Hacker News new | ask | show | jobs
by lomkju 2035 days ago
How to beat rainbow tables, add some salt.
2 comments

There are actually hash functions designed for password storage (e.g. scrypt, argon2). These functions provide many features in addition to salting. The scrypt whitepaper is pretty easy to read if you want to learn more about this.

https://www.tarsnap.com/scrypt/scrypt.pdf

Will do thanks!
how to discomfort or discourage
For something ancient like original Unix crypt() with 12-bit salt sure, it's just discouragement. A time-space tradeoff like rainbow tables is only going to be ~4096 times worse to calculate and you can amortize that over just 4096 successful attacks.

But this isn't the 1970s suppose you have 32-bit salt, now you need to use the rainbow table in 4 billion attacks to amortize the extra cost. Hey maybe you can attack every adult in the world?

In reality modern hashes often use 128-bit salt. Now you need to do billions of attacks, for each of the billions of people on the planet, just to keep it only billions of billions of times more expensive than brute force per attack. Or to put it more simply: This prevents the use of rainbow tables.