by aestetix

What are rainbow tables?

A rainbow table is a lookup table designed to help recover plaintext from a one-way hash. It is created by collecting all possible (in theory) plaintexts of a specific nature (length, character set) and their respective outputs from a hash function. In short, it's a code book for a hash function. These tables can then be used to run quick brute-force attacks against hashes. Due to their nature, rainbow tables are very large (ranging from 500 megs to 40 gigs), and take many days to compute, depending on processor speed. This is known as a time-memory tradeoff because it consumes enormous time to create, but once they are created password recovery is -very- quick.

For more information, check out:
"A Cryptanalytic Time-Memory Trade-Off" (Marty Hellman)
"Making a Faster Cryptanalytical Time-Memory Trade-Off" (Philippe Oechslin)

There are also a few active rainbow table projects:
http://www.antsight.com/zsl/rainbowcrack/ (tools to create your own rainbow tables)
http://rainbowcrack.com/ (contribute to a world-wide effort to create rainbow tables)
http://rainbowtables.shmoo.com/ (rainbow tables of different sizes, compliments of Shmoo group)

 

 
Read more of   The Yak's Frequently Questioned Answers   (mod.2010-02-10)

441.   What is Conware?   [jake/2006-12-22]
404.   How can I limit the ammount of bandwidth rsync over ssh (or anything else) uses, without a complicated firewall solution?   [leif/2004-02-06]
383.   How do I translate to and from Japanese?   [novalis/2003-09-25]
382.   What is the best combination Sushi Bar / Internet Cafe in Berlin?   [jake/2003-09-25]
359.   Is Larry Wall on crack?   [strick/2003-04-10]
343.   How can I patch my in kernel PCMCIA orinoco drivers so that I may change my MAC address/enter MonMode? (and use kismet, airsnort and the like...)   [jake/2002-12-19]
335.   What is Bob?   [gopherdave/2002-11-04]
313.   What is the best way to end your console session with a Ultra Enterprise 2 when connected with cu?   [jake/2002-05-06]
302.   How can I raise my website's placement on google?   [macki/2002-01-20]
293.   where can i find data about the most common names in the USA?   [jesse/2001-12-05]
266.   Why won't sites with 24.x.x.x IPs respond to HTTP requests?   [rupe/2001-08-13]
244.   Does Jeffrey read too many web comics each day?   [strick/2001-06-06]
232.   Where can i find a stamp sized ethernet web server for (barely)less than $100?   [sidd/2001-05-30]
218.   how do I make my page appear in web search results?   [josh/2001-05-08] ( strick/2001-05-08 )
185.   what are some cool domain names?   [jesse/2001-02-26] ( josh/2001-04-03 )
156.   Where did Sprint come from?   [rupe/2000-12-30]
128.   What is a TINI, and what are some good sources of information on it?   [jesse/2000-10-07]
117.   Where can I find information on character codes, and encoding issues?   [rupe/2000-09-12]
78.   Where can I find the latest copy of nmap?   [rupe/2000-04-22]
73.   How many Zelda games are there?   [vonguard/2001-06-25] ( combee/2001-07-10 mennonite/2001-03-27 )
56.   Hows do i make bogus IDENTD   [ross/2000-02-11] ( jesse/2000-11-15 strick/2000-10-30 )
52.   What countries are .HR .SR .TT .LK etc.   [strick/2000-02-07]