Browse Definitions :

rainbow table

What is a rainbow table?

A rainbow table is a password hacking tool that uses a precomputed table of reversed password hashes to crack passwords in a database. Although rainbow tables provide security administrators with a method to test password security standards, they also provide hackers a way to quickly crack passwords and gain unauthorized access to computer systems.

Rainbow refers to the different colors used in the table to show the various hashing and reduction functions and steps. With each reduction function being a different color, the final plaintexts and hashes would look like a rainbow.

Passwords aren't typically saved as plain, readable text or plaintext. Instead, they are encrypted using hashes. Hash functions transform any given string of characters into another value. After a user enters a password, that password is converted into hashes. The result is compared with the stored hashes to look for a match. If the hashes match, then the user is authenticated.

Rainbow tables are a listing of the password hash values for each plaintext character used during authentication. Threat actors could either make a large list of hashes that correlate to common passwords or gain access to a list of password hashes. This means they can quickly infiltrate a system without knowing the original password.

Rainbow tables aren't as great of a threat as they used to be because of a process called salting. Salting adds an extra random value to hashed passwords, making the same hash a different hash value.

How do rainbow table attacks work?

Rainbow tables calculate the hash function of every string placed in the table. A rainbow table is constructed using chains of both hashing and reduction functions. Common plaintext passwords are repeatedly passed through a chain of these operations and then stored in the table next to their corresponding hash.

The construction of a rainbow table
A rainbow table is constructed using chains of both hashing and reduction functions.

To crack a password, or for rainbow table attacks, large numbers of hashes are run through a dataset and then through multiple reduction stages to split them into smaller components that are linked to plaintext characters. The plaintext passwords are then stored in the table next to their hashes.

A password-cracking program then compares the rainbow table's list of potential hashes to hashed passwords in the database. If there's a match, the plaintext that produced the hash is retrieved and the process is stopped. With the correct hash, the threat actor can now successfully access the device -- they've cracked the authentication process.

Benefits and drawbacks of rainbow tables

Rainbow tables provide the following advantages:

  • They make password cracking much faster than earlier methods, such as brute-force attacks and dictionary attacks.
  • The process is simplified as a search-and-compare operation, as all of the values in a rainbow table should already be computed.
  • The exact password doesn't need to be known. Authentication is possible as long as the hash matches.

Disadvantages of rainbow tables include the following:

  • They require a large amount of storage to make the attack completable in a realistic amount of time.
  • If the hash the attacker is trying to break isn't in the table, the attack becomes much less viable.
  • Rainbow attacks are much less common due to the use of modern cryptographic hash functions, namely salted passwords.

Protecting against rainbow table attacks

To protect against attacks using rainbow tables, systems administrators should add these security measures:

  • Salting.This technique adds a random string of characters to passwords before encrypting them. Rainbow table attacks work under the assumption that a text string has one specific hash value; the extra generated characters change that expected hash value.
  • Biometric authentication. Rainbow table attacks don't work against biometric passwords, which verify a user's identity. They can't be typed like a password and are unique to that individual.
  • Key stretching. In this method, the password, salt and an intermediate hash value are run through a hash function multiple times to increase the computation time for the attack.
  • Server monitoring. Server security software is designed to detect an attack before any threat actors find a password database.
  • Secure hash functions. Organizations should discontinue using outdated hashing algorithms such as the message-digest algorithm or Secure Hash Algorithm 1. Instead, they should consider using SHA-3, which is more secure.

Future of rainbow tables

Since the salting technique started being used, the prevalence and threat of rainbow table attacks have decreased dramatically. For example, Unix, Linux and Berkley Software Distribution use salted hashes. Even Apple Keychain, Apple's password management system in macOS, uses salt. Although Windows systems don't use salt, they can still encrypt stored hashes using the system key or Syskey utility. However, rainbow table attacks are possible on Windows for eight- and nine-character New Technology LAN Manager passwords

GPU-based brute force attacks have become more practical than rainbow table attacks. GPU brute-force attacks are similar to regular brute force attacks, but the graphics processing unit of a PC searches for passwords. Comparatively, rainbow table attacks are slower, less scalable and are specific to given password hash and password types.

Learn more about password security and its relation to character length.

This was last updated in September 2022

Continue Reading About rainbow table

  • subnet (subnetwork)

    A subnet, or subnetwork, is a segmented piece of a larger network. More specifically, subnets are a logical partition of an IP ...

  • Transmission Control Protocol (TCP)

    Transmission Control Protocol (TCP) is a standard protocol on the internet that ensures the reliable transmission of data between...

  • secure access service edge (SASE)

    Secure access service edge (SASE), pronounced sassy, is a cloud architecture model that bundles together network and cloud-native...

  • intrusion detection system (IDS)

    An intrusion detection system monitors (IDS) network traffic for suspicious activity and sends alerts when such activity is ...

  • cyber attack

    A cyber attack is any malicious attempt to gain unauthorized access to a computer, computing system or computer network with the ...

  • digital signature

    A digital signature is a mathematical technique used to validate the authenticity and integrity of a digital document, message or...

  • What is data privacy?

    Data privacy, also called information privacy, is an aspect of data protection that addresses the proper storage, access, ...

  • product development (new product development)

    Product development -- also called new product management -- is a series of steps that includes the conceptualization, design, ...

  • innovation culture

    Innovation culture is the work environment that leaders cultivate to nurture unorthodox thinking and its application.

  • organizational network analysis (ONA)

    Organizational network analysis (ONA) is a quantitative method for modeling and analyzing how communications, information, ...

  • HireVue

    HireVue is an enterprise video interviewing technology provider of a platform that lets recruiters and hiring managers screen ...

  • Human Resource Certification Institute (HRCI)

    Human Resource Certification Institute (HRCI) is a U.S.-based credentialing organization offering certifications to HR ...

Customer Experience
  • What is an outbound call?

    An outbound call is one initiated by a contact center agent to prospective customers and focuses on sales, lead generation, ...

  • What is lead-to-revenue management (L2RM)?

    Lead-to-revenue management (L2RM) is a set of sales and marketing methods focusing on generating revenue throughout the customer ...

  • What is relationship marketing?

    Relationship marketing is a facet of customer relationship management (CRM) that focuses on customer loyalty and long-term ...