3.4.4.2 With Extended Session Security

  • Article

When Extended Session Security (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) is negotiated and session security (NTLMSSP_NEGOTIATE_SIGN or NTLMSSP_NEGOTIATE_SEAL) is negotiated, the message signature for NTLM with extended session security is a 16-byte value that contains the following components, as specified by the NTLMSSP_MESSAGE_SIGNATURE structure (section 2.2.2.9.1):

  • A 4-byte version-number value that is set to 1 (Version).

  • The first eight bytes of the message's HMAC_MD5 (Checksum).

  • The 4-byte sequence number (SeqNum).

If message integrity is negotiated, the message signature is calculated as follows:

 -- Input: 
 --   SigningKey - The key used to sign the message.
 --   SealingKey - The key used to seal the message or checksum.
 --   Message - The message being sent between the client and server.
 --   SeqNum - Defined in section 3.1.1.
 --   Handle - The handle to a key state structure corresponding to the
 --   current state of the SealingKey
 --
 -- Output:
 --   An NTLMSSP_MESSAGE_SIGNATURE structure whose fields are defined 
      in section 2.2.2.9.
 --   SeqNum - Defined in section 3.1.1.
 --
 -- Functions used: 
 --   ConcatenationOf() - Defined in Section 6.
 --   RC4() - Defined in Section 6.
 --   HMAC_MD5() - Defined in Section 6.
  
 Define MAC(Handle, SigningKey, SeqNum, Message) as 
      Set NTLMSSP_MESSAGE_SIGNATURE.Version to 0x00000001
      Set NTLMSSP_MESSAGE_SIGNATURE.Checksum to 
          HMAC_MD5(SigningKey,
          ConcatenationOf(SeqNum, Message))[0..7]
      Set NTLMSSP_MESSAGE_SIGNATURE.SeqNum to SeqNum
      Set SeqNum to SeqNum + 1 
 EndDefine

If a key exchange key is negotiated, the message signature for the NTLM security service provider is the same as in the preceding description, except the 8 bytes of the HMAC_MD5 are encrypted with RC4, as follows: 

 Define MAC(Handle, SigningKey, SeqNum, Message) as 
      Set NTLMSSP_MESSAGE_SIGNATURE.Version to 0x00000001
      Set NTLMSSP_MESSAGE_SIGNATURE.Checksum to RC4(Handle,  
      HMAC_MD5(SigningKey, ConcatenationOf(SeqNum, Message))[0..7])
      Set NTLMSSP_MESSAGE_SIGNATURE.SeqNum to SeqNum
      Set SeqNum to SeqNum + 1
 EndDefine