Syskey Tool Reuses Keystream

Article translations Article translations
Article ID: 248183 - View products that this article applies to.
This article was previously published under Q248183
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

On This Page

Symptoms

A cryptographic error in the Syskey tool makes offline password attacks easier than previously believed. Syskey reuses keystream when encrypting certain elements in the Security Accounts Manager (SAM) database, making the tool vulnerable to an attack using a known cryptanalytic method. This vulnerability could allow offline password attacks to be mounted against a Syskey-protected SAM database.

Cause

Passwords in the SAM database are stored in hashed form to prevent a user who gains access to the database from reading the passwords. However, offline password attacks are still possible if an attacker obtains a copy of the database and is willing to devote the time needed to perform an exhaustive search of all possible passwords. The Syskey tool is designed to prevent such attacks by strongly encrypting the SAM database using 128-bit cryptography. However, a flaw in the implementation results in multiple database entries being encrypted with the same keystream. This renders the encryption susceptible to a known attack.

Resolution

Windows NT Server or Workstation 4.0

To resolve this problem, obtain the individual package referenced below or obtain the Windows NT 4.0 Security Rollup Package. For additional information on the SRP, click the article number below to view the article in the Microsoft Knowledge Base:
299444 Post-Windows NT 4.0 Service Pack 6a Security Rollup Package (SRP)
The following files are available for download from the Microsoft Download Center:
Collapse this imageExpand this image
Download
Download Q248183.Exe for x86-based computers now

Collapse this imageExpand this image
Download
Download Q248183.Exe for Alpha-based computers now
The English version of this fix should have the following file attributes or later:
   Date      Time        Size      File name    Platform
   -----------------------------------------------------
   12/06/1999   06:52p   155,408   Lsasrv.dll   x86
   12/06/1999   06:53p   174,352   Samsrv.dll   x86

   12/06/1999   06:51p   253,712   Lsasrv.dll   Alpha
   12/06/1999   06:51p   290,064   Samsrv.dll   Alpha
				

Windows NT Server 4.0, Terminal Server Edition

To resolve this problem, obtain the Windows NT Server 4.0, Terminal Server Edition, Security Rollup Package (SRP). For additional information about the SRP, click the article number below to view the article in the Microsoft Knowledge Base:
317636 Windows NT Server 4.0, TerminalServer Edition, Security Rollup Package

Status

Windows NT Server or Workstation 4.0

Microsoft has confirmed that this problem may cause a degree of security vulnerability in Windows NT 4.0 Server and Workstation.

Windows NT Server 4.0, Terminal Server Edition

Microsoft has confirmed that this problem may cause a degree of security vulnerability in Windows NT Server 4.0, Terminal Server Edition.

More information

For additional information about the Syskey tool, click the article number below to view the article in the Microsoft Knowledge Base:
143475 Windows NT System Key Permits Strong Encryption of the SAM

Properties

Article ID: 248183 - Last Review: October 26, 2013 - Revision: 3.0
Applies to
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 4.0 Enterprise Edition
Keywords: 
kbnosurvey kbarchive kbhotfixserver kbqfe kbbug kbfix kbgraphxlinkcritical kbsecurity KB248183

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com