GPEN · Question #250
LM hash is one of the password schemes that Microsoft LAN Manager and Microsoft Windows versions prior to the Windows Vista use to store user passwords that are less than 15 characters long. If you pr
The correct answer is A. 0xAAD3B435B51404EE. The LM hash algorithm splits a password into two 7-character halves; when the password is 7 characters or fewer, the second half is all null bytes, which always hashes to the fixed value 0xAAD3B435B51404EE.
Question
LM hash is one of the password schemes that Microsoft LAN Manager and Microsoft Windows versions prior to the Windows Vista use to store user passwords that are less than 15 characters long. If you provide a password seven characters or less, the second half of the LM hash is always __________.
Options
- A0xAAD3B435B51404EE
- B0xBBD3B435B51504FF
- C0xBBC3C435C51504EF
- D0xAAD3B435B51404FF
How the community answered
(69 responses)- A72% (50)
- B14% (10)
- C10% (7)
- D3% (2)
Why each option
The LM hash algorithm splits a password into two 7-character halves; when the password is 7 characters or fewer, the second half is all null bytes, which always hashes to the fixed value 0xAAD3B435B51404EE.
LM hashing pads the password to 14 characters, then splits it into two 7-character chunks, each hashed independently using DES. When the original password is 7 characters or fewer, the second 7-byte chunk is entirely null bytes (0x00000000000000), and DES encryption of that constant null value with the fixed LM key always produces 0xAAD3B435B51404EE. This predictable constant makes LM hashes trivially identifiable and exploitable.
0xBBD3B435B51504FF is not a value produced by any LM hash operation and does not correspond to the DES encryption of a null 7-byte block.
0xBBC3C435C51504EF is also a fabricated value that does not match any known LM hash output for null or empty password halves.
0xAAD3B435B51404FF differs from the correct answer only in the last byte (FF vs EE) and is not the actual DES output for the null 7-byte padding block.
Concept tested: LM hash weakness with short passwords
Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change
Topics
Community Discussion
No community discussion yet for this question.