/5/2008 10.0 Updated and revised the technical content. 1/16/2009 11.0 Major Updated and revised the technical content. 2/27/2009 12.0 Major Updated and revised the technical content. 4/10/2009 12.1 Minor Clarified the meaning of the technical content.
5/22/2009 13.0 Updated and revised the technical content. 7/2/2009 13.1 Minor Clarified the meaning of the technical content. 8/14/2009 13.2 Minor Clarified the meaning of the technical content. 9/25/2009 14.0 Major Updated and revised the technical content. 11/6/2009 15.0 Major Updated and revised the technical content. 12/18/2009 15.1 Minor Clarified the meaning of the technical content. 1/29/2010 15.2 Clarified the meaning of the technical content. 3/12/2010 16.0 Updated and revised the technical content. 4/23/2010 16.1 Minor Clarified the meaning of the technical content. 6/4/2010 16.2 Clarified the meaning of the technical content. 7/16/2010 16.2 None No changes to the
meaning, language, or formatting of the technical content. 8/27/2010 16.2 None No changes to the meaning, language, or formatting of the technical content. 10/8/2010 16.2 None No changes to the meaning, language, or formatting of the technical content. 11/19/2010 17.0 Updated and revised the technical content. 1/7/2011 17.1 Minor Clarified the meaning of the technical content. 2/11/2011 17.2 Clarified the meaning of the technical content. 3/25/2011 17.3 Minor Clarified the meaning of the technical content. 5/6/2011 17.3 None No changes to the meaning, language, or formatting of the technical content.
6/17/2011 17.4 Minor Clarified the meaning of the technical content. 9/23/2011 18.0 Major Updated and revised the technical content. 12/16/2011 19.0 Major Updated and revised the technical content. 3/30/2012 20.0 Updated and revised the technical content. 7/12/2012 21.0 Major Updated and revised the technical content. 10/25/2012 22.0 Major Updated and revised the technical content. 1/31/2013 23.0 Updated and revised the technical content. 8/8/2013 24.0 Major Updated and revised the technical content. 11/14/2013 25.0 Major Updated and revised the technical content. 2/13/2014 26.0 Major Updated and revised the technical content. 5/15/2014 26.0 None No changes to the
meaning, language, or formatting of the technical content. 6/30/2015 27.0 Major Significantly changed the technical content. 10/16/2015 27.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 28.0 Major Significantly changed the technical content. 6/1/2017 28.0 None No changes to the meaning, language, or formatting of the technical content.
ConcatenationOf( DES(K[0..6], D), \ DES(K[7..13], D), DES( \ Z(5)), D)); Note K[] implies a key represented as a character array. GetVersion() An auxiliary function that returns an operating system version-specific value (section ). , 3.1.5.1.2, 3.2.5.1.1, 3.2.5.1.2 LMGETKEY(U, D) Retrieve the user's LM response key from the server database ( or local database). 3.2.5.1.2 NTGETKEY(U, D) Retrieve the user's NT response key from the server database. 3.2.5.1.2 HMAC(K, M) Indicates the encryption of data item M with the key K the HMAC algorithm (). 3.3.2, 3.4.4 HMAC_MD5(K, M) Indicates the computation of a 16-byte HMAC-keyed MD5 message digest of the byte string M using the key K. 3.3.2, 3.4.4 KXKEY(K, LM, SC) Produces a key exchange key from the session base key, LM response and server challenge as defined in the sections KXKEY, SIGNKEY, and SEALKEY. 3.1.5.1.2, 3.2.5.1.2, 3.4.5.1 Computes a one-way function of the user's password to use as the response key. NTLM v1 and NTLM v2 define separate functions in the NTLM v1 authentication and NTLM v2 authentication sections, respectively. 3.1.5.1.2, 3.3.1, 3.3.2 MD4(M) Indicates the computation of an MD4 message digest of the null-terminated byte string M (). 3.3.1, 3.3.2 MD5(M) Indicates the computation of an MD5 message digest of the null-terminated byte string M (). 3.3.1, 3.3.2, 3.4.4, 3.4.5.2, 3.4.5.3
SIGNKEY(flag, K, string1) Produces a signing key from the session key as defined in sections SIGNKEY, and SEALKEY. 3.1.5.1.2, 3.4.5.2 Currenttime Indicates the retrieval of the current time as a 64-bit value, represented as the number of 100-nanosecond ticks elapsed since midnight of January 1st, 1601 (UTC). 3.1.5.1.2 UNICODE(string) Indicates the 2-byte byte order encoding of the Unicode UTF-16 representation of string. The Byte Order Mark (BOM) is not sent over the wire. 3.3.1, 3.3.2 UpperCase(string) Indicates the uppercase representation of string. 3.3.1, 3.3.2 Z(N) Indicates the creation of a byte of length N. Each byte in the array is initialized to the value zero. 3.3.1, 3.3.2
Index A Abstract data 39 39 variables 40 39 47 47 variables 48 47 59 15 23 Authentication 55 57 28 C Call flow 14 13 12 15 20 92 Client 39 39 variables 40 39 41 41 47 42 45 42 42 47 42 45 42 42 47 41 70 60 14 13 Cryptographic 82 70 D Data model - abstract 39 39 variables 40 39 47 47 variables 48 47 59 E Examples 70 70 69 NTLMv1 authentication 73 73 71 client challenge 76 75 74 NTLMv2 authentication 79 78 77 F 15 G 7 GSS_GetMICEx() 67 68 GSS_UnwrapEx() 66 67 GSS_VerifyMICEx() 68 68 GSS_WrapEx() 65 66 H Higher-layer triggered events 41 48 I 81 81
11 Initialization 41 48 7 K KXKEY ( 63, 63) L 31 31 Local events 47 55 M Message processing 42 45 42 42 49 54 49 49 Messages 16 16 N 31 17 10 NTLM 12 14 13 69 34 16 36 37 36 NTLMv1 55 71 73 73 client challenge 74 76 75 55 NTLMv2 57 77 79 78 55 34 35 O Other local events 47 55 11 P 81 15 15 85 Protocol Details 39 R 10 11 10 14 30 S SEALKEY ( 63, 64) Security 81 81 59 Sequencing rules 42 45 42 42 49 54 49 49 Server 47 47 variables 48 47 48 48 55 49 54 49 49 55 49 54 49 49 55 48 Session security 59 60