A rainbow table is a special type of lookup table that is constructed by placing a plaintext password entry in a chain of keys and cyphertexts, generated by a one-way hash. The end result is a highly compressed table that contains statistically high chance of revealing a password within a short period of time, generally less than a minute. The success probability of the table depends on the parameters used to generate it. These include the character set used, password length, chain length, table count. Tables are hash specific, e.g. MD5 tables can only crack MD5 hashes. The theory of this technique was first pioneered by Philippe Oechslin [1] as a fast form of time-memory tradeoff [2](PDF). In computer science, a lookup table is a data structure, usually an array or associative array, used to replace a runtime computation with a simpler lookup operation. ... A hash function or hash algorithm is a function for summarizing or probabilistically identifying data. ... In computer science, a space-time tradeoff (also a time-memory tradeoff) can sometimes be made in the event of a shortage of either time or space. ...

Defense against Rainbow Tables

A rainbow table is essentially worthless against one-way hashes that include tokens (or salts, in the case of 56-bit DES). For example, if a password hash is generated using the following function (where "." is the concatenation operator): General Designer(s) IBM First published 1975 (January 1977 as the standard) Derived from Lucifer (cipher) Cipher(s) based on this design Triple DES, G-DES, DES-X, LOKI89, ICE Algorithm detail Block size(s) 64 bits Key size(s) 56 bits Structure Feistel network Number of rounds 16 Best... In formal language theory (and therefore in programming languages), concatenation is the operation of joining two character strings end to end. ...

 hash = md5sum(password . token) 

...a password cracker would have to generate both every possible token for every possible password -- a rainbow table would not give any benefit. However, if a password hash is generated using the following function:

 hash = md5sum(password) 

...a password cracker may benefit from a rainbow table.

Nearly all distributions and variations of Unix, Linux, and BSD use one-way hashes and salts, though many PHP web applications use regular MD5. It has been suggested that List of Unixes be merged into this article or section. ... Tux, a cartoon penguin frequently featured sitting, is the official Linux mascot. ... BSD redirects here; for other uses see BSD (disambiguation). ... PHP is an open-source, reflective programming language used mainly for developing server-side applications and dynamic web content, and more recently, other software. ...

External links

• Plain-Text Team - Largest Distributed Rainbow Table Cracking System (over 600gb of tables)
• Project RainbowCrack - Official site.
• RainbowCrack Tutorial - Tutorial on using Rainbow Tables.
• winrtgen - GUI for rtgen.
• PassCracking.com - MD5 online cracking.
• PassCracking.ru - MD5 online cracking + database.
• rainbowtables.shmoo.com - Free LanMan rainbow tables.
• http://rainbowcrack.com/ - Community based distributed rainbow table generation