Breaking Lanman Forever (Break It!)

No ratings

Presented at ShmooCon 2006 by

In late 2004, a few Shmoo, at the suggestion of Beetle, started working in earnest on using RainbowCrack to generate the entirety of the LanMan keyspace, with the intent of breaking LanMan once and for all. Chief in this was work done by snax and Dan Moniz, who pooled around 120 CPUs combined at the high point of the collaboration to run rtgen jobs to build the datasets, which was completed by ShmooCon 2005. Further work was done by other Shmoo especially in the areas of sorting and storing the tables and making them available on a website we had set up for BitTorrent-based distribution of the data. We learned a few things in the process. One, we had inadvertently done the wrong rainbow table configuration, including every valid LanMan input character except the space character, ASCII 32 (20h). Two, RainbowCrack's code had certain deficiencies. Three, RainbowCrack's method, while based on the time-memory trade-off documented in Philippe Oechslin's paper, only provided *statistical* coverage of the keyspace, not guaranteed complete coverage. Initially we considered a modification to RainbowCrack to optimize certain parts, but in the wake of receiving an angry and somewhat odd letter from the author of RainbowCrack himself, Dan and Patrick decided to go their own way. Harnessing the power of 1024 Itanium2 CPUs and untold gigabytes of addressable unified memory, with the help of many friends, we break LanMan once and for all. Dan Moniz is a member of The Shmoo Group and has worked for a variety of high tech companies and organizations, including Alexa Internet (an Amazon.com company), the Electronic Frontier Foundation, Cloudmark, OpenCola, and Viasec. He currently spends his time consulting, figuring out new cool ways to play with FPGAs, and tinkering with programming languages of all shapes and sizes. Patrick Stach lives in Houston and reads daily from the Gospel of Knuth.