31 a rainbow table is just a pre computed table of

31

A rainbow table is just a pre-computed table of all possible
password values and their corresponding hashes. The idea
behind rainbow table attacks is to trade computational
power for disk space by pre-computing the hashes and
storing them in a table. An attacker can determine what the
corresponding password is for a given hash by just looking
up the hash in their rainbow table. This is unlike a brute
force attack where the hash is computed for each guess
attempt. It's possible to download rainbow tables from the
internet for popular password lists and hashing functions. This further reduces the need for
computational resources requiring large amounts of storage space to keep all the password and hash
data. You may be wondering how you can protect against these pre-computed rainbow tables. That's
where salts come into play. And no, I'm not talking about table salt.
A password salt is additional randomized data that's added into the hashing function to generate the
hash that's unique to the password and salt combination. Here's how it works.
A randomly chosen large salt is concatenated or tacked onto the end of the
password. The combination of salt and password is then run through the
hashing function to generate the hash which is then stored alongside the salt.
What this means now for an attacker is that they'd have to compute a rainbow
table for each possible salt value. If a large salt is used, the computational and
storage requirements to generate useful rainbow tables becomes almost
unfeasible. Early Unix systems used a 12 Bit salt, which amounts to a total of
4,096 possible salts. So, an attacker would have to generate hashes for every
password in their database, 4,096 times over. Modern systems like Linux,
BSD and Solaris use a 128 bit salt. That means there are two to the 128 power
possible salt values, which is over 340 undecillion. That's 340 with 36 zeros
following. Clearly, 128 bit salt raises the bar high enough that a rainbow table
attack wouldn't be possible in any realistic time-frame. Just another scenario when adding salt to
something makes it even better. That runs out our lesson on hashing functions. Up next we'll talk about
real world applications of cryptography and explain how it's used in various applications and protocols.
But first, a project that will help you get hands on with hashing.
32

Cryptography Applications
Public Key Infrastructure
In this lesson, we're going to cover PKI, or Public Key Infrastructure . Spoiler alert, this is a critical
piece to securing communications on the Internet today. Earlier we talked about Public Key
Cryptography and how it can be used to securely transmit data over an untrusted channel and verify the
identity of a sender using digital signatures.
PKI is a system that defines the creation, storage and distribution of digital certificates. A digital
certificate is a file that proves that an entity owns a certain public key.