312-50V13 · Question #134
Windows LAN Manager (LM) hashes are known to be weak. Which of the following are known weaknesses of LM? (Choose three.)
The correct answer is A. Converts passwords to uppercase. B. Hashes are sent in clear text over the network. D. Effective length is 7 characters. This question identifies known cryptographic weaknesses associated with the deprecated Windows LAN Manager (LM) hashing algorithm.
Question
Options
- AConverts passwords to uppercase.
- BHashes are sent in clear text over the network.
- CMakes use of only 32-bit encryption.
- DEffective length is 7 characters.
How the community answered
(39 responses)- A90% (35)
- C10% (4)
Why each option
This question identifies known cryptographic weaknesses associated with the deprecated Windows LAN Manager (LM) hashing algorithm.
LM hashes convert all passwords to uppercase before hashing, effectively reducing the possible character set and making dictionary and brute-force attacks much easier and faster.
Historically, in some legacy protocols using LM authentication, the LM hashes were transmitted in a way that allowed easy interception and offline cracking, often referred to as being 'sent in clear text' due to their extreme vulnerability to sniffing.
LM hashes internally use a variant of the DES (Data Encryption Standard) algorithm, which is a 56-bit key algorithm, not 32-bit encryption; the statement is technically incorrect regarding the underlying cryptographic strength.
The LM hashing algorithm processes passwords in two 7-character blocks; therefore, it effectively limits the 'strength' of any password to a maximum of 7 characters, regardless of its actual length beyond that.
Concept tested: LM hash vulnerabilities
Source: learn.microsoft.com/en-us/troubleshoot/windows-server/identity/windows-password-hashing-function
Topics
Community Discussion
No community discussion yet for this question.