A short description of NTLM
NTLM is a security protocol used in Microsoft Networks. It is the main approach used by Microsoft to implement single sign-on. It is also used for HTTP authentication and also in Exchange, as well as CIFS/SMB, Telnet and SIP.
NTLM uses a challenge response authentication mechanism, in which users are able to establish their identity without the use of a password. This is generally handled by a certificate that the user already had in their poccession. It includes three exchanges, in general known as Type1 (negotiation), Type2 (challenge) and Type3 (authentication). The exchanges work on the following basis.
The client generates and sends a Type 1 communication to the server. This contains a feature supported by the client and requested of from the server.
The server responds with a Type 2 communication. This contains the features decided to be supported by the server. More notably however, it contains a challenge generated by the server.
The client responds to the challenge with a Type 3 communication. This contains a number of pieces of data about the client, including the domain and users name of the client user along with the secret key. This secret key that has been sent should match the secret key that is held by the server.
Finally Digital signatures can be managed. This means that the signed message has not been intercepted and means the sender is privy to the shared secret. This could be a Radius client interating along with Active Directory whereby the shared secret is manually set within each configuration by the administrator. The keys used in signing and sealing are established as a by-product of the NTLM authentication process. Signing functionality is performed by the addition of a Message Authentication Code (MAC) to any message. This is checked by the server who can now be certain that the message integrity is safe. The signature is generated using the secret key, known by both the sender and receiver. The MAC can only be checked by any party holding the key.
Sealing is carried out by a different function, which adds encryption to a message to put a stop to it from being viewed by another party in transit. There are several encryption protocols used throughout signing and sealing, plus more are appearing frequently. As well as providing message integrity, communication discretion is ensured by the use of sealing. Under SSPI (Security Support Provider Interface) sealing (and signing) is at all times performed in combination with the same key. This encryption allows that a message cannot be intercepted or tampered with whatsoever. (Unless of course you are employed for the FBI).
NTLM is a popular authentication protocol. While there are other authentication protocols that are used, the straightforwardness of use and it’s integration with Microsoft leaves it as nearly all administrators number 1 choice.