NLA Unicode Support

[awakecoding]

Network Level Authentication, unlike the older authentication mechanism, has an extra challenge when it comes to unicode support: the username and passwords must be uppercased in unicode. Even though the current development sources will correctly use iconv for the unicode conversion, there is no mechanism to properly uppercase unicode characters. Since this is required in order to compute the correct NTLMv2 response, authentication fails.

In order to complete NLA unicode support, proper unicode uppercasing must be implemented, and that is definitely not as trivial as doing US ASCII uppercasing.

[kiilerix]

For the record: The uppercasing only applies to the old LM passwords that for some reason is included as an insecure fallback in NTLM.

AFAICS the LM password is never used with NLA. It would be nice to have full support for the protocol, but it seems like it doesn't matter, never will be used, and can't be verified against MS servers.

[awakecoding]

Actually, I did provide an LM implementation, but after I got NLA working I realized I could simply zero out the LmChallengeResponse. I don't think that we would encounter a server requiring a valid LmChallengeReponse, so I could just get rid of the LM authentication code completely, and just keep NTLMv2.

[awakecoding]

@KILLERIX: uppercasing also happens in NTLMv2, not just LM.

[kiilerix]

On 03/16/2011 06:34 PM, awakecoding wrote:

@KILLERIX: uppercasing also happens in NTLMv2, not just LM.

Ok, yes, I was only referring to uppercasing of passwords.

Do unicode usernames (and domains) generally work ok - also with NLA? I
would assume that even if it worked in theory there would be so many
problems in strange places that it really wouldn't work.

[awakecoding]

Ok, regarding what gets uppercased, I looked back at the source code, and only the username is uppercased, not the password. This means that unicode passwords should work properly, but not unicode usernames with non US ASCII characters.

[otavio]

And does Microsoft client properly handle it?

[awakecoding]

Yes it does, Microsoft has its own Unicode conversion API: http://msdn.microsoft.com/en-us/library/ff563005/

Wine apparently has its own implementation for it