>Thanks to Luke Howard for suggesting that NTLM2 signing might use
>ADEA!


It's AEAD, and it's in generic composition mode. Cf inter alia
http://www.cs.berkeley.edu/~daw/talks/FSE04eax.ppt.


cheers,

-- Luke