Windows 95 PWL File Encryption Vulnerabilities

Windows 95 introduced Password List (.PWL) files to store cached user credentials locally, but the proprietary encryption algorithm securing them suffered from catastrophic cryptographic weaknesses. Due to predictable file headers, a flawed pseudo-random number generator, and an additive stream cipher design, attackers could perform known-plaintext attacks that completely bypassed the master password. These flaws made it possible to decrypt stored network and dial-up passwords within seconds on standard consumer hardware.

The Role of PWL Files

In Windows 95, PWL files were designed as a single sign-on mechanism. When a user logged into Windows, their master password was used to unlock a corresponding .PWL file (such as USER.PWL). This file contained cached credentials for network shares, NetWare servers, remote access services (RAS), and mail servers, sparing the user from repeatedly typing distinct passwords throughout a session.

The Use of an XOR-Based Stream Cipher

The fundamental cryptographic flaw lay in the implementation of the encryption mechanism. Rather than adopting an established, peer-reviewed standard like DES, Microsoft implemented an RC4-like proprietary stream cipher. The algorithm generated a pseudo-random keystream derived from the user's master password and encrypted the data by applying an exclusive OR (XOR) operation between the plaintext data and this keystream.

Susceptibility to Known-Plaintext Attacks

Because the cipher used an XOR operation, recovering any segment of the original plaintext alongside its corresponding ciphertext would directly reveal the keystream for that specific offset (\(Plaintext \oplus Ciphertext = Keystream\)).

PWL files had a highly predictable internal layout:

  • The username of the account was stored in plain text or at fixed, known offsets.
  • The header structures, record pointers, and resource name fields contained standardized null-padding and static structural metadata.

By taking advantage of these known and predictable bytes, an attacker could instantly reconstruct significant portions of the generated keystream without having to guess or brute-force the master password.

PRNG State Reconstruction

The vulnerability went beyond recovering isolated keystream fragments. The algorithm used an internal state table of 256 bytes to generate the stream. Due to mathematical flaws in the pseudo-random number generator (PRNG), the entire state table could be reconstructed once an attacker recovered approximately 100 to 200 bytes of contiguous keystream via the known-plaintext approach.

Once the generator state was recovered, the attacker could generate the remainder of the keystream forward and backward, allowing the full decryption of all credentials stored inside the PWL file. The attack complexity dropped from an intractable keyspace search to mere milliseconds of computation.

Fallout and Remediation

Shortly after the operating system's launch in late 1995, independent researchers publicly disclosed the flaw and published automated extraction tools. In response, Microsoft released a security update that replaced the broken algorithm with 128-bit RC4 encryption and required users to delete their existing, compromised .PWL files so that new ones could be created under the stronger cipher.