Penetration Testing mailing list archives



MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"

First the quote from the MSFT program manager "Microsoft is banning certain cryptographic functions from new computer code, citing increasingly sophisticated attacks that make them less secure, according to a company executive. The Redmond, Wash., software company instituted a new policy for all developers that bans functions using the DES, MD4, MD5 and, in some cases, the SHA1 encryption algorithm, which is becoming "creaky at the edges," said Michael Howard, senior security program manager at the company, Howard said." "All three algorithms show signs of 'extreme weakness' and have been banned, Howard said. Microsoft is recommending using the Secure Hash Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption Standard) cipher instead, he said. Quote when hearing about this "It's about time," Bruce Schneier of Counterpane Security Inc "Microsoft should have ended use of DES, MD4 and MD5 years ago" To answer "And I'm not sure where you are getting your info regarding Microsoft "dropping NTLMv2 for backward compatibility.""... Don't take my word for it... http://www.eweek.com/article2/0%2C1895%2C1859751%2C00.asp http://www.neowin.net/comments.php?id=30463&category=main http://www.technorati.com/search/md5 http://www.extremetech.com/article2/0,1697,1859953,00.asp http://it.slashdot.org/article.pl?sid=05/09/16/1211227&from=rss http://diswww.mit.edu/bloom-picayune/crypto/18482 http://www.codeproject.com/useritems/GoodbyeMD5.asp http://forums.thetechzone.com/showthread.php?s=&threadid=76038 http://download.microsoft.com/download/b/8/3/b838ee36-41a2-4280-af5c-182 04bb7a581/cryptography_windows_vista_2005_MBR.wmv Complimentary http://www.microsoft.com/presspass/features/2002/jan02/01-24secure.mspx For those who still believe MD5 collisions are just theory http://www.codeproject.com/useritems/HackingMd5.asp Craig PS NTLMv2 uses MD4 and HMAC_MD5 - these are not going to be supported. MSFT is moving to AES and SHA256 - so I guess it might be time for some people still on Windows 98 or NT 4.0 to finally move on. ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------

By Date By Thread

Current thread: