NTLM is an authentication protocol that allows clients to prove their identity to a server without sending a password. It uses a 3-message handshake of negotiation, challenge, and authentication. However, NTLM has security issues as it hashes passwords in a way that is not truly one-way, making passwords easier to crack such as converting all lowercase passwords to uppercase before hashing. NTLM does not use cryptographic salts and hashes can be cracked within hours via brute force attacks. As a result, NTLM has been replaced by the more secure Kerberos authentication protocol as the preferred choice for Microsoft environments.

1. Windows New Technology
LAN Manager

2. NTLM Protocol
NTLM is a mechanism for
authentication.
Can prove identities without sending a
password to the server.
NTLM has a ‘Hash Security’ issue

3. How it works
NTLM has three messages:
Type 1:
Negotiation
Type 2:
Challenge
Type 3:
Authentication

4. LM Hash Security Issue
Not a true one-way function
Passwords longer than 7 characters
are divided into 2 pieces. Each piece
is hashed separately.
All lowercase passwords are
changed to uppercase before
hashed, making it easier to crack.

5. LM Hash Security Issue:
Doesn’t use cryptographic salt –
Ophcrack can crack LM encryption.
Implementation – change only when
user changes password.
Brute force attacks can be cracked
in hours.

6. NTLM Replaced by
Kerberos
NTLM has been replaced by Kerberos.
Kerberos is the most secure authentication and
best choice for Microsoft SharePoint Server.