Which of the following statements are true about NTLMv1? Each correct answer represents a complete solution. Choose all that apply.

NTLMv1 is a legacy challenge-response authentication protocol. In this mechanism, a server sends a challenge (a random nonce) to a client, and the client responds by encrypting this challenge with a key derived from the user's password hash. For backward compatibility, NTLMv1 clients compute and send responses based on both the weak LANMAN hash and the stronger (but still flawed) NT hash. While Kerberos is the preferred authentication protocol within an Active Directory domain, NTLM is commonly used as a fallback or as the primary protocol in workgroup environments where no domain controller is present.

D. It uses the MD5 hash of the user's password. This is incorrect. The NTLM hash, which is a core component of NTLMv1, is based on the MD4 hashing algorithm, not MD5.

1. Microsoft Corporation. (2021). [MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol. Microsoft Docs.

Section 3.3.1

"NTLM v1 Authentication": This section details the computation for both the LmChallengeResponse and NtChallengeResponse. It explicitly shows that the LmChallengeResponse is derived from the LANMAN hash

confirming option A. The NtChallengeResponse is derived from the NTLM hash (NTOWFv1)

which is defined as MD4(UNICODE(password))

refuting option D.

Section 1.3

"Protocol Overview": This section describes the fundamental message flow

stating

"NTLM is a challenge-response authentication protocol

" which validates option C.

2. Microsoft Corporation. (2023). NTLM overview. Microsoft Learn.

"Where NTLM is used" section: This document states

"NTLM is also used for authentication on standalone computers." and "For environments where an Active Directory domain controller isn't available

NTLM can be used." This supports the statement that NTLM is predominantly used when no Active Directory domain exists (option B)

as Kerberos is the default in domain environments.

3. Boneh

D. (2022). CS 255: Introduction to Cryptography

Lecture 15. Stanford University.

Slide 18

"NTLM Authentication": The lecture notes describe NTLM as a "Challenge-response protocol for authentication in Windows" and note its use in "standalone systems and workgroups." This corroborates that NTLM is a challenge-response protocol (option C) and is primarily used in non-domain environments (option B).