Take a look at Bruce Schneier's paper on MSCHAPv2, http://www.schneier.com/paper-pptpv2.html. NTLM functions very similarly to MSCHAP...

E