[cifs-protocol] MS-NRPC: AES Schannel problems

Hongwei Sun hongweis at microsoft.com
Tue Aug 25 10:28:47 MDT 2009


   Thanks for your question.  I will be working on this request.  I will let you know as soon as I complete the investigation.


Hongwei  Sun - Sr. Support Escalation Engineer
DSC Protocol  Team, Microsoft
hongweis at microsoft.com
Tel:  469-7757027 x 57027

-----Original Message-----
From: Stefan (metze) Metzmacher [mailto:metze at samba.org]
Sent: Tuesday, August 25, 2009 11:13 AM
To: Interoperability Documentation Help
Cc: pfif at tridgell.net; cifs-protocol at samba.org
Subject: MS-NRPC: AES Schannel problems


I'm currently trying to implement the AES based Netlogon Secure Channel in Samba.

But the documentation is not really clear about the used algorithms.

I have started with the implementation here:

And here's the actual commit that tries to add aes support:

In Section " Session-Key Computation" the hmac-sha256 base computation of the session-key seems to use the plain SharedSecret and not the NT-HASH of it (MD4(UNICODE(ShareSecret))), is that correct?
I thought the plain text is never stored in AD by default...
Where should the netlogon server get the plain text from?
I just tried the NT-HASH see my netlogon_creds_init_hmac_sha256() function.

In Section " Netlogon Credential Computation" there's a AesEncrypt function used. Can you please document the exact algorithm that's used there. You say AES128 is used in CFB mode without initialization vector.

says that all modes except ECB require an IV.

It would also be nice if you could add some more example values in secion 4.2 Cryptographic Values for Session Key Validation.


More information about the cifs-protocol mailing list