Struct NtlmSession 

pub struct NtlmSession { /* private fields */ }

NTLM session state for message encryption/decryption after authentication.

Derived from the NTLMv2 authentication exchange per MS-NLMP section 3.4.4. Provides seal (encrypt+sign) and unseal (decrypt+verify) for WinRM message-level encryption over HTTP.

Usage

After completing the NTLM handshake with create_authenticate_message_with_key, use the returned exported session key to create an NtlmSession:

let (type3_msg, session_key) = create_authenticate_message_with_key(...);
let mut session = NtlmSession::from_auth(&session_key);
let sealed = session.seal(b"plaintext payload");

The actual integration into the HTTP transport (MIME multipart framing for encrypted payloads) is deferred to a future release.

Implementations

impl NtlmSession

pub fn from_auth(exported_session_key: &[u8; 16]) -> Self

Derive a session from the exported session key produced during the NTLMv2 authentication exchange.

Computes the four session keys (client/server seal/sign) per MS-NLMP section 3.4.4 and initializes the RC4 cipher handles.

pub fn seal(&mut self, plaintext: &[u8]) -> Vec<u8>

Seal (encrypt + sign) a message for sending to the server.

Returns signature (16 bytes) || ciphertext. The signature contains:

• Version (4 bytes, always 1)
• Encrypted HMAC-MD5 checksum (8 bytes)
• Sequence number (4 bytes, little-endian)

pub fn sign(&mut self, data: &[u8]) -> [u8; 16]

Compute an NTLM signature over data (no encryption of payload). Returns the 16-byte NTLMSSP_MESSAGE_SIGNATURE per MS-NLMP 3.4.4.1 (with extended session security + key exchange). Consumes 8 bytes of the client RC4 keystream and increments the client sequence number.

pub fn unseal(&mut self, sealed: &[u8]) -> Result<Vec<u8>, NtlmError>

Unseal (decrypt + verify) a message received from the server.

Expects sealed to be signature (16 bytes) || ciphertext. Verifies the signature version and sequence number. Returns the decrypted plaintext.

Errors

Returns NtlmError::InvalidMessage if:

• The message is shorter than 16 bytes
• The signature version is not 1
• The sequence number does not match the expected value
• The HMAC-MD5 checksum does not match the expected value