NT Security Question

[patrickj]

I am trying to find specific information about how NT 4.0 password security works. I am trying to create password policies and need to determine the proper password length. I remember reading(don't remember where) that NT breaks the password into two pieces, encrypts it, and then sends it on its merry way. I want to make sure that my passwork length is longth enough to ensure that the second encrypted piece is not full of nulls. Could someone please provide this information, or preferably, a good link to this information?

Thanks in advance...

 

[Rogue]

Use passwords of 7, 14, 21 etc. to eliminate null characters in your password string. A 7 character password is tougher than an 8 character password because the first 7 characters are a password and the eighth character is a single character password padded by 6 other null characters. A good combination of non-printable ASCII characters (ie.-ALT+255), captial letters, lower case letters, numbers and special characters, you will have a pretty damn tough password for anything to crack. I use 14 character passwords everywhere now.