How Windows XP stores passwords:
In windows XP the passwords are stored in SAM (Security Account Manager) using LM or NTLM hashes method.
When a user sets password for an account or changes the password for his user account, the password is first hashed using basically two methods LAN Manager hash (LM hash) and NTLM hash. If the password supplied by user is 14 character long or less than 14 characters, Windows generates both hashes LM hash and NTLM hash of such password. Once the hashes of password are generated the both hashed passwords are then stored in the local Security Accounts Manager or SAM.
The LM hash method is relatively less secure as compare to NTLM hash. This hash method is based on IBM peer to peer system and can store passwords with maximum length of 14 characters. It converts all characters of password in upper case and divides into two groups of 7 characters in each. Each group is separately encrypted with 56 bit DES encryption key and stored together as LM hash. If second group is empty a 16 bit pattern AAD3B435B51404EE is stored in SAM as second group. The 0s are added as pad to fill 7 characters if needed.
The NTLM hash is more secure method to store password in SAM. The password with more than 14 characters is stored as NTLM hash in SAM. NTLM provides large character set including unicode. It is case sensitive and uses Md4 hash (128 bit) method to hash a password.
How Linux stores passwords:
In Linux the user information and passwords are stored in etc/passwd file in an encrypted form. The etc/passwd file actually contain user information and the passwords are stored in etc/shadow file and only root user has access to shadow file. The passwords in Linux are encrypted using following cryptographic methods before storing in etc/shadow file:
In original UNIX systems the passwords are encrypted using a program called crypt which adds a salt of 2 characters in 11 character password. The salt added in password is random as a result even if two users have same passwords the hash created to store is different. Newer UNIX systems use MD5 hash method.
In Linux system the passwords are encrypted using DES, Blowfish and MD5 hash with password salt. Once the password is encrypted using one of these hashing algorithms the password along with user account information is stored in etc/passwd file as under:
tsingh:7aabc345d7346:47:3:T Singh:/usr/jsingh/:/bin/csh
So Among WINXP and Linux ,LINUX is the best ways to secure our password because it is more secure than the WINXP. so that is why most of companies using Linux to store their password instead of WinXP.
ReplyDeleteLM method used for hashing a password in Windows XP is not a secured method .Since it converts the password into uppercase before storing it, so it is case sensitive. The main security issue is that it can store only 14 characters. In LM hash method the password is divided into two groups and it is easier for hackers to detect each group. Also in LM the padding is done with 56 bit key which is not a secure method.
ReplyDelete