DOCUMENT:Q132807 13-JUN-2001 [win95x] TITLE :Enhanced Encryption for Windows 95 Password Cache PRODUCT :Microsoft Windows 95.x Retail Product PROD/VER:WINDOWS:95; Win2000:95 OPER/SYS: KEYWORDS:kbfile kbnetwork osr1 msnets win95 kbgraphxlinkcritical ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows 95 - Microsoft Windows 95 OEM Service Release, version 1.0 ------------------------------------------------------------------------------- SYMPTOMS ======== The following issues exist regarding password list files in Windows 95: 1. An algorithm that can be used to compromise the security scheme used in the Windows 95 password list (.pwl) file has been posted on the Internet. A person who can access the password list file on the hard disk of a Windows 95-based computer may be able to use this decryption algorithm to generate unencrypted passwords. 2. If two users with user names containing the same first eight characters log on to the same Windows 95-based computer, the first user's password list file becomes invalid. Note that this second symptom occurs only with the Windows 95 Password Cache update (Mspwl32.dll version 9.00.951) available with Microsoft Windows 95 Service Pack 1 and OEM Service Release 1. CAUSE ===== 1. The encryption mechanism used specifically for Windows 95 .pwl files, including not only the algorithm itself but also the manner in which it is applied, may be susceptible to certain decryption techniques. Different encryption algorithms are applied elsewhere in Windows 95 to encrypt other information. These algorithms are not susceptible to the decryption techniques mentioned above. 2. When a user logs on to Windows 95, Windows 95 checks the System.ini file to see if that user has logged on before. If there is no entry for that user, the first eight characters of the user name are used to create a password list file for the user. If another password list file with the same name exists, it is overwritten. Note that this second symptom occurs only with the Windows 95 Password Cache update (Mspwl32.dll version 9.00.951) available with Microsoft Windows 95 Service Pack 1 and OEM Service Release 1. RESOLUTION ========== This issue is resolved in Microsoft Windows 98. These issues are resolved by the following updated files for Windows 95 and Windows 95 OEM Service Release 1: Mspwl32.dll version 4.00.952 (dated 4/26/96) and later
Net.exe (no version information) dated 12/11/95 and later To install this update, follow these steps: 1. Download the Mspwlupd.exe file from the Microsoft Download Center to an empty folder. 2. In My Computer or Windows Explorer, double-click the Mspwlupd.exe file you downloaded in step 1. 3. Follow the instructions on the screen. The following file is available for download from the Microsoft Download Center: Download Mspwlupd.exe now (http://download.microsoft.com/download/win95/Update/95/w95/EN-US/mspwlupd.exe) For additional information about how to download Microsoft Support files, click the article number below to view the article in the Microsoft Knowledge Base: Q119591 How to Obtain Microsoft Support Files from Online Services Microsoft used the most current virus detection software available on the date of posting to scan this file for viruses. Once posted, the file is housed on secure servers that prevent any unauthorized changes to the file. The Mspwlupd.exe file contains the following files: File name Version Date/Time Size Destination folder ---------------------------------------------------------------------- Mspwl32.dll 4.00.952 4/26/96 9:52am 21,504 Windows\System Net.exe 12/11/95 9:51am 375,930 Windows MORE INFORMATION ================ This update is an enhanced security component that substantially strengthens the encryption used for the Microsoft Windows 95 password cache. The new component uses a 128-bit key, increased from the 32-bit key used in the previous version. The new component also includes enhancements to the method used to store passwords in the .pwl file. With the 128-bit security, the new component is 2^96 times more difficult to decrypt. This component replaces the Mspwl32.dll and Net.exe files. The previous .pwl file is automatically upgraded to the new format. Net.exe, which is usually used from the command line, no longer uses the password cache. Users are prompted for passwords when using Net.exe to connect to resources on the network. NOTE: Because the same algorithm is used to cache passwords in Windows for Workgroups version 3.11, you may want to disable password caching in Windows for Workgroups using Admincfg.exe. For information about using Admincfg.exe, please refer to the Windows for Workgroups Resource Kit. NOTE: If you disabled password caching on a Windows 95-based computer as a temporary workaround before installing this update, you can re-enable password caching after installing this update. You can re-enable password caching by reversing the procedure documented in the following article in the Microsoft Knowledge Base: Q140557 Microsoft Windows 95 Password List Security Issue To re-enable password caching, set the DisablePwdCaching value to zero (0) or delete the DisablePwdCaching value. Additional query words: ====================================================================== Keywords : kbfile kbnetwork osr1 msnets win95 kbgraphxlinkcritical Technology : kbWin95search kbOPKSearch kbWin95 Version : WINDOWS:95; Win2000:95 ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2001.