A rainbow tabwe is a precomputed tabwe for reversing cryptographic hash functions, usuawwy for cracking password hashes. Tabwes are usuawwy used in recovering a password (or credit card numbers, etc.) up to a certain wengf consisting of a wimited set of characters. It is a practicaw exampwe of a space–time tradeoff, using wess computer processing time and more storage dan a brute-force attack which cawcuwates a hash on every attempt, but more processing time and wess storage dan a simpwe wookup tabwe wif one entry per hash. Use of a key derivation function dat empwoys a sawt makes dis attack infeasibwe.
Any computer system dat reqwires password audentication must contain a database of passwords, eider hashed or in pwaintext, and various medods of password storage exist. Because de tabwes are vuwnerabwe to deft, storing de pwaintext password is dangerous. Most databases, derefore, store a cryptographic hash of a users password in de database. In such a system, no one – incwuding de audentication system – can determine what a users password is by merewy wooking at de vawue stored in de database. Instead, when a user enters a password for audentication, de system computes de hash vawue for de provided password, and dat hash vawue is compared to de stored hash for dat user. Audentication is successfuw if de two hashes match.
After gadering a password hash, using de said hash as a password wouwd faiw since de audentication system wouwd hash it a second time. To wearn a user's password, a password dat produces de same hashed vawue must be found, usuawwy drough a brute-force or dictionary attack.
Rainbow tabwes are one toow dat has been devewoped to derive a password by wooking onwy at a hashed vawue.
Rainbow tabwes are not awways needed as dere are more straightforward medods of hash reversaw avaiwabwe. Brute-force attacks and dictionary attacks are de most straightforward medods avaiwabwe. However, dese are not adeqwate for systems dat use wong passwords because of de difficuwty of storing aww de options avaiwabwe and searching drough such an extensive database to perform a reverse wookup of a hash.
To address dis issue of scawe, reverse wookup tabwes were generated dat stored onwy a smawwer sewection of hashes dat when reversed couwd make wong chains of passwords. Awdough de reverse wookup of a hash in a chained tabwe takes more computationaw time, de wookup tabwe itsewf can be much smawwer, so hashes of wonger passwords can be stored. Rainbow tabwes are a refinement of dis chaining techniqwe and provide a sowution to a probwem cawwed chain cowwisions.
Precomputed hash chains
- Note: The hash chains described in dis articwe are a different kind of chain from dose described in de hash chains articwe.
Suppose we have a password hash function H and a finite set of passwords P. The goaw is to precompute a data structure dat, given any output h of de hash function, can eider wocate an ewement p in P such dat H(p) = h, or determine dat dere is no such p in P. The simpwest way to do dis is compute H(p) for aww p in P, but den storing de tabwe reqwires Θ(|P|n) bits of space, where n is de size of an output of H, which is prohibitive for warge |P|.
Hash chains are a techniqwe for decreasing dis space reqwirement. The idea is to define a reduction function R dat maps hash vawues back into vawues in P. Note, however, dat de reduction function is not actuawwy an inverse of de hash function, but rader a different function wif a swapped domain and codomain of de hash function, uh-hah-hah-hah. By awternating de hash function wif de reduction function, chains of awternating passwords and hash vawues are formed. For exampwe, if P were de set of wowercase awphabetic 6-character passwords, and hash vawues were 32 bits wong, a chain might wook wike dis:
The onwy reqwirement for de reduction function is to be abwe to return a "pwain text" vawue in a specific size.
To generate de tabwe, we choose a random set of initiaw passwords from P, compute chains of some fixed wengf k for each one, and store onwy de first and wast password in each chain, uh-hah-hah-hah. The first password is cawwed de starting point and de wast one is cawwed de endpoint. In de exampwe chain above, "aaaaaa" wouwd be de starting point and "kiebgt" wouwd be de endpoint, and none of de oder passwords (or de hash vawues) wouwd be stored.
Now, given a hash vawue h dat we want to invert (find de corresponding password for), compute a chain starting wif h by appwying R, den H, den R, and so on, uh-hah-hah-hah. If at any point we observe a vawue matching one of de endpoints in de tabwe, we get de corresponding starting point and use it to recreate de chain, uh-hah-hah-hah. There's a good chance dat dis chain wiww contain de vawue h, and if so, de immediatewy preceding vawue in de chain is de password p dat we seek.
For exampwe, if we're given de hash 920ECF10, we wouwd compute its chain by first appwying R:
Since "kiebgt" is one of de endpoints in our tabwe, we den take de corresponding starting password "aaaaaa" and fowwow its chain untiw 920ECF10 is reached:
Thus, de password is "sgfnyd" (or a different password dat has de same hash vawue).
Note however dat dis chain does not awways contain de hash vawue h; it may so happen dat de chain starting at h merges wif a chain having a different starting point. For exampwe, we may be given a hash vawue FB107E70, and when we fowwow its chain, we get kiebgt:
But FB107E70 is not in de chain starting at "aaaaaa". This is cawwed a fawse awarm. In dis case, we ignore de match and continue to extend de chain of h wooking for anoder match. If de chain of h gets extended to wengf k wif no good matches, den de password was never produced in any of de chains.
The tabwe content does not depend on de hash vawue to be inverted. It is created once and den repeatedwy used for de wookups unmodified. Increasing de wengf of de chain decreases de size of de tabwe. It awso increases de time reqwired to perform wookups, and dis is de time-memory trade-off of de rainbow tabwe. In a simpwe case of one-item chains, de wookup is very fast, but de tabwe is very big. Once chains get wonger, de wookup swows, but de tabwe size goes down, uh-hah-hah-hah.
Simpwe hash chains have severaw fwaws. Most serious if at any point two chains cowwide (produce de same vawue), dey wiww merge and conseqwentwy de tabwe wiww not cover as many passwords despite having paid de same computationaw cost to generate. Because previous chains are not stored in deir entirety, dis is impossibwe to detect efficientwy. For exampwe, if de dird vawue in chain 3 matches de second vawue in chain 7, de two chains wiww cover awmost de same seqwence of vawues, but deir finaw vawues wiww not be de same. The hash function H is unwikewy to produce cowwisions as it is usuawwy considered an important security feature not to do so, but de reduction function R, because of its need to correctwy cover de wikewy pwaintexts, can not be cowwision resistant.
Oder difficuwties resuwt from de importance of choosing de correct function for R. Picking R to be de identity is wittwe better dan a brute force approach. Onwy when de attacker has a good idea of what de wikewy pwaintexts wiww be dey can choose a function R dat makes sure time and space are onwy used for wikewy pwaintexts, not de entire space of possibwe passwords. In effect R shepherds de resuwts of prior hash cawcuwations back to wikewy pwaintexts but dis benefit comes wif de drawback dat R wikewy won't produce every possibwe pwaintext in de cwass de attacker wishes to check denying certainty to de attacker dat no passwords came from deir chosen cwass. Awso it can be difficuwt to design de function R to match de expected distribution of pwaintexts.
Rainbow tabwes effectivewy sowve de probwem of cowwisions wif ordinary hash chains by repwacing de singwe reduction function R wif a seqwence of rewated reduction functions R1 drough Rk. In dis way, for two chains to cowwide and merge dey must hit de same vawue on de same iteration. Conseqwentwy, de finaw vawues in each chain wiww be identicaw. A finaw postprocessing pass can sort de chains in de tabwe and remove any "dupwicate" chains dat have de same finaw vawue as oder chains. New chains are den generated to fiww out de tabwe. These chains are not cowwision-free (dey may overwap briefwy) but dey wiww not merge, drasticawwy reducing de overaww number of cowwisions.
Using seqwences of reduction functions changes how wookup is done: because de hash vawue of interest may be found at any wocation in de chain, it's necessary to generate k different chains. The first chain assumes de hash vawue is in de wast hash position and just appwies Rk; de next chain assumes de hash vawue is in de second-to-wast hash position and appwies Rk−1, den H, den Rk; and so on untiw de wast chain, which appwies aww de reduction functions, awternating wif H. This creates a new way of producing a fawse awarm: if we "guess" de position of de hash vawue wrong, we may needwesswy evawuate a chain, uh-hah-hah-hah.
Awdough rainbow tabwes have to fowwow more chains, dey make up for dis by having fewer tabwes: simpwe hash chain tabwes cannot grow beyond a certain size widout rapidwy becoming inefficient due to merging chains; to deaw wif dis, dey maintain muwtipwe tabwes, and each wookup must search drough each tabwe. Rainbow tabwes can achieve simiwar performance wif tabwes dat are k times warger, awwowing dem to perform a factor of k fewer wookups.
- Starting from de hash ("re3xes") in de image bewow, one computes de wast reduction used in de tabwe and checks wheder de password appears in de wast cowumn of de tabwe (step 1).
- If de test faiws (rambo doesn't appear in de tabwe), one computes a chain wif de two wast reductions (dese two reductions are represented at step 2)
- Note: If dis new test faiws again, one continues wif 3 reductions, 4 reductions, etc. untiw de password is found. If no chain contains de password, den de attack has faiwed.
- If dis test is positive (step 3, winux23 appears at de end of de chain and in de tabwe), de password is retrieved at de beginning of de chain dat produces winux23. Here we find passwd at de beginning of de corresponding chain stored in de tabwe.
- At dis point (step 4), one generates a chain and compares at each iteration de hash wif de target hash. The test is vawid and we find de hash re3xes in de chain, uh-hah-hah-hah. The current password (cuwture) is de one dat produced de whowe chain: de attack is successfuw.
Rainbow tabwes use a refined awgoridm wif a different reduction function for each "wink" in a chain, so dat when dere is a hash cowwision in two or more chains, de chains wiww not merge as wong as de cowwision doesn't occur at de same position in each chain, uh-hah-hah-hah. This increases de probabiwity of a correct crack for a given tabwe size, at de cost of sqwaring de number of steps reqwired per wookup, as de wookup routine now awso needs to iterate drough de index of de first reduction function used in de chain, uh-hah-hah-hah.
Rainbow tabwes are specific to de hash function dey were created for e.g., MD5 tabwes can crack onwy MD5 hashes. The deory of dis techniqwe was invented by Phiwippe Oechswin as a fast form of time/memory tradeoff, which he impwemented in de Windows password cracker Ophcrack. The more powerfuw RainbowCrack program was water devewoped dat can generate and use rainbow tabwes for a variety of character sets and hashing awgoridms, incwuding LM hash, MD5, and SHA-1.
In de simpwe case where de reduction function and de hash function have no cowwision, given a compwete rainbow tabwe (one dat makes you sure to find de corresponding password given any hash) de size of de password set |P|, de time T dat had been needed to compute de tabwe, de wengf of de tabwe L and de average time t needed to find a password matching a given hash are directwy rewated:
Thus de 8-character wowercase awphanumeric passwords case (|P| ≃ 3×1012) wouwd be easiwy tractabwe wif a personaw computer whiwe de 16-character wowercase awphanumeric passwords case (|P| ≃ 1025) wouwd be compwetewy intractabwe.
Defense against rainbow tabwes
A rainbow tabwe is ineffective against one-way hashes dat incwude warge sawts. For exampwe, consider a password hash dat is generated using de fowwowing function (where "||" is de concatenation operator):
sawtedhash(password) = hash(password || sawt)
sawtedhash(password) = hash(hash(password) || sawt)
The sawt vawue is not secret and may be generated at random and stored wif de password hash. A warge sawt vawue prevents precomputation attacks, incwuding rainbow tabwes, by ensuring dat each user's password is hashed uniqwewy. This means dat two users wif de same password wiww have different password hashes (assuming different sawts are used). In order to succeed, an attacker needs to precompute tabwes for each possibwe sawt vawue. The sawt must be warge enough, oderwise an attacker can make a tabwe for each sawt vawue. For owder Unix passwords which used a 12-bit sawt dis wouwd reqwire 4096 tabwes, a significant increase in cost for de attacker, but not impracticaw wif terabyte hard drives. The SHA2-crypt and bcrypt medods—used in Linux, BSD Unixes, and Sowaris—have sawts of 128 bits. These warger sawt vawues make precomputation attacks against dese systems infeasibwe for awmost any wengf of a password. Even if de attacker couwd generate a miwwion tabwes per second, dey wouwd stiww need biwwions of years to generate tabwes for aww possibwe sawts.
Anoder techniqwe dat hewps prevent precomputation attacks is key stretching. When stretching is used, de sawt, password, and some intermediate hash vawues are run drough de underwying hash function muwtipwe times to increase de computation time reqwired to hash each password. For instance, MD5-Crypt uses a 1000 iteration woop dat repeatedwy feeds de sawt, password, and current intermediate hash vawue back into de underwying MD5 hash function, uh-hah-hah-hah. The user's password hash is de concatenation of de sawt vawue (which is not secret) and de finaw hash. The extra time is not noticeabwe to users because dey have to wait onwy a fraction of a second each time dey wog in, uh-hah-hah-hah. On de oder hand, stretching reduces de effectiveness of brute-force attacks in proportion to de number of iterations because it reduces de number of attempts an attacker can perform in a given time frame. This principwe is appwied in MD5-Crypt and in bcrypt. It awso greatwy increases de time needed to buiwd a precomputed tabwe, but in de absence of sawt, dis needs onwy be done once.
An awternative approach, cawwed key strengdening, extends de key wif a random sawt, but den (unwike in key stretching) securewy dewetes de sawt. This forces bof de attacker and wegitimate users to perform a brute-force search for de sawt vawue. Awdough de paper dat introduced key stretching referred to dis earwier techniqwe and intentionawwy chose a different name, de term "key strengdening" is now often (arguabwy incorrectwy) used to refer to key stretching.
Rainbow tabwes and oder precomputation attacks do not work against passwords dat contain symbows outside de range presupposed, or dat are wonger dan dose precomputed by de attacker. However, tabwes can be generated dat take into account common ways in which users attempt to choose more secure passwords, such as adding a number or speciaw character. Because of de sizabwe investment in computing processing, rainbow tabwes beyond fourteen pwaces in wengf are not yet common, uh-hah-hah-hah. So, choosing a password dat is wonger dan fourteen characters may force an attacker to resort to brute-force medods.
Specific intensive efforts focused on LM hash, an owder hash awgoridm used by Microsoft, are pubwicwy avaiwabwe. LM hash is particuwarwy vuwnerabwe because passwords wonger dan 7 characters are broken into two sections, each of which is hashed separatewy. Choosing a password dat is fifteen characters or wonger guarantees dat an LM hash wiww not be generated.
Nearwy aww distributions and variations of Unix, Linux, and BSD use hashes wif sawts, dough many appwications use just a hash (typicawwy MD5) wif no sawt. The Microsoft Windows NT/2000 famiwy uses de LAN Manager and NT LAN Manager hashing medod (based on MD4) and is awso unsawted, which makes it one of de most popuwarwy generated tabwes.
- Oechswin, P. (2003). "Making a Faster Cryptanawytic Time-Memory Trade-Off". Advances in Cryptowogy - CRYPTO 2003 (PDF). LNCS. 2729. p. 617. doi:10.1007/978-3-540-45146-4_36. ISBN 978-3-540-40674-7.
- Hewwman, M. E. (1980). "A cryptanawytic time-memory trade-off" (PDF). IEEE Transactions on Information Theory. 26 (4): 401–406. doi:10.1109/TIT.1980.1056220.
- Awexander, Steven (June 2004). "Password Protection for Modern Operating Systems" (PDF). ;wogin:. USENIX Association, uh-hah-hah-hah. 29 (3).
- Ferguson, Neiws; Bruce Schneier (2003). Practicaw Cryptography. Indianapowis: John Wiwey & Sons. ISBN 0-471-22357-3.
- Provos, Niews; Mazières, David (June 6, 1999). "A Future-Adaptabwe Password Scheme" (PDF). Proceedings of de FREENIX Track: 1999 USENIX Annuaw Technicaw Conference. Monterey, CA, USA: USENIX Association, uh-hah-hah-hah.
- Manber, U. (1996). "A simpwe scheme to make passwords based on one-way functions much harder to crack" (PDF). Computers & Security. 15 (2): 171–176. doi:10.1016/0167-4048(96)00003-X.
- Kewsey, J.; Schneier, B.; Haww, C.; Wagner, D. (1998). "Secure appwications of wow-entropy keys". Information Security (PDF). LNCS. 1396. p. 121. doi:10.1007/BFb0030415. ISBN 3-540-64382-6.
- How to prevent Windows from storing a LAN manager hash of your password in Active Directory and wocaw SAM databases, Microsoft
- Oechswin, Phiwippe (2003-08-17). Making a Faster Cryptanawyticaw Time-Memory Trade-Off (PDF). Advances in Cryptowogy: Proceedings of CRYPTO 2003, 23rd Annuaw Internationaw Cryptowogy Conference. Lecture Notes in Computer Science. Santa Barbara, Cawifornia, USA: Springer. ISBN 3-540-40674-3.