public function isValidResponse($username, $hash, $challenge)
	{
		if(self::NTLM_BLOB_HEADER != substr($this->clientBlob, 0, 8))
		{
			return false;
		}
	
		// Timstamp, seconds since january 1, 1601, used in replay-attack prevention.
		// 	$str = (float)vsprintf('%u%04u%04u%04u', array_reverse(unpack('vt1/vt2/vt3/vt4', substr($this->clientBlob, 8, 8))));
		// 	$seconds = floor($str / 1000000);
	
		// Client nonce, useful in replay-attack prevention.
		// 	$cnonce = substr($this->clientBlob, 16, 8);
	
		if(!SecurityUtil::timingSafeEquals($username, $this->username))
		{
			return false;
		}
		
		if(!SecurityUtil::timingSafeEquals($this->provider->getDomain(), $this->domain))
		{
			return false;
		}
		
		$ntlmhash = $this->computeHmacMd5($hash, $this->encodeUtf16(strtoupper($this->username) . $this->domain));
		$hash = (string)$this->computeHmacMd5($ntlmhash, $challenge . $this->clientBlob);
		
		if(!SecurityUtil::timingSafeEquals($hash, $this->clientHash))
		{
			return false;
		}
		
		return true;
	}