nerdexam
EC-Council

312-50V13 · Question #134

Windows LAN Manager (LM) hashes are known to be weak. Which of the following are known weaknesses of LM? (Choose three.)

The correct answer is A. Converts passwords to uppercase. B. Hashes are sent in clear text over the network. D. Effective length is 7 characters. This question identifies known cryptographic weaknesses associated with the deprecated Windows LAN Manager (LM) hashing algorithm.

Submitted by haruto_sh· Mar 6, 2026System Hacking

Question

Windows LAN Manager (LM) hashes are known to be weak. Which of the following are known weaknesses of LM? (Choose three.)

Options

  • AConverts passwords to uppercase.
  • BHashes are sent in clear text over the network.
  • CMakes use of only 32-bit encryption.
  • DEffective length is 7 characters.

How the community answered

(39 responses)
  • A
    90% (35)
  • C
    10% (4)

Why each option

This question identifies known cryptographic weaknesses associated with the deprecated Windows LAN Manager (LM) hashing algorithm.

AConverts passwords to uppercase.Correct

LM hashes convert all passwords to uppercase before hashing, effectively reducing the possible character set and making dictionary and brute-force attacks much easier and faster.

BHashes are sent in clear text over the network.Correct

Historically, in some legacy protocols using LM authentication, the LM hashes were transmitted in a way that allowed easy interception and offline cracking, often referred to as being 'sent in clear text' due to their extreme vulnerability to sniffing.

CMakes use of only 32-bit encryption.

LM hashes internally use a variant of the DES (Data Encryption Standard) algorithm, which is a 56-bit key algorithm, not 32-bit encryption; the statement is technically incorrect regarding the underlying cryptographic strength.

DEffective length is 7 characters.Correct

The LM hashing algorithm processes passwords in two 7-character blocks; therefore, it effectively limits the 'strength' of any password to a maximum of 7 characters, regardless of its actual length beyond that.

Concept tested: LM hash vulnerabilities

Source: learn.microsoft.com/en-us/troubleshoot/windows-server/identity/windows-password-hashing-function

Topics

#LM hash weaknesses#password security#DES#network authentication

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice