The NTLM algorithm does not directly transmit passwords for identity authentication. (Challenge/response challenge reply)

NTLM Algorithm, Good idea. Do not directly transfer the password for authentication. (Challenge reply)
Http://msdn2.microsoft.com/en-us/library/aa378749.aspx

Related keywords:

KerberosNegotiateSspi

Negotiate is an SSP, which selects other appropriate specific SSP based on the user's Environment (more like a redirection, negotiation): NTLM or Kerberos. NTLM is a relatively old SSP with extensive support. Kerberos is a new and better SSP, but does not support NT4.0 or earlier versions. Generally, you do not directly call NTLM or Kerberos, but call negotiate. The Negotiate policy is that if the user system does not support Kerberos or does not provide information that supports Kerberos, negotiate will return NTLM to the client by default.