NTLM V1 and V2 Differentiation Against Kerbero | CalCom Software

Kerberos, NTLMv1 and NTLMv2 are the three different authentication protocols. These protocols seek to improve security, especially in the Active Directory environment. Authentication protocols are widely used in attack techniques. They might facilitate the access and privilege-escalation of intruders. So it's important to choose the most trustworthy protocol and be aware of its shortcomings.

The underlying fact that the NTLMv1 protocol is the oldest of the three is shown when NTLM v1 and v2 are compared to Kerberos. NTLMv2 offers a few minor security-enhancing upgrades. The authentication process using Kerberos is significantly more complex and secure.

AUTHENTICATION of NTLMV1: 

NTLM was made by Microsoft. Both current and vintage Windows versions are compatible with it (Windows 95, Windows 98, Windows ME, N.T 4.0).

• The NTLM authentication protocol uses a challenge-response mechanism.

• A user connects on to a client computer using a domain name, username, and password.

• The client computer uses cryptography to create an NT or KM hash of the password.

• The client computer sends the username in plain text to the desired server.

• The challenge is that the targeted server generates and delivers the client machine a 16-byte random number.

• The client machine responds to the challenge by sending the user's password hash.

• The server sends the domain controller the username, challenge, and response (DC).

• The DC asks the Security Account Manager for the hash of the user password using the username.

• The DC encrypts the challenge.

• The client's encrypted response to the challenge that the DC has encrypted is examined by the DC. If they exactly match, the authentication is accepted.

Authentication of NTLMV2

Although NTLM v2 differs from NTLM v1 in two ways, the overall structure remains the same:

The client includes a timestamp while transmitting the username to the client (stage 3). 2. The targeted server generates a variable-length challenge (as an alternative to the 16-byte challenge). These modifications aid in relay attack mitigation. But since NTLMv2 still uses the same authentication technique, it can still be vulnerable to more NTLMv1 problems.

NTLM only allows one-way authentication from the client to the server using the challenge-response mechanism. This lessens NTLM security because the client could unintentionally verify in the presence of a fake server.

Authentication of KERBEROS 

The Kerberos protocol is free and open-source software. Newer versions of Windows are supported (Windows 2000, Windows XP, and beyond) (Windows 2000, Windows XP, and later).

The Kerberos authentication procedure is more challenging than NTLM. Kerberos uses mutual authentication and supports two-factor authentication. It uses tickets and a token to verify the client.

NTLM v1 and v2 vs Kerberos

Now comparing, NTLM v1 and v2 vs Kerberos features:

Security: Since no passwords are stored or sent over the network, it is bad for NTML v1, better for NTML v2, and ideal for Kerberos.

Performance: NTLM v1 and NTML v2 both have slower authentication but Kerberos has faster authentication.

Delegation Support: While Kerberos enables delegation of authenticity and impersonation, NTLM v1 and NTML v2 only support impersonation.

Multi-Factor Verification – Smart Cards: NTLM v1 and NTLM v2 do not support them; Kerberos, on the other hand, does.

Cryptography: NTLM v1 and NTML v2 both support symmetric cryptography, while Kerberos also supports both asymmetric and symmetric cryptography.

Reliable third party: KDC, DC (and Windows Enterprise Certification Authority in Kerberos PKINIT) for Kerberos, and DC for NTLM v1 and NTML v2.

Mutual authentication: NTLM v1 and NTML v2 do not support it, but Kerberos does.

Conclusion

These situations can be challenging to find. For this reason, it is recommended to automate this operation. The application of hardening solutions will notify you of any instances where NTLM is being used, as well as any instances where you can disable NTLM and use only Kerberos without causing any harm. Additionally, it will put your policy into practise in the real working environment to ensure that everything is set up correctly. Finally, it will monitor any setting drifts and make the necessary corrections to keep you secure and compliant.