|
LM hash or LAN Manager hash is one of the formats that Microsoft LAN Manager and Microsoft Windows use to store Windows user passwords that are less than 15 characters long. This type of hash is the only type of encryption used in Microsoft LAN Manager, hence the name, and versions of Windows up to Windows Me. It is also supported in more recent Windows versions for backward compatibility.
Algorithm The LM hash is computed as follows.• KGS!@”, resulting in two 8-byte ciphertext values.Security weaknesses Although it is based on DES, a reasonably secure block cipher, the LM hash can easily be cracked due to two weaknesses in its implementation. First, passwords longer than 7 characters are divided into two pieces and each piece is hashed separately. Second, all lower case letters in the password are changed to upper case before the password is hashed. The first weakness allows each half of the password to be attacked separately. While there are different passwords made of up to 14 mixed case letters and digits, there would be only different 1-7 character password pieces using the same character set. Restricting the character set to upper case letters and digits further reduces the number of possibilities for each half to . By mounting a brute force attack on each half separately, modern desktop machines can crack alphanumeric LM hashes in hours. Because LM hash does not include salt, a time-memory trade-off cryptanalysis attack is also feasible. In 2003, Ophcrack, an implementation of the time-memory trade-off technique, was published. It specifically targets the weaknesses of LM encryption, and includes pre-computed data sufficient to crack virtually all alphanumeric LM hashes in a few seconds. Many cracking tools, e. g. RainbowCrack, L0phtCrack and Cain, now incorporate similar attacks and make cracking of LM hashes trivial. To address the security weaknesses inherent in LM encryption, Microsoft introduced the NTLM algorithm. While LAN Manager is considered obsolete and current Windows operating systems use the stronger NTLM hashing method, all Windows systems still compute and store the LAN Manager hash by default for compatibility with LAN Manager and Windows Me or earlier clients. It is considered good security practice to disable this feature where it isn’t needed.• Microsoft claims that support for LM will be completely eliminated in the new Windows Vista operating system. Notes See also | ||||||||
|
| |||||||||
 |
|
| |