Does Windows really still use unsalted MD4 for password storage?

Question

I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm.

Can it really be true?

I've been revising my understanding of password storage recently, and learning how to use PKDBF2 properly. Then I thought I'd look up what major commercial organisations used. At which point I put my head in my hands! Unsalted MD4 in Windows. And that's an improvement on the LM hash. And there are plenty of other bad examples. /etc/shadow with a decent crypt is just about the only good implementation in major commercial / opensource.

MySQL's OLD_PASSWORD is terrible, even the new PASSWORD is just unsalted SHA-1 twice.

Is the general commercial / opensource sector really that bad?

Answer 1

NTLMv1 uses MD4, v2 uses MD5, and the Windows implementation of Kerberos uses a KDF using HMAC-SHA1 for AES 128/256. Active Directory can actually store multiple types of hashes of passwords depending on what you are wanting it to do, and what versions of protocols are enabled.

Yes, Active Directory uses unsalted passwords. Is this a security problem? Theoretically yes, but practically probably not. The AD database was designed to be stored in a protected environment where only trusted people have access to the actual file, and only trusted systems can read the data in the file. A salt really only adds value if the particular store containing the password is accessible by potentially non-trusted people and/or non-trusted systems like a SQL database that also contains content. If you are letting anyone and everyone access the AD database you have bigger problems than password salts.

Then of course the other side of this goes to backwards-compatibility as well. Microsoft has to make sure the current version of AD is backwards compatible with the one 4 versions prior. Is this good for security? Not really, but they would be crucified if the versions weren't compatible. Are they changing the hashes to something more secure? Yes, albeit slowly.

Answer 2

Yes, Windows domain controllers still store unsalted MD4 password hashes, to enable legacy NTLM authentication and Kerberos authentication with the legacy rc4-hmac-md5 cipher.

By default, Windows also stores three Kerberos keys for each password: two of which are derived via PBKDF2 and one via a DES-based key derivation method. The MD4 hash is unsalted and can be computed much more efficiently, though, so that one is generally used for password cracking.

You could argue that when an attacker is in the position to steal hashes from the account database they don't really have to bother cracking any passwords. They could just impersonate any user via pass-the-hash or golden/silver ticket attacks. I don't agree with this perspective, though, as people tend to reuse passwords for different services: compromising an organization's domain is one thing, but also getting access to private employee mailboxes is another.

I once had a pentest assessment where we obtained hashes from a decommissioned legacy domain, but couldn't reuse many of them them in the new domain because the latter required bimonthly password changes. However, after we cracked 70% of the legacy hashes we were able to come up with variations of plaintext passwords (by replacing year and month numbers in them) that gave us high privileges in the new domain. This would have been much more difficult if Windows had used a stronger password hashing scheme.