Password Storing and Rainbow Table Baiscs

Password Storing

Passwords are never or should never be stored in plaintext. Then how are they stored or what is the procedure that is used to store them?

The answer to this question is HASH Function.

A hash function is a one way function wherein an input is provided to a function say H(x) and an output is received which is irreversible.

For example:

If x is an input say x= John and H(x) is a function which computes x and gives another value say h(x) where h(x) is the value called as HASH of the input x

The passwords are preferred to be stored as the output of this HASH function. With its nature of irreversibility, even if the BAD guys get hands on your password it will cost them at-least some time to catch hold of your actual passwords and this time can increase drastically depending upon the Algorithm used for HASHING and the complexity of the password you have chosen.

To crack these kind of HASHED passwords there was the concept of RAINBOW TABLES introduced. These are enormous, pre-computed hash values for every possible combination of characters.

The calculation of hashes is possible whenever somebody wants to crack a password, but these tables comes in handy and save the time which can be consumed while creating the hashes which in turn saves  time for your cracking procedure. The generation of HASHES are completely dependent upon efficiency of your algorithm used and largely on the computational power of your machine including the size of RAM you possess.

These rainbow tables also offers you re usability. Once created you can use it to crack passwords on the go rather than computing hashes each time you find a password to crack. No doubt building these rainbow tables is not an easy job. It consumes a lot of time and power.

The smallest available rainbow table available is the basic alphanumeric one which is 388 megabytes.

Some type of Rainbow tables is as under:

Alphanumeric 10k	388 MB	Contains the LanManager hashes of 99.9% of all alphanumerical passwords. These are passwords made of mixed case letters and numbers (about 80 billion hashes). Because the LanManager hash cuts passwords into two pieces of 7 characters, passwords of length 1 to 14 can be cracked with this table set. Since the LanManager hash is also not case sensitive, the 80 billion hashes in this table set corresponds to 12 septillion (or 283) passwords.
Alphanumeric 5k	720 MB	Contains the LanManager hashes of 99.9% of all alphanumerical passwords. However, because the tables are twice as large, cracking is about four times faster if you have at least 1 GB of RAM.
Extended	7.5 GB	Contains the LanManager hashes of 96% of all passwords made of up to 14 mixed case letters, numbers and the following 33 special characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|} ~. There are about 7 trillion hashes in this table set covering 5 octillion (or 292) passwords.
NT	8.5 GB	You can use this table set to crack the NT hashes on machines where the LanManager hash has been disabled. The set contains 99.0% of the hashes of the passwords made of the following characters: up to 6 mixed case letters, numbers and 33 special characters (same as above) 7 mixed-case letters and numbers 8 lower-case letters and numbers There are 7 trillion hashes in this table, corresponding to 7 trillion passwords (the NT hash does not suffer from the weaknesses of the LanManager hash).

The one thing to note here is that each rainbow tables have specific character sets and lengths that they work in. In other words one specific rainbow table is specific to the character set and length. There will be no use of a RAINBOW TABLE which you are using to crack a password whose character set is not in it or the password is too long with respect to the Rainbow table.

Here are some generated Rainbow table sizes for more secure NT hash in case you are targeting for cracking Windows Passwords.

Character Set	Length	Table Size
ABCDEFGHIJKLMNOPQRSTUVWXYZ	14	0.6 GB
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789	14	3 GB
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=	14	24 GB
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/	14	64 GB

So the technique of password cracking can be broadly categorized in to two broad categories. One can be called as ONLINE and the other can be called as OFFLINE.

Online password cracking has its own limitations apart from the encryption and salting procedures you are applying. It majorly depends upon the implementation that you have done. 

For e.g.

• §   How many wrong passwords attempts are allowed before getting a particular user blocked.
• §   Do you block a particular IP if you see unwanted password attempts for a particular account
• §   Is there any implementation of CAPTCHA to avoid any kind of automation attacks or a BOT attack etc..

But the OFFLINE attack comes into picture only when the bad guy has hands on your password file or the password database by some or the other means.

Then the bad guy has all the time in the world to get his brain working towards cracking your password. To avoid or we can say to make the job of the malicious guy more difficult we can add salt to our hashes. This creates more randomness in your password resulting in unique values.

hash = hashing algorithm('salt -' + password)

Salting makes your password prone free for at least Rainbow table attacks provided your SALT is unknown to him.

In the next blog I am going to go a little deep on how Rainbow Tables work  and its use to crack the passwords.