CyberGlossary

Attacks & Threats

Rainbow Table Attack

Also known as: Time-memory tradeoff

Definition

A precomputation attack that uses chains of hash and reduction functions stored in a compact table to invert unsalted password hashes much faster than brute force.

Rainbow tables encode the result of running an entire candidate password space through a hash function as alternating hash/reduction chains, storing only the chain endpoints. To crack a hash, the attacker reruns the reduction chain until the value matches an endpoint, then walks the chain to recover the password. This makes rainbow tables a space–time tradeoff that defeats unsalted hashes for short passwords almost instantly. They are largely neutralised by per-user random salts and modern memory-hard hashing (Argon2id, bcrypt, scrypt), which is why salted hashing is mandatory in every credible authentication design.

Examples

  • Cracking unsalted MD5/SHA-1 password databases with public rainbow tables.
  • Recovering NTLM hashes for passwords up to a given length using ophcrack tables.

Related terms