LWN: Comments on "Rainbow tables for password cracking"

Rainbow tables for password cracking

stuartdenley — Wed, 03 Sep 2008 20:19:49 +0000

RainbowCrack is a general propose implementation, the lan manager table can be used to break windows password. Stuartdenley Crack Cocaine

Rainbow tables for password cracking

dmenest — Wed, 22 Nov 2006 01:33:08 +0000

The MD5 password hash is a lot more complicated than a simple MD5 hash. In fact, the code to generate the password hash calls the simple MD5 hash routine more than 1000 times. So you won't be able to do it easily on the command line without a program that calls the crypt() function for you.

Rainbow tables for password cracking

jond — Sat, 18 Nov 2006 14:39:53 +0000

Very interesting. Forgive my ignorance, but how is the hash then stored? I use md5 passwords (at least I told the installer to do so ;).

If I setup a temp user with password Ior3yaeW, I get the following:

temp:$1$.K4dEqjn$pHNfFwq4BAUHf7TcUScuJ1:13470:0:99999:7:::

so if I echo Ior3yaeW.K4dEqjn | md5sum ; what do I do to _that_ to get pHNfFwq4BAUHf7TcUScuJ1 ?

Rainbow tables for password cracking

jake — Fri, 17 Nov 2006 04:14:59 +0000

> Unfortunately, it seems as if all of my many Debian-based systems use "1" as the salt.

No, the salt is actually between the next 2 dollar signs ... $1$salt$hash

$1$ indicates the format of the password ...

hope that helps!

jake

Rainbow tables for password cracking

zaitseff — Fri, 17 Nov 2006 02:53:28 +0000

The best defense against rainbow tables is ‘salt’, which has been a part of UNIX passwords since near the beginning of time (UNIX epoch time anyway) […] Linux MD5 passwords store the salt between two dollar signs in the password field in /etc/shadow.

Unfortunately, it seems as if all of my many Debian-based systems use "1" as the salt. Are other GNU/Linux systems different? I am guessing that this would depend on the version of the shadow package being used on the system.

Rainbow tables for password cracking

dvrabel — Fri, 10 Nov 2006 11:31:15 +0000

I assume LWN stores salted and hashed passwords?

Rainbow tables for password cracking

drfickle — Thu, 09 Nov 2006 15:42:21 +0000

Great article. I don't think I've seen many web apps which salt the passwords.