21–30 of 64 posts
If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
With a separate salt for each password the rainbow table becomes useless. If an attacker has both the salt and the hash, they are back to computing the table (brute force)
If the salt is short (username, email address, phone number, user id, etc.) then this becomes much more of a serious attack, specifically if the salt+password combination is less than 14 characters.
Earlier quoted context omitted.
If the salt is short (username, email address, phone number, user id, etc.) then this becomes much more of a serious attack, specifically if the salt+password combination is less than 14 characters.
A salt is a salt, not username or any other user information.
Hmm, I guess I'll just go out to 15 (or 60, safe for a few years) digits of Pi instead of 14...
The rainbow tables are an implementation of a form of time-memory tradeoff attack using a refined hash reduction algorithm based on the work of Martin Hellman (of Diffie-Hellman fame) - http://en.wikipedia.org/wiki/Rainbow_table Basically Ophcrack uses optimised hash chains to speed things up. The precomputed hashes are generated with a specific character set. This works particularly well for unsalted algorithms that…
Your best bet to protecting from rainbow tables [..]
If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
I'm not entirely sure which algorithm is used in WinXP for password hashing, but it might still be an LM hash, which has some security flaws. All lower-case characters are converted into upper case characters and the 14-byte password (cannot be longer) is divided into two 7-byte passwords, which can be cracked alone (sort of). So, 300 billion passwords per second is still a very impressive load, but the keyspace for…
From Vista onwards, I think, LM is no longer used.
I believe it's not accidental that all passwords that they crack in the demo are 14 characters or less, that can mean that they attack the hashes which are always possible to crack, the speedup they claim is 100 (they simply increased tables from 8 GB to 80 GB and put them on SSD) but e.g. 1000 seconds before was also very fast for somebody who just needed to gain access to one target.
The rainbow tables are an implementation of a form of time-memory tradeoff attack using a refined hash reduction algorithm based on the work of Martin Hellman (of Diffie-Hellman fame) - http://en.wikipedia.org/wiki/Rainbow_table Basically Ophcrack uses optimised hash chains to speed things up. The precomputed hashes are generated with a specific character set. This works particularly well for unsalted algorithms that…
Your best bet to protecting from rainbow tables [..] is using a salt. No need to use uncommon characters.
For anything else, ready salted is definitely the best crypto flavour.
Having said that, a few years ago I co-ordinated a distributed effort to create rainbow tables for standard Oracle database accounts. Oracle's crypto mechanism uses the username as a salt. It meant that we had to generate different (but small as the algorithm was crap) tables for DBSNMP,SYSTEM etc. The same applies to WPA-PSK - don't use a common SSID in the Church of Wifi tables.
I guess the moral of the story is that salting alone won't get you out of the woods. You need to think very carefully when it comes to crypto, and get as many second opinions as you can.
What stupid linkbait. Cracking LM-hashed passwords is about as interesting as .1 + .2 != .3 in ieee754. Can we at least change the headline to something like "Newsflash: SSDs faster than spinning platters"?