Posted: February 21, 1996

Go To TechNet Home Page

Enhanced Password Cache Security Update

This update is an enhanced security component that substantially strengthens the encryption used for the Microsoft Windows 95 password cache.

The new component uses a 128-bit key, increased from a 32-bit key in the previous version. The new component also includes enhancements to the way passwords are stored in the PWL file.

• The previous PWL file will be automatically upgraded to the new format.
• This component replaces the MSPWL32.DLL and NET.EXE files.
• NET.EXE, which is usually used from the command line, will no longer use the password cache users will be prompted for passwords while using NET.EXE.

By using the new component, customers will have a PWL file that is very secure. In fact, with the new 128-bit security, the new component is 2^96 (2 to the 96th power) times harder to decrypt.

Background

Windows 95 uses an optional caching mechanism to store network passwords on a user's machine. When a user first types and saves a password while connecting to a password protected resource, the user can choose to store the password in a local password list file. Subsequent logins with a Windows 95 password unlocks the list and associates those stored passwords with the Windows 95 password. If the user does not choose to use password caching, they must type the passwords each time they connect to a password protected resource.

Recently, an algorithm was posted on the Internet which could be used to compromise the security used in the previous version of the password list file. If someone had access to the password list file on the hard disk of a Windows 95 machine and the decryption algorithm, they may have been able to perform operations on the file that could generate the unencrypted password(s).

After installing this new component, the password file will be well protected against security violations.
http://www.microsoft.com/windows/software/updates.htm

Click Here to Search TechNet Web Contents

TechNet CD Overview

Microsoft TechNet Credit Card Order Form At this time we can only support electronic orders in the US and Canada, sorry for any inconvenience this may cause.

Go To TechNet Home Page

©1996 Microsoft Corporation

Go To Microsoft Home Page