Windows 95 Password Caching and PWL Files

This article examines how Windows 95 handled credential management through Password List (PWL) files, detailing the caching architecture, the severe cryptographic flaws present in its initial implementation, and the subsequent security updates Microsoft released to address those vulnerabilities.

The Purpose and Role of PWL Files

In Windows 95, Microsoft introduced Password List (.pwl) files to streamline user access across various local and network services. Located in the C:\WINDOWS directory and named after the logged-in user (e.g., username.pwl), these files served as a unified local cache. Whenever a user accessed an SMB network share, a NetWare resource, a dial-up networking connection, or an application like Microsoft Mail, Windows 95 offered an option to save the password.

Instead of prompting the user repeatedly during a session, the operating system queried the Multiple Provider Router (MPR.DLL). This component retrieved the necessary credentials directly from the PWL cache and supplied them to the appropriate network provider.

The Master Key Mechanism

The security model of the PWL file relied on the user's primary Windows logon password:

  1. Authentication: When a user booted the machine and entered their Windows username and password, the system used that input to generate a master decryption key.
  2. Decryption: If the master key successfully unlocked the PWL file, Windows decrypted the file's contents into memory.
  3. Session Management: Throughout the session, the cached credentials remained in memory for seamless authentication against network resources.
  4. Locking/Saving: When the user logged off or shut down, the in-memory cache was discarded. Any newly added credentials had already been encrypted using the master key and written back to the .pwl file on disk.

If a user logged in with a blank password, the system warned them that password caching would be unavailable, as an empty string could not securely derive a decryption key.

The Original Cryptographic Flaw

The initial release of Windows 95 (OEM Service Release 1 and earlier) contained a major cryptographic flaw in how PWL files were protected.

Rather than using established cryptographic algorithms like DES or RC4, Microsoft developed a proprietary stream cipher based on a 32-bit key and an additive pseudo-random sequence. The key generation algorithm was heavily flawed:

  • Known-Plaintext Weakness: The structure of PWL files contained fixed, predictable headers and padding.
  • Key Leakage: Because the encryption relied on modular addition and fixed XOR patterns, recovering a single plaintext byte directly revealed the corresponding byte of the encryption keystream.
  • Keystream Reconstruction: In late 1995, independent security researchers demonstrated that an attacker did not need to brute-force the user's master password. By analyzing known plaintext offsets, an offline attacker could reconstruct the entire 256-byte keystream within seconds, exposing every stored username, service, and password in plain text.

The Microsoft Patch and RC4 Transition

Following public disclosure of the vulnerability, Microsoft released a security update in early 1996 (often distributed via MSPLEX.EXE).

The patch completely replaced the proprietary cipher with a 128-bit RC4 encryption algorithm. Under the revised system:

  • The master password was hashed to produce a 128-bit key.
  • The system deleted the older, insecure PWL files and generated new ones using the RC4 standard upon the user's next login.
  • The new mechanism effectively closed the algorithmic shortcut, forcing any offline attack against a patched PWL file into a significantly more computationally expensive brute-force attempt against the master password.