Why does a target service that enforces SMB signing break a relayed NTLM session?

## What signing actually is Message signing on a session protocol means every message after authentication carries a keyed integrity value, and the receiver recomputes and compares it. The key is not a configured shared secret; it is a session key derived during authentication from key material tied to the authenticating account. That derivation is the whole point of this question. ## Why the relay operator cannot produce it The operator's position is defined by an absence: they possess no key material at all. They obtained a valid authentication by having the coerced host compute the answer and by carrying that answer to the far end. Both genuine parties - the coerced host and the target service - end the handshake holding the derived session key. The operator, standing between them, holds neither. So the sequence against a signing-enforcing destination is: the authentication succeeds, the target opens a session, the operator sends their first real request, and it either goes unsigned or carries garbage. The target rejects it and tears the session down. The technique gets an authenticated session it cannot use, which is the same as getting nothing. This is worth stating precisely, because it is the part candidates get backwards: signing does not prevent the relayed authentication. The authentication succeeds. Signing removes the *use* of what the authentication bought. ## Enforcement belongs at the destination A common wrong answer is that turning signing on everywhere, starting with clients, closes the hole. Requiring signing on the coerced host does not stop the relay, because the operator does not need that leg to survive. They need the client to produce authentication messages; once those are in hand, the client's session is disposable. The operator never intended to talk to it again. The control has to be enforced by the party that accepts the identity and grants access. That reframing matters for planning: the estate does not have to be uniform, it has to have no valuable destination left unenforced. Relay is a shopping exercise. The operator holds an authentication that no message states an audience for, and looks for any service that will accept it and let them act. One unenforced service that matters is the whole answer. ## Session binding is not audience binding Here is the property this technique turns on. Signing binds a message stream to the session it was negotiated in - it guarantees that whoever continues talking is the party that authenticated. It carries no statement about which service the client believed it was authenticating to. The coerced host produced an authentication that is, semantically, an assertion of identity with no addressee. So signing is a per-destination control that happens to defeat relay as a side effect of denying the session to a party without the key. It is not a fix for relay as a class. Give the operator a service that accepts the same identity and does not enforce signing, and the same authentication is spent there instead. The controls that attack the class directly are the ones that put an addressee into the exchange - the client stating the service name it intended, and the client mixing the transport channel into its response - so that a forwarded authentication is refused on arrival rather than made useless afterwards. ## Where signing is not even available A further limitation: not every protocol that accepts these identities has a signing story. Services fronted by TLS commonly do not sign at the application layer, on the reasonable assumption that the transport is protecting the stream. For those destinations, session signing is not the lever at all, and the channel and service binding properties are the only ones that apply. ## How to say this in an interview The compact answer has three beats. First: the session key comes from the account's key, and the operator never had it. Second: therefore the authentication lands and the first request fails, so enforcement must be at the destination that grants access, not at the host that was coerced. Third: what this buys is protection for the enforcing service only, because a signed session says which conversation you are in and never says which conversation you were supposed to be having. An interviewer following up will usually push on cost: enforcement is refused somewhere in most estates because something in the fleet cannot negotiate it, and the useful instinct is to price that exception per unenforced destination rather than per legacy device.