What is the main difference between LAN MAN and NTLMv1 challenge/responses?

NTLMv1 begins with the 16-byte NT hash (the 'IS bytes' reference likely denotes this 16-byte intermediate value), whereas LANMAN pads its hash to a full 21-byte working value by appending 5 null bytes before the DES key derivation step. This structural difference in how each protocol prepares the hash prior to splitting it into three 7-byte DES keys is the core distinguishing mechanism. Recognizing this padding distinction is essential to understanding how each protocol derives its three challenge/response DES keys.

While it is true that NTLMv1 uses the NT hash and LANMAN uses the LM hash as input, the answer does not accurately capture the specific structural padding difference that distinguishes the two challenge/response mechanisms.

Both NTLMv1 and LANMAN challenge/response use DES to encrypt the server challenge - NTLMv1 does not replace DES with a different cipher; MD4 is used only to generate the NT hash, not in the challenge/response encryption step itself.

Both NTLMv1 and LANMAN split the padded value into three 7-byte pieces (not eight-byte pieces) to use as DES keys, so this choice incorrectly describes the split size for both protocols.