On Tue May 13 19:00:57 2025 +0000, Dmitry Timoshkov wrote:
On the other hand if integrity or confidentiality are not reported as used after a successful creation of the context I'm not sure how such an NTLM context could be considered as a secure/valid one.
It makes sense to let the caller decide what's sufficiently secure. If authentication is done over SSL for example then confidentiality doesn't matter much.