In NTLMv2, what is used as the key in the first HMAC-MD5 operation?

• A. Server challenge
• B. Client challenge
• C. User's NT hash
• D. NTLMv2 specific hash

Answer: (C)

In NTLMv2, the first HMAC-MD5 uses the user’s NT hash as the key. The NT hash is the MD4 hash of the Unicode password, and that hash serves as the secret key for the first HMAC-MD5 calculation, with the data being the username in uppercase plus the domain. The result of this step is the NTLMv2 hash, which then becomes the key for the second HMAC-MD5 computation that combines the server challenge and a client blob to form the final response. So the key in the first HMAC-MD5 operation is the user’s NT hash.