Misplaced Pages

LM hash: Difference between revisions

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
Browse history interactively← Previous editContent deleted Content addedVisualWikitext
Revision as of 22:47, 9 February 2017 editKlbrain (talk | contribs)Autopatrolled, Extended confirmed users, New page reviewers87,017 edits Adding missed merge template from April 2014← Previous edit Latest revision as of 04:47, 7 June 2021 edit undoPascal666 (talk | contribs)Extended confirmed users17,486 edits Password hashing algorithmTag: Redirect target changed 
(2 intermediate revisions by 2 users not shown)
Line 1: Line 1:
#REDIRECT ]
{{merge to|LAN Manager|discuss=Talk:LAN Manager#Merger with LM hash proposal|date=April 2014}}
'''LM hash''', '''LanMan hash''', or '''LAN Manager hash''' is a compromised password ] that was the primary ] that ] and ] versions prior to ] used to store user ]s. Support for the legacy ] protocol continued in later versions of Windows for ], but was recommended by Microsoft to be turned off by administrators; as of Windows Vista, the protocol is disabled by default, but continues to be used by some non-Microsoft ] implementations.


{{Redirect category shell|1=
== Algorithm ==
{{R from merge}}
The LM hash is computed as follows:<ref>{{cite web
{{R to section}}
| url=https://technet.microsoft.com/en-us/library/dd277300.aspx#ECAA
}}
| title=Chapter 3 - Operating System Installation: The LMHash
| work=]
| accessdate=2015-05-12}}</ref><ref name="davenport">{{cite web
| url=http://davenport.sourceforge.net/ntlm.html#theLmResponse
| title=The NTLM Authentication Protocol and Security Support Provider: The LM Response
| last=Glass
| first=Eric
| year=2006
| accessdate=2015-05-12}}</ref>
# The user's password is restricted to a maximum of fourteen characters.<ref group="Notes">If the password is more than fourteen characters long, the LM hash cannot be computed.</ref>
# The user’s password is converted to ].
# The user's password is encoded in the System OEM ].<ref>{{cite web
| url=https://msdn.microsoft.com/nl-nl/goglobal/cc563921%28en-us%29.aspx
| title=List of Localized MS Operating Systems
| work=]
| accessdate=2015-05-12}}</ref>
# This password is null-padded to 14 bytes.<ref name="KB828861">{{cite web
| url=https://support.microsoft.com/kb/828861
| title=Cluster service account password must be set to 15 or more characters if the NoLMHash policy is enabled
| publisher=]
| date=2006-10-30
| accessdate=2015-05-12}}</ref>
# The “fixed-length” password is split into two 7-byte halves.
# These values are used to create two ] keys, one from each 7-byte half, by converting the seven bytes into a bit stream with the most significant bit first, and inserting a null bit after every seven bits (so <code>1010100</code> becomes <code>10101000</code>). This generates the 64 bits needed for a DES key. (A DES key ostensibly consists of 64 bits; however, only 56 of these are actually used by the algorithm. The null bits added in this step are later discarded.)
# Each of the two keys is used to DES-encrypt the constant ] string “<code>KGS!@#$%</code>”,<ref group="Notes">The string “KGS!@#$%” could possibly mean '''K'''ey of '''G'''len and '''S'''teve and then the combination of '''Shift + 12345'''. Glen Zorn and Steve Cobb are the authors of RFC 2433 (]).</ref> resulting in two 8-byte ciphertext values. The DES CipherMode should be set to ECB, and PaddingMode should be set to <code>NONE</code>.
# These two ciphertext values are concatenated to form a 16-byte value, which is the LM hash.

== Security weaknesses ==
Although it is based on ], a well-studied and formerly secure ], the LM hash is not a true ] as the password can be determined from the hash because of several weaknesses in its design:<ref>{{cite web
| url=http://download.microsoft.com/download/f/4/a/f4a67fc8-c499-461d-a025-8155fb4f7a0f/Windows%20Passwords%20Master%201.5%20Handout%20-%20Jesper%20Johansson.ppt
| title=Windows Passwords: Everything You Need To Know
| publisher=]
| first=Jasper M.
| last=Johansson
| date=2004-06-29
| accessdate=2015-05-12}}</ref> Firstly, passwords are limited to a maximum of only 14 characters, giving a theoretical maximum keyspace of <math>95^{14} \approx 2^{92}</math> with the ].

Secondly, passwords longer than 7 characters are divided into two pieces and each piece is hashed separately; this weakness allows each half of the password to be attacked separately at ] cost than the whole, as only <math>95^{7} \approx 2^{46}</math> different 7-character password pieces are possible with the same character set. By mounting a ] on each half separately, modern desktop machines can crack ] LM hashes in a few hours. In addition, all lower case letters in the password are changed to upper case before the password is hashed, which further reduces the ] for each half to <math>69^{7} \approx 2^{43}</math>.

The LM hash also does not use ], a standard technique to prevent ]s. A ] ] attack, such as a ], is therefore feasible. In addition, any password that is shorter than 8 characters will result in the hashing of 7 null bytes, yielding the constant value of <code>0xAAD3B435B51404EE</code>, hence making it easy to identify short passwords on sight. In 2003, ], an implementation of the rainbow table technique, was published. It specifically targets the weaknesses of LM encryption, and includes pre-computed data sufficient to crack virtually all alphanumeric LM hashes in a few seconds. Many cracking tools, e.g. ], ] and ], now incorporate similar attacks and make cracking of LM hashes fast and trivial.

A final weakness of LM hashes lies in their implementation — since they change only when a user changes their password, they can be used to carry out a ] attack.

== Workarounds ==
To address the security weaknesses inherent in LM encryption and authentication schemes, Microsoft introduced the ] protocol in 1993 with ]. For hashing, NTLM uses ] support, replacing <code>LMhash=DESeach(DOSCHARSET(UPPERCASE(password)), "KGS!@#$%")</code> by <code>NThash=](]-LE(password))</code>, which does not require any padding or truncating that would simplify the key. On the negative side, the same DES algorithm was used with only ] for the subsequent authentication steps, and there is still no salting. Furthermore, Windows machines were for many years configured by default to send and accept responses derived from both the LM hash and the NTLM hash, so the use of the NTLM hash provided no additional security while the weaker hash was still present. It also took time for artificial restrictions on password length in management tools such as User Manager to be lifted.

While LAN Manager is considered obsolete and current Windows operating systems use the stronger NTLMv2 or ] authentication methods, Windows systems before ]/] enabled the LAN Manager hash by default for ] with legacy LAN Manager and ] or earlier clients, or legacy ]-enabled applications. It has for many years been considered good security practice to disable the compromised LM and NTLMv1 authentication protocols where they aren't needed.<ref name="KB299656">{{cite web
| url=https://support.microsoft.com/kb/299656
| title=How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases
| work=]
| date=2007-12-03
| accessdate=2015-05-12}}</ref>
Starting with Windows Vista and Windows Server 2008, Microsoft disabled the LM hash by default; the feature can be enabled for local accounts via a security policy setting, and for ] accounts by applying the same setting via domain ]. The same method can be used to turn the feature off in Windows 2000, Windows XP and NT.<ref name="KB299656"/> Users can also prevent a LM hash from being generated for their own password by using a password at least fifteen characters in length.<ref name="KB828861"/>

NTLM hashes have in turn become vulnerable in recent years to various attacks that effectively make them as weak today as LanMan hashes were back in 1998.{{CN|date=August 2016}}

==Reasons for continued use==
Many legacy third party ] implementations have taken considerable time to add support for the stronger protocols that Microsoft has created to replace LM hashing because the ] communities supporting these libraries first had to ] the newer protocols—] took 5 years to add NTLMv2 support, while JCIFS took 10 years.

{| class="wikitable"
|-
|+ Availability of NTLM protocols to replace LM authentication
! Product
! NTLMv1 support
! NTLMv2 support
|-
| ]
| RTM (1993)
| Not supported
|-
| ]
| RTM (1994)
| Not supported
|-
|-
| ]
| RTM (1995)
| Not supported
|-
| ]
| RTM (1996)
| Service Pack 4<ref>{{cite web
| url=https://support.microsoft.com/kb/194507
| title=Windows NT 4.0 Service Pack 4 Readme.txt File (40-bit)
| date=1998-10-25
| publisher=]
| accessdate=2015-05-12}}</ref> (25 October 1998)
|-
| ]
| Not supported
| Directory services client (released with ] Server, 17 February 2000)
|-
| ]
| RTM
| Directory services client (released with ] Server, 17 February 2000)
|-
| ]
| RTM (17 February 2000)
| RTM (17 February 2000)
|-
| ]
| RTM (14 September 2000)
| Directory services client (released with ] Server, 17 February 2000)
|-
| ]
| ?
| Version 3.0<ref>{{cite web
| url=https://www.samba.org/samba/history/samba-3.0.0.html
| title=The Samba Team announces the first official release of Samba 3.0
| date=2003-09-24
| publisher=]
| accessdate=2015-05-12}}</ref> (24 September 2003)
|-
| JCIFS
| Not supported
| Version 1.3.0 (25 October 2008)<ref>{{cite web
| url=https://jcifs.samba.org/
| title=The Java CIFS Client Library
| accessdate=2015-05-12}}</ref>
|-
| ] (SMBFS)
| 5.3 (2004)<ref>{{cite web|
| url=http://www-01.ibm.com/support/knowledgecenter/ssw_aix_53/com.ibm.aix.commadmn/doc/commadmndita/smbfs_intro.htm
| title=AIX 5.3 Networks and communication management: Server Message Block file system
| page=441
| publisher=]
| date=2010-03-15
| accessdate=2015-05-12}}</ref>
| Not supported as of v7.1<ref>{{cite web
| url=http://www-01.ibm.com/support/knowledgecenter/ssw_aix_71/com.ibm.aix.networkcomm/smbfs_intro.htm
| title=AIX 7.1 Networks and communication management: Server Message Block file system
| publisher=]
| date=2011-12-05
| accessdate=2015-05-12}}</ref>
|}

Poor patching regimes subsequent to software releases supporting the feature becoming available have contributed to some organisations continuing to use LM Hashing in their environments, even though the protocol is easily disabled in ] itself.

Lastly, prior to the release of Windows Vista, many unattended build processes still used a ] boot disk (instead of ]) to start the installation of Windows using WINNT.EXE, something that requires LM hashing to be enabled for the legacy ] networking stack to work.

== See also ==
* ]
* ]

==Notes==
{{reflist|group=Notes}}

== References ==
{{reflist}}

== External links ==
<!--===========================({{NoMoreLinks}})===============================-->
<!--| DO NOT ADD MORE LINKS TO THIS ARTICLE. WIKIPEDIA IS NOT A COLLECTION OF |-->
<!--| LINKS. If you think that your link might be useful, do not add it here, |-->
<!--| but put it on this article's discussion page first or submit your link |-->
<!--| to the appropriate category at the Open Directory Project (www.dmoz.org)|-->
<!--| and link back to that category using the {{dmoz}} template. |-->
<!--| |-->
<!--| Links that have not been verified WILL BE DELETED. |-->
<!--| See ] and ] for details |-->
<!--===========================({{NoMoreLinks}})===============================-->*
{{Wikibooks|Reverse Engineering/Cracking Windows XP Passwords}}
* {{cite web
| url=http://lasec.epfl.ch/~oechslin/publications/crypto03.pdf
| title=Making a Faster Cryptanalytic Time-Memory Trade-Off
| first=Philippe
| last=Oechslin
| work=Advances in Cryptology, CRYPTO 2003
| year=2003}}

* {{cite web
| url=http://ophcrack.sourceforge.net/
| title=Ophcrack, a well known password cracker}}

* {{cite web
| url=http://www.oxid.it/cain.html
| title=Cain and Abel, password recovery tool for Microsoft Operating Systems}}

* {{cite web
| url=http://seclists.org/bugtraq/1997/Jul/135
| title=A L0phtCrack Technical Rant
| author=mudge
| date=1997-07-24
| archiveurl=http://dl.packetstormsecurity.net/Crackers/NT/l0phtcrack/l0phtcrack.rant.nt.passwd.txt
| archivedate=1997-07-24}}

{{Cryptography navbox | hash}}

]
]
]
]

Latest revision as of 04:47, 7 June 2021

Redirect to:

This page is a redirect. The following categories are used to track and monitor this redirect:
  • From a merge: This is a redirect from a page that was merged into another page. This redirect was kept in order to preserve the edit history of this page after its content was merged into the content of the target page. Please do not remove the tag that generates this text (unless the need to recreate content on this page has been demonstrated) or delete this page.
When appropriate, protection levels are automatically sensed, described and categorized.