blocks|key|1526433|text|维基百科的文章有点难以理解。简而言之，您可以将彩虹表看作是一个大型字典，其中包含预先计算的散列和从中计算散列的密码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1526434|彩虹表和其他字典的区别只在于存储条目的方法不同。彩虹表针对散列和密码进行了优化，因此在保持良好的查找速度的同时实现了巨大的空间优化。但本质上，它只是一本字典。|1526435|当攻击者从你那里窃取一长串密码哈希时，他可以快速检查其中是否有任何一个在彩虹表中。对于那些被散列的人，彩虹表还将包含它们的散列字符串。|1526436|当然，有太多的散列存储在一个彩虹表中。因此，如果散列不在特定的表中，黑客就不走运了。但是，如果您的用户使用简单的英语单词，而您只对它们进行了一次哈希运算，那么很有可能一个好的彩虹表将包含密码。|1526437|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

The wikipedia article is a bit difficult to understand. In a nutshell, you can think of a Rainbow Table as a large dictionary with pre-calculated hashes and the passwords from which they were calculated.

The difference between Rainbow Tables and other dictionaries is simply in the method how the entries are stored. The Rainbow table is optimized for hashes and passwords, and thus achieves great space optimization while still maintaining good look-up speed. But in essence, it's just a dictionary.

When an attacker steals a long list of password hashes from you, he can quickly check if any of them are in the Rainbow Table. For those that are, the Rainbow Table will also contain what string they were hashed from.

Of course, there are just too many hashes to store them all in a Rainbow Table. So if a hash is not in the particular table, the hacker is out of luck. But if your users use simple english words and you have hashed them just once, there is a large possibility that a good Rainbow Table will contain the password.

blocks|key|1526249|text|当有人使用Rainbow+table破解密码的时候。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1526250|如果你担心这一点，你应该使用Salt。还有一个Stack+Overlow+question可能会帮助你比维基百科更好地理解salt……|1526251|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Rainbow_table|1|http://en.wikipedia.org/wiki/Salt_(cryptography))|2|https://stackoverflow.com/questions/420843/need-some-help-understanding-password-salt^0|5|D|0|0|E|4|1|N|M|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]|$A|Z|B|10|1|11]]|C|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]|P|$5|I|J|K|C|$L|Q]]]]

It's when somebody uses a <a href="http://en.wikipedia.org/wiki/Rainbow_table" rel="nofollow noreferrer">Rainbow table</a> to crack passwords.

If you are worried about this, you should use <a href="http://en.wikipedia.org/wiki/Salt_(cryptography)" rel="nofollow noreferrer">Salt</a>. There is also a <a href="https://stackoverflow.com/questions/420843/need-some-help-understanding-password-salt">Stack Overlow question</a> that might help you understand salt a little better than Wikipedia...

blocks|key|1311263|text|这是一个外行人员的useful+article+on+Rainbow+Tables。(并不是说你是外行，但这篇文章写得很好，很简洁。)|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1311264|entityMap|0|LINK|mutability|MUTABLE|url|http://kestas.kuliukas.com/RainbowTables/^0|9|W|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

This is a <a href="http://kestas.kuliukas.com/RainbowTables/" rel="noreferrer">useful article on Rainbow Tables</a> for the lay person. (Not suggesting you are a layperson, but it's well written and concise.)

blocks|key|1526516|text|一般而言，您可以加密大量可能的短明文字符串(即密码)，并将加密值与明文一起存储。当您拥有加密值时，这使得简单地查找明文变得(相对)简单。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1526517|这对于弱密码散列和/或无盐密码散列最有用。一个很受欢迎的例子是LAN+Manager+hash，从Windows到XP的各个版本都使用它来存储用户密码。|offset|length|1526518|请注意，即使是像LM哈希表这样简单的预先计算的彩虹表也需要花费大量CPU时间来生成，并占用相当大的空间(大约10+on的数量级)。|1526519|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/LM_hash^0|0|V|G|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

Broadly speaking, you encrypt a vast number of possible short plaintext strings (i.e. for passwords), and store the encrypted values alongside the plaintext. This makes it (relatively) straightforward to simply lookup the plaintext when you have the encrypted value.

This is most useful for weak and/or unsalted password hashes. A popular example is the <a href="http://en.wikipedia.org/wiki/LM_hash" rel="nofollow noreferrer">LAN Manager hash</a>, used by versions of Windows up to XP to store user passwords.

Note that a pre-computed rainbow table for even something as simple as the LM hash takes a lot of CPU time to generate and occupies a fair amount of space (on the order of 10s of gigabytes IIRC).

blocks|key|1311432|text|彩虹表基本上允许人们可行地存储大量预先计算的哈希值。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1311433|这使得破解你的散列密码变得很容易，因为不是执行一堆散列函数，这项工作已经完成，他们实际上只需要做一个数据库查找。|1311434|对这种攻击的最佳保护是在您的密码中使用盐(随机字符)。即，代替存储md5(密码)，存储md5(密码%2B+salt)，或者甚至更好的md5(salt+%2Bmd5(密码))。|1311435|因为即使使用彩虹表，也几乎不可能存储所有可能的加盐哈希。|1311436|顺便说一句，显然你必须把你的盐和你的散列存储起来，这样你才能验证用户的身份。|1311437|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

Rainbow Tables basically allow someone to store a large number of precomputed hashes feasibly.

This makes it easy to crack your hashed passwords, since instead of performing a whole heap of hashing functions, the work has already been done and they virtually just have to do a database lookup.

The best protection against this kind of attack is to use a salt (random characters) in your password. i.e. instead of storing md5(password), store md5(password + salt), or even better md5(salt + md5(password)).

Since even with rainbow tables, it is going to be near impossible to store all possible salted hashes.

BTW, obviously you have to store your salt with your hash so that you can authenticate the user.

blocks|key|1311500|text|聚会晚了，但我也意识到彩虹表是一种攻击哈希/无盐密码的方法。然而，最近在推特上，http://codahale.com/how-to-safely-store-a-password/被分享了，这取决于你的需求和担忧。您可能无法使用您的方式安全地存储密码。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1311501|我希望这能对你有所帮助。|1311502|entityMap|0|LINK|mutability|MUTABLE|url|http://codahale.com/how-to-safely-store-a-password/^0|14|1F|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

Late to the party but I was also aware of Rainbow Tables being a method of attack on hashed/unsalted passwords. However on Twitter recently <a href="http://codahale.com/how-to-safely-store-a-password/" rel="nofollow">http://codahale.com/how-to-safely-store-a-password/</a> was shared and depending on your needs and concerns.. you may not be able to salt your way to safe password storage.

I hope this is informative to you.

blocks|key|1311211|text|维基百科是你的朋友：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1311212|http://en.wikipedia.org/wiki/Rainbow_table|offset|length|1311213|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|16|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@$D|O|E|P|1|Q]]|A|$]]|$1|F|3|-4|5|6|7|R|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|C]]]]

Wikipedia is your friend:

<a href="http://en.wikipedia.org/wiki/Rainbow_table" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/Rainbow_table</a>

I was reading a few articles on salts and password hashes and a few people were mentioning rainbow attacks. What exactly is a rainbow attack and what are the best methods to prevent it?

What exactly is a rainbow attack?

数据库

Windows

我读了一些关于盐和密码散列的文章，有几个人提到了彩虹攻击。彩虹攻击到底是什么?预防它的最好方法是什么？

问彩虹攻击到底是什么？
EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问彩虹攻击到底是什么？EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问彩虹攻击到底是什么？
EN