Get the latest tech news
Lessons in disabling RC4 in Active Directory (2021)
Customer lessons learned when disabling RC4 in Active Directory.
The protocol certainly didn't let you do weird things like DES(MD4(password)), so Windows created the MD4+RC4 crypto system. This turns out to be phenomenally powerful because it transparently migrates users to stronger keys without breaking anyone, at a small cost of delaying weeks or months as password changes occur. This is because MD4 itself is a pretty lousy hash algorithm, and it's easier to guess the original password when compared to the AES ciphers.
Or read this on Hacker News
