I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication.

  1. Client sends the username and password to the server.

  2. Server sends a challenge.

  3. Client responds to the challenge with 24 byte result.
  4. Servers checks if the response is properly computed by contacting the domain controller.
  5. If everything is proper it grants the request.


  1. I am not able to understand what is happening after the client has sent the username and password. Especially the words "challenge" and "24 byte result"
  2. Which encryption method is while sending username/password to the server?

Here is the wording from official source:

The following steps present an outline of NTLM noninteractive authentication. The first step provides the user's NTLM credentials and occurs only as part of the interactive authentication (logon) process.

  1. (Interactive authentication only) A user accesses a client computer and provides a domain name, user name, and password. The client computes a cryptographic hash of the password and discards the actual password.
  2. The client sends the user name to the server (in plaintext).
  3. The server generates a 16-byte random number, called a challenge or nonce, and sends it to the client.
  4. The client encrypts this challenge with the hash of the user's password and returns the result to the server. This is called the response.
  5. The server sends the following three items to the domain controller:
    • User name
    • Challenge sent to the client
    • Response received from the client
  6. The domain controller uses the user name to retrieve the hash of the user's password from the Security Account Manager database. It uses this password hash to encrypt the challenge.
  7. The domain controller compares the encrypted challenge it computed (in step 6) to the response computed by the client (in step 4). If they are identical, authentication is successful.

So the challenge is a server generated message that is encrypted with the hash of the account password by the client and by the DC and compared on DC.

Encryption methods are variable between versions of NTLM and different server settings.

Here's a bit from Wikipedia:

Both LMv2 and NTv2 hash the client and server challenge with the NT hash of the user's password and other identifying information. The exact formula is to begin with the NT Hash, which is stored in the SAM or AD, and continue to hash in, using HMAC-MD5, the username and domain name.

  • Grigory, are you aware of a tool where I can see all these 5 steps? If I want to see response and challenge. Is it possible with Wireshark? – one Jul 12 '16 at 9:22
  • I am pretty sure Wireshark should capture at least challenge and response activity, however I didn't have to excercise this activity. Whatever DC does to compare and make a decision wouldn't be in the capture, ofcourse. – Grigory Sergeev Jul 12 '16 at 9:26
  • @one, have you figured a scenario in which this kind exchange occurs? – kroiz Apr 29 '18 at 11:09

Your Answer

