Questions tagged [rainbow-table]

A rainbow table allows inverting a cryptographic function (typically, a hash) at low cost, after a precomputation.

Filter by
Sorted by
Tagged with
15
votes
5answers
4k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
12
votes
1answer
16k views

Example Rainbow Table Generation

I have read up on rainbow tables and think I understand the idea behind them. However, I find that it would be better for me to actually attempt to implement a (very basic) rainbow table generator in ...
6
votes
3answers
2k views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
6
votes
3answers
2k views

Are rainbow tables still useful?

With unsalted passwords becoming rare, and stream ciphers having a significantly large state, are there currently any widely deployed systems still vulnerable to such time-memory-data trade-off ...
6
votes
1answer
4k views

How to create reduction functions in rainbow tables?

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
6
votes
1answer
9k views

Is this SHA256 hash implementation secure from rainbow table, brute forcing attacks?

So I have an implementation where by we have an $8$-byte random input (entirely random, not user defined) which we hash with $\text{SHA256}$. The hash is shared with many parties to the point that we ...
4
votes
1answer
497 views

Are there any known inverse hash lookups for the zero string?

Just wondering, are there any known inverse hashes / hash lookups in common hashes (md5, sha1, sha2, etc.) for the zero string hash value? (i.e. bytes 0x00 00 00 00 00 ...) Or more specifically, for ...
4
votes
1answer
140 views

Which values to store in rainbow table generation?

According to the Wikipedia and Philippe Oechslin's Making a Faster Cryptanalytic Time-Memory Trade-Off (pdf), both starting points and endpoints are keys. Here is an example from Wikipedia: As you ...
4
votes
1answer
2k views

How to choose the reduction function in rainbow tables?

I have a question regarding Reduction Functions in Rainbow Tables. If the hashing function is MD5 or SHA-1 etc then should the reduction functions also be MD5 or SHA-1? That is, should the Reduction ...
3
votes
5answers
935 views

How does a salt get chosen?

I feel like I am missing some information regarding salting. How does one choose the salt? If you reuse the same salt for all passwords, can it just be figured out and then used in conjunction with ...
3
votes
2answers
2k views

How does using salt reduce rainbow table attack?

I could create a rainbow table for a particular salt value and still create a successful attack similar to one without salt value.
3
votes
1answer
224 views

Given a sha-512 hash of a value picked at random from the $2^{128}$ key space, how hard would it be to recover the original value?

More specifically is it reasonable to assume that someone with the resources of a state actor can feasibly compute a rainbow table of all the sha-512 hashes of values within the $2^{128}$ key space? ...
3
votes
1answer
632 views

Rainbow Table - Number of Chains and Chain Length

Is there a difference between having 10,000 of chains (with 1,000 chain length) and 10,000 chain length (with 1,000 of chains)? How does it affect the success rate of the rainbow table? I understand ...
2
votes
2answers
368 views

Idea for user/pass hashing to prevent rainbow tables, would it work?

I'm very new to cryptography (and security in general, for that matter), but I had an idea that I'm sure is very flawed, but is worth asking. If a computer user, online account, etc, needs to verify a ...
2
votes
1answer
230 views

Why must we hash lot of times in rainbow tables?

I don't get the utility to chain and reduce in generating rainbow tables. Hash functions are made to not have collisions, or at least chain only 2 times so we don't return to the concept of the hash ...
2
votes
2answers
1k views

Is rainbow table attack applicable to any hash?

Typically when rainbow tables are discussed MD5 hash is used as an example. It's not quite clear whether this attack is specific just to MD5 or to a certain subset of hashes or to just any hash ...
2
votes
1answer
209 views

How to prove that a rainbow table is complete?

Passwords that are hashed but not salted can be cracked using the rainbow table. I went through this and this which explains the logic behind rainbow table very well. But I am missing something about ...
2
votes
2answers
690 views

Multiple Rainbow Tables and their Success Probability

I am trying to understand the calculations for the success probability of finding an unknown key using rainbow tables. Basically, I have a target success probability, a known keyspace of size $N$ and ...
2
votes
1answer
983 views

What's the perfect chain length : number of chains ratio for rainbow tables?

I'm building a SHA-1 rainbow table to crack basic passwords (i.e. up to 10 character, 0-9,a-z), but I can't seem to calculate that golden ratio that would give me the most coverage. What ration of ...
2
votes
1answer
929 views

Construct rainbow table to break DES for a fixed plaintext

I'm facing a project where I need to build a rainbow table to break DES for a fixed plaintext. I've already collected information about Hellman, DP, rainbow table method. Finally, I chose the rainbow ...
2
votes
1answer
421 views

Rainbow tables, where have I got it wrong?

There seems to be some error in my understanding of the concept of rainbow tables, despite going through quite a bit of articles on it. Let me show what I don't seem to agree with. My plain text is ...
2
votes
1answer
898 views

Rainbow tables and blowfish

I'm thinking of implementing rainbow tables for a specific blowfish problem, but I have trouble thinking of the proper way to apply the original paper (and its application to hash functions) to ...
2
votes
0answers
44 views

Are the prime numbers used for RSA encryption known? [duplicate]

I read that one reason why RSA is secure is because it uses a huge number that's called the modulus which is the product of two prime numbers. For maths reasons the prime numbers being prime numbers ...
1
vote
1answer
824 views

What effect does a salt have on attacks against hashes's fundamental properties?

I am interested in analyzing how adding a salt to our hashed passwords affects the three types of attacks we can use. The three types of attacks against hashes are as follows: We have the hashed ...
1
vote
1answer
48 views

Is there a point in storing hash or plaintext in the last column of Rainbow Tables

As I read up on rainbow tables, I found that most sources suggest storing a plaintext - the result of Rk(hk) - in the last column, while others just store the hash hk, basically stopping one step ...
1
vote
2answers
332 views

Time complexity of looking up in a rainbow table

It is mentioned in the famous paper Making a Faster Cryptanalytic Time-Memory Trade-Off (pdf) by Philippe Oechslin that: The total number of calculations we have to make is thus $\frac{t(t−1)}{2}$...
1
vote
2answers
371 views

How to guarantee every plaintext is in a rainbow table?

This guide says that for a rainbow table or pre-computed hash chain, you can only get a probability that a plaintext is in a table, not a guarantee. Is there a way to guarantee every possible ...
1
vote
1answer
52 views

Is hashing data with dynamic keys still worth effort?

some years ago it took long time to "decrypt" hashes because they took slow cpu to brute force. Nowadays they use graphic cards for stuff like this and can do this most time in less than 20 Minutes ...
0
votes
1answer
84 views

Capital passphrases with rainbow tables?

I'm currently trying to learn how rainbow tables work for a personal project of mine, but I am a little bit confused on how passphrases can be found. Here are the steps that seem do this, from the ...
0
votes
1answer
213 views

Using rainbow tables to find encryption keys of block ciphers?

Hi I have a question in mind. Let's consider a block cipher whose key length is 36 bits. The bit-length of the plaintext is 256 bits, but there are only 16 possible plaintexts $m_0, m_1, . . . , ...
0
votes
1answer
67 views

Is there (this) a case in which salting is dispensable?

tl;dr this is not a duplicate of "what is a salt/why use salt?" question. Instead it is specificly asking when salt may not be necessary for hashing securly? (i.e. when the data being hashed is ...
0
votes
0answers
128 views

Reduction function Generation

I think I know how rainbow table works , I just wanted to make basic reduction function(for md5) in python with an approach that I am not taking a certain portion of hash but am taking the full hash ...
0
votes
1answer
459 views

Having trouble understanding reduction functions in rainbow tables

I'm continuing doing some personal research on rainbow tables, but forsome reason I cannot understand how to choose the correct reduction function. Wikipedia states that "Only when the attacker has ...
-2
votes
1answer
165 views

Secure password storing mechanism [closed]

I recently thought about a secure password storing mechanism. I wanted to ask if the following password storing mechanism is resistant against rainbow tables with a secure password and the attacker ...
-4
votes
2answers
601 views

Decrypting SHA-256 with SHA-256 as input?

Is there a way to somewhat decrypt a SHA-256 hash, provided that the initial string was also a SHA-256 hash? If not, could anyone link me to a rainbow table containing some of the $16^{64}$ possible ...