I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm.

Can it really be true?

I've been revising my understanding of password storage recently, and learning how to use PKDBF2 properly. Then I thought I'd look up what major commercial organisations used. At which point I put my head in my hands! Unsalted MD4 in Windows. And that's an improvement on the LM hash. And there are plenty of other bad examples. /etc/shadow with a decent crypt is just about the only good implementation in major commercial / opensource.

MySQL's OLD_PASSWORD is terrible, even the new PASSWORD is just unsalted SHA-1 twice.

Is the general commercial / opensource sector really that bad?


NTLMv1 uses MD4, v2 uses MD5, and the Windows implementation of Kerberos (I believe -- I don't have the book with the specs sitting in front of me) uses something else. Active Directory can actually store multiple types of hashes of passwords depending on what you are wanting it to do, and what versions of protocols are enabled.

Yes, Active Directory uses unsalted passwords. Is this a security problem? Theoretically yes, but practically probably not. The AD database was designed to be stored in a protected environment where only trusted people have access to the actual file, and only trusted systems can read the data in the file. A salt really only adds value if the particular store containing the password is accessible by potentially non-trusted people and/or non-trusted systems like a SQL database that also contains content. If you are letting anyone and everyone access the AD database you have bigger problems than password salts.

Then of course the other side of this goes to backwards-compatibility as well. Microsoft has to make sure the current version of AD is backwards compatible with the one 4 versions prior. Is this good for security? Not really, but they would be crucified if the versions weren't compatible. Are they changing the hashes to something more secure? Yes, albeit slowly.

  • 3
    And doesn't Active Directoy need plain text password to encrypt the session key in a Kerberos ticket ? In which case it must store password in a reversible symetric scheme. The local password cache uses a salted hash, though, and you can disable it if you don't need offline logon (wich is rather rare, from my experience). – ixe013 Jul 7 '11 at 20:06
  • IIRC Active Directory doesn't store an encrypted value unless you explicitly enable it, but I can't remember if thats for a different function. And good point about local cache. – Steve Jul 7 '11 at 20:53
  • 1
    you're forgetting that backups are rarely threated as "sensitive" so access to password hashes is not so unlikely – Hubert Kario Jul 11 '11 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.