What is the LM authentication protocol?

The LM authentication protocol, also known as LAN Manager and LANMAN, was invented by IBM and used extensively by Microsoft operating systems prior to NT 4.0. It uses a password encrypting technology that is now considered insecure.

LM works by creating a "hash" of your password, as follows:

• Breaking the password into seven-character chunks: If the password length is not a multiple of seven (i.e., 7, 14, 21, 28...), LM pads the remainder of each chunk with zeroes to make it a full seven bytes long. For example, a ten-letter-long password would be divided into a seven-character-long chunk and a three-character-long one, and the smaller one would have zeroes added to it to push it up to seven characters.
  
  
• Mapping all lowercase letters into uppercase: For example, Dog becomes DOG.
  
  
• Encrypting each chunk: LM uses each chunk as a 56-bit DES (a standardized cipher standard) key to encrypt the following string: KGS!@#$%.
  
  
• Concatenating those strings (i.e., linking them end-to-end).

The resulting string is what computers pass between each other when authenticating users with the LM protocol.

The insecurity is a result of several facets of the protocol:

• Simple 56-bit DES key is today considered to be very weak encryption; normal desktop computers in 1998 were able to break any passwords so encrypted within an average of six days; a single standard modern desktop computer could achieve the same result in a matter of hours or days.
  
  
• Because everything was converted to uppercase, an attacker could ignore every lowercase possibility and attack using only hashes built from uppercase passwords.
  
  
• While the standard itself did not have this limitation, the actual implementation on many operating systems led to the maximum password lengths being restricted to 14 characters or fewer. Windows 98, for example, only allowed a password length of 8 characters.
  
  
• Splitting the password into seven-character chunks meant that there were often short (less than seven-letter) chunks. Since they were shorter than seven characters, those chunks were easy to crack, which was the first step towards cracking the whole password.

Many more problems, too numerous to discuss here, have been identified.

The successor is the NT LAN Manager (NTLM) protocol. On the Indiana University network, UITS requires the use of the NTLMv2 protocol for domain authentications.