Computer networks are sus­cep­ti­ble to cy­ber­at­tacks if they are not protected against them properly. Networks are protected by not allowing every single user access to shared data and services. In this way, only a des­ig­nat­ed user can access a network. Protected entryways have to be in­te­grat­ed into an otherwise closed network. This requires the in­stal­la­tion of certain safety pro­ce­dures. With the NT LAN Manager (NTLM), Windows in­tro­duced its own au­then­ti­ca­tion protocol back in 1993, but the protocol is now con­sid­ered largely outdated. How does ntlm au­then­ti­ca­tion work?

What is NTLM?

NTLM is a col­lec­tion of au­then­ti­ca­tion protocols created by Microsoft. Initially a pro­pri­etary protocol, NTLM later became available for use on systems that did not use Windows. The NT LAN Manager allows various computers and servers to conduct mutual au­then­ti­ca­tion. Most networks attempt to deny access to unau­tho­rized users, which requires im­ple­men­ta­tion of an au­then­ti­ca­tion process.

The protocol requires a client to be au­then­ti­cat­ed by providing a username and a cor­re­spond­ing password. This allows for an exchange to be es­tab­lished between the user’s device and a server. After the user’s log-in cre­den­tials have been rec­og­nized, the server can then check access rights and allow the user entry.

How does NTLM au­then­ti­ca­tion work?

NTLM uses a challenge-response protocol to check a network user’s au­then­tic­i­ty. To do so, the client and host go through several steps:

  1. The client sends a username to the host.
  2. The host responds with a random number (i.e. the challenge).
  3. The client then generates a hashed password value from this number and the user’s password, and then sends this back as a response.
  4. The host knows the user’s password and generates a hashed password value which it can then compare to the client’s response.
  5. If both values match, the au­then­tic­i­ty of the client is confirmed, and network access is granted. If there is no match between the values, the client will be denied access.
Image: Exchange between a client and server during NTLM authentication
With NTLM, the client must first answer a challenge correctly before access to network services can be granted.
Fact

To keep a password sent over a network from being read by unau­tho­rized third parties, a hash function is used in which the password is converted into an in­com­pre­hen­si­ble string of numbers with the help of a math­e­mat­i­cal function. Since this con­ver­sion cannot be undone very easily, hash functions play a very important role in cryp­tol­ogy.

In­for­ma­tion is partially relayed in the form of NTLM flags during the exchange between a client and a host. These are codes with a length of 4 bytes. Ne­go­ti­a­tion flags, which sometimes only differ from each other by one byte, provide in­for­ma­tion on the status of the sign-in process.

Ap­pli­ca­tions of NTLM

The NTLM protocol was conceived to connect several Windows machines to one another or to a server. The protocol provides security through the mon­i­tor­ing of clients’ access rights. Windows uses NTLM as a single sign-on process (SSO); users only have to log in once to then have access to various ap­pli­ca­tions within the domain.

NTLM is now con­sid­ered outdated, and Microsoft uses Kerberos instead. This newer au­then­ti­ca­tion protocol is more secure. However, NTLM is still in use, es­pe­cial­ly to support older services. If you are an ad­min­is­tra­tor of a larger network, it may be advisable to stop using the NTLM protocol where it is not necessary. This will help to ensure that no client un­in­ten­tion­al­ly logs in to the network while using it, thereby creating a potential security breach.

NTLM protocol: pros and cons of this method

One advantage is that au­then­ti­ca­tion through NTLM does not require users to send passwords un­pro­tect­ed via the network. Password delivery from the client to the server is only done in the form of hashed values which provide a high level of security. However, hashed values have the dis­ad­van­tage of being equiv­a­lent to a password. If the trans­mis­sion is in­ter­cept­ed, the very security promised by the system can be com­pro­mised. Passwords are encrypted through MD4. This process is now con­sid­ered unsecure since these hashed values can be decrypted with rel­a­tive­ly little effort.

A further dis­ad­van­tage is that NTLM does not include multi-factor au­then­ti­ca­tion (MFA). It is advisable to implement several security mech­a­nisms, es­pe­cial­ly when sharing sensitive data. The challenge-response protocol in NTLM only allows for a single au­then­ti­ca­tion method: that of using a username and password.

Go to Main Menu