title: Why can't NTLM double hop?
body: <p>My understanding is that NTLM is a challenge response protocol, whereas Kerberos passes a ticket around. Most information I come across just says this is the reason Kerberos can double hop but NTLM can't, without explaining why NTLM can't just forward responses and challenges. </p>
  
  <p>I.e., why isn't this scenario possible:</p>
  
  <p>A client authenticates with a front end server, the front-end server then needs to authenticate with a back-end server on the clients behalf. The front end then attempts to authenticate and sends the user's name, the back-end then issues a challenge to the front end, the front end forwards this challenge to the client, the client issues a response that the front-end then forwards this response to the back-end.</p>
  
  <p>I know that it doesn't work like this, but I am curious about specifics. Why can't a server forward responses and challenges allowing for a double hop?</p>
  
  <p>Thanks.</p>