GPEN · Question #226
Which of the following is the second half of the LAN manager Hash?
The correct answer is C. 0xAAD3B435B51404EE. The second half of the LAN Manager hash is the constant 0xAAD3B435B51404EE when the password is seven characters or fewer.
Question
Which of the following is the second half of the LAN manager Hash?
Options
- A0xAAD3B435B51404BB
- B0xAAD3B435B51404CC
- C0xAAD3B435B51404EE
- D0xAAD3B435B51404AA
How the community answered
(38 responses)- A3% (1)
- B5% (2)
- C82% (31)
- D11% (4)
Why each option
The second half of the LAN Manager hash is the constant 0xAAD3B435B51404EE when the password is seven characters or fewer.
0xAAD3B435B51404BB has an incorrect trailing byte of BB; the actual null-key DES output ends in EE.
0xAAD3B435B51404CC has an incorrect trailing byte of CC; the actual null-key DES output ends in EE.
The LM hash algorithm splits a password into two 7-byte halves, pads each with null bytes to 7 bytes, and uses each half as a DES key to encrypt the fixed plaintext 'KGS!@#$%'. When the second half is all null bytes (password is 7 or fewer characters), DES encryption of 'KGS!@#$%' with a null key always produces the constant 0xAAD3B435B51404EE. This predictable constant immediately reveals to an attacker that the password is short, which is a well-known weakness of the LM hash scheme.
0xAAD3B435B51404AA has an incorrect trailing byte of AA; the actual null-key DES output ends in EE.
Concept tested: LAN Manager hash empty second-half constant value
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/preventing-windows-store-lm-hash-passwords
Topics
Community Discussion
No community discussion yet for this question.