In that case, to recover current password, it would be sufficient to have the password from credential history, set between the current password and the duplicate. Theoretically, there is a chance that user sets a password that has already been used before (let's call it duplicate). Encryption algorithms used to decode credential history hases in DPAPI.ĬREDHIST stores all the previous password hashes, even though the passwords are identical. In general, the encryption algorithm is similar to the one that is used for protecting Master Keys. If the Master Key still resists, the first hash in the CREDHIST history decrypts the second hash, and the operation repeats.ĭifferent operating systems use different default parameters and algorithms for encrypting credential history (see the table 3 below). If an error occurs when decrypting the Master Key using current password, DPAPI uses the logon password to decrypt the first hash in CREDHIST and attempts to decrypt the Master Key with the first CREDHIST hash. Credentials history decryption scheme in DPAPI. Therefore, to decrypt the entire chain, one needs to know user's current password (see fig. Each password hash is encrypted with the preceding hash, and the first hash is encrypted with user's current password.

Slots with user's hashes are stored in series, one after another. Random set of binary data used for encryptingįigure 6 shows the data storage scheme used in CREDHIST. Security identifier size of the data owner Type of password used for decrypting current link } CREDENTIAL_HISTORY, *PCREDENTIAL_HISTORY Ĭurrent link version of the credential history chain If we look at the credential history file as a chain, each slot with a password hash would appear as a link of the chain with the following binary structure: typedef struct _tagCREDENTIAL_HISTORY All the previous passwords are stored as hashes in a special container file named CREDHIST, located in the %APPDATA%/Microsoft/Protect folder. The proper functioning of DPAPI assumes keeping all of user's previous passwords.

Wpa password list txt skype