public function isValidResponse($username, $hash, $challenge)
	{
		if(self::NTLM_BLOB_HEADER != substr($this->clientBlob, 0, 8))
		{
			return false;
		}
	
		// Timstamp, seconds since january 1, 1601, used in replay-attack prevention.
		// 	$str = (float)vsprintf('%u%04u%04u%04u', array_reverse(unpack('vt1/vt2/vt3/vt4', substr($this->clientBlob, 8, 8))));
		// 	$seconds = floor($str / 1000000);
	
		// Client nonce, useful in replay-attack prevention.
		// 	$cnonce = substr($this->clientBlob, 16, 8);
	
		if(!SecurityUtil::timingSafeEquals($username, $this->username))
		{
			return false;
		}
		
		if(!SecurityUtil::timingSafeEquals($this->provider->getDomain(), $this->domain))
		{
			return false;
		}
		
		$ntlmhash = $this->computeHmacMd5($hash, $this->encodeUtf16(strtoupper($this->username) . $this->domain));
		$hash = (string)$this->computeHmacMd5($ntlmhash, $challenge . $this->clientBlob);
		
		if(!SecurityUtil::timingSafeEquals($hash, $this->clientHash))
		{
			return false;
		}
		
		return true;
	}
public function isValidResponse($username, $hash, $challenge)
	{
		if(self::NTLM_BLOB_HEADER != substr($this->clientBlob, 0, 8))
		{
			return false;
		}
	
		// Timstamp, seconds since january 1, 1601, used in replay-attack prevention.
		// 	$str = (float)vsprintf('%u%04u%04u%04u', array_reverse(unpack('vt1/vt2/vt3/vt4', substr($this->clientBlob, 8, 8))));
		// 	$seconds = floor($str / 1000000);
	
		// Client nonce, useful in replay-attack prevention.
		// 	$cnonce = substr($this->clientBlob, 16, 8);
	
		if(!SecurityUtil::timingSafeEquals($username, $this->username))
		{
			return false;
		}
		
		if(!SecurityUtil::timingSafeEquals($this->provider->getDomain(), $this->domain))
		{
			return false;
		}
		
		$ntlmhash = $this->computeHmacMd5($hash, $this->encodeUtf16(strtoupper($this->username) . $this->domain));
		$hash = (string)$this->computeHmacMd5($ntlmhash, $challenge . $this->clientBlob);
		
		if(!SecurityUtil::timingSafeEquals($hash, $this->clientHash))
		{
			return false;
		}
		
		return true;
	}
public function isValidResponse ( $ username , $ hash , $ challenge ) { if ( self :: NTLM_BLOB_HEADER != substr ( $ this -> clientBlob , 0 , 8 ) ) { return false ; } // Timstamp, seconds since january 1, 1601, used in replay-attack prevention. // 	$str = (float)vsprintf('%u%04u%04u%04u', array_reverse(unpack('vt1/vt2/vt3/vt4', substr($this->clientBlob, 8, 8)))); // 	$seconds = floor($str / 1000000); // Client nonce, useful in replay-attack prevention. // 	$cnonce = substr($this->clientBlob, 16, 8); if ( ! SecurityUtil :: timingSafeEquals ( $ username , $ this -> username ) ) { return false ; } if ( ! SecurityUtil :: timingSafeEquals ( $ this -> provider -> getDomain ( ) , $ this -> domain ) ) { return false ; } $ ntlmhash = $ this -> computeHmacMd5 ( $ hash , $ this -> encodeUtf16 ( strtoupper ( $ this -> username ) . $ this -> domain ) ) ; $ hash = ( string ) $ this -> computeHmacMd5 ( $ ntlmhash , $ challenge . $ this -> clientBlob ) ; if ( ! SecurityUtil :: timingSafeEquals ( $ hash , $ this -> clientHash ) ) { return false ; } return true ; }
Needs the MD4 hash of the UTF-16LE encoded password of the user in hex- or binary format.

@param string $username
@param string $hash
@param unknown $challenge
Needs the MD4 hash of the UTF - 16LE encoded password of the user in hex - or binary format .