Difference between Kerberos and NTLM

Computer NetworkInternetMCA


Kerberos is a ticket establish authentication system used to confirm the user's information while signing into the system. It is based on the uniformity of key cryptography. It relies on the consistent third party and performs on the private key encoding during the confirmation stage.

Various versions of Kerberos are introduced to intensify security in authentication. Kerberos is generally executed in Microsoft products like Windows 2000, Windows XP and newer versions of Windows.


New technology LAN Manager (NTLM) is a collection of security protocols presented by Microsoft to the genuine user's identity. And secure the integrity and hush of their activity. NTLM is a single sign-on (SSO) device that depends on a challenge-reaction protocol. To support users without wanting them to give in a password.

Despite susceptibility, NTLM remains extensively established and that too on the new systems, to manage the similarity with estate clients and servers. However, NTLM is currently supported by Microsoft. The Kerberos replaces NTLM as the default confirmation protocol in Windows 2000 and Subsequent Active Directory (AD) estate.

Difference between Kerberos and NTLM

The following table highlights the major differences between Kerberos and NTLM −

Kerberos is an authenticated open-source software that offers a free system.NTLM is the Microsoft confirmation protocol.
Kerberos supports the delegacy of authenticity in the multistage requisition.It does not keep up with the delegation of authenticity.
It keeps up with two-part confirmation such as smart card logon.NTLM does not give a smart card logon.
This protocol has the function of common authentication.This protocol does not have a common authentication function.
Kerberos provide excessive security.Security is low as compared to the Kerberos.
Kerberos holds up in Microsoft Windows 2000, Windows XP, and newer versions of Windows.NTLM is supported in the previous versions of Windows like Windows 95, Windows 98, Windows ME, NT 4.0.

NTLM replaced by Kerboes

NTLM is a subject matter to much-known security amenability linked to password hashing and distorting. In the NTLM protocol, the password is stored on the server, and the province device are not distorted, which means that a casual string of characters is not added to the hashed password to preserve it in future from splitting techniques.

It means that the challenger who owns the password hash does not need the primary password to confirm a session. This results in the system is at risk to beast strength attacks, which is when the attacker makes an effort to hack the password via various login attempts. However, if the user selects the weak password, they are easily exposed to such strategies.

HTML cryptography breaks down to benefit the advancement in algorithms and encryption, which remarkably amplify security potentiality.

How to protect your network using NTLM?

Crowdstrike suggests that corporations try to reduce the usage of NTLM in their network soon, as there is so much security risk. For the corporation, which is still dependent upon NTLM for a similar purpose. Crowdstrike offers the given recommendation to increase security and reduce the risk.

To get protected wholly from the NTLM relay strike, it would be best if you allowed the server signing and EPA on all the appropriate servers. Assure that your systems are completely secured with the newer security updates from Microsoft.

Published on 19-Aug-2021 11:56:34