LANMAN C/R and NTLMv1 use the same padding, splitting, and encrypting steps. What is different between them?

• A. Only the final hash differs; padding/splitting/encrypting steps are the same.
• B. Padding length differs.
• C. They use different encryption algorithms.
• D. NTLMv1 uses MD5.

Answer: (A)

The idea being tested is that LANMAN (LM) and NTLMv1 share the same DES-based challenge-response mechanism, but they differ in what value is fed into that mechanism, which changes the final output.

In LM, you take the password, convert it to uppercase, pad or truncate it to 14 bytes, split that into two 7-byte pieces, turn each into a DES key, and DES-encrypt the server challenge with each key. The two 8-byte results are concatenated to form a 16-byte LM response.

In NTLMv1, you first compute the NTLM hash by applying MD4 to the Unicode password, producing a 16-byte value. You then split this 16-byte hash into three 7-byte pieces (padding the last piece as needed), convert those into three DES keys, and DES-encrypt the server challenge with each key. The three results are concatenated to yield a 24-byte NTLMv1 response.

So the same padding/splitting/encrypting steps are used, but the input material and thus the final hash differ, giving a different length and content. NTLMv1 relies on the MD4-hashed password, not MD5, and the final output is 24 bytes rather than 16.