2.2.2.4 LMv2_RESPONSE

The LMv2_RESPONSE structure defines the NTLM v2 authentication LmChallengeResponse in the AUTHENTICATE_MESSAGE. This response is used only when NTLM v2 authentication is configured.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
Response (16 bytes)
...
...
ChallengeFromClient
...

Response (16 bytes): A 16-byte array of unsigned char that contains the client's LM challenge-response. This is the portion of the LmChallengeResponse field to which the HMAC_MD5 algorithm has been applied, as defined in section 3.3.2. Specifically, Response corresponds to the result of applying the HMAC_MD5 algorithm, using the key ResponseKeyLM, to a message consisting of the concatenation of the ResponseKeyLM, ServerChallenge and ClientChallenge.

ChallengeFromClient (8 bytes): An 8-byte array of unsigned char that contains the client's ClientChallenge (as defined in section 3.3.2). See section 3.1.5.1.2 for details.