Subject: RE: GSSAPI/AES draft

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 1 Sep 2003 12:37:40 -0700

Martin, 

For starters, NTLM/SSPI has two parts: context initiations and
per-message protection. The UI you mentioned below is referring to the
context initiation portion; there is another UI for the per-message
portion too.

Our discussion about cipher-state chaining in particular was mostly
relevant to the per-message tokens.

You can get more information at
http://members.microsoft.com/consent/Info/default.aspx.

Thx. 

Larry

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Monday, September 01, 2003 12:25 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; [email-masked]; JK Jaganathan;
[email-masked]
Subject: Re: GSSAPI/AES draft

Liqiang\ wrote:
> 
> Martin, your point (2) is applicable only to NTLMv1/SSPI, which is
> turned off on win2ksp3/winxp/ws2003 and can NOT be turned on at the
API
> level.

Well, I don't quite believe that.
I have a W2Ksp4 (no Domain) here and the local security policy option
for "LAN Manager authentication level" is still at its default value
of "Send LM & NTLM responses".

I tried to use any of the Settings that has NTLMv2 in it, but when
I do that, then my NT4sp6a Workstation (which has joined an NT4-domain)
can no longer connect to shares of my W2K machine...

So even if I wanted to, I seem to be unable to use NTLMv2,
and it certainly isn't the default on W2Ksp4.

-Martin