What Are Rainbow Tables?

Table of Contents (click to expand)

Rainbow Tables are datasets of chains of pre-generated “hash-values” for almost every popular password variant, thus reducing the difficulty of password cracking.

Ever seen a sci-fi thriller where a computer genius hacks into a villain’s computer to find out their top-secret diabolical plan to take over the world? They always showcase a computer screen with futuristic transitions, rapidly rolling lines of code, indecipherable symbols, and cryptic computer jargon. Growing up, that’s what I assumed real hacking would look like. Never have I been so wrong. “Hacking” into an email or social media account is not the glamorous task it’s made out to be on TV. In fact, it’s a painstaking process that requires a great amount of patience. You can’t be typing away at breakneck speed, wildly jabbing at keys, hoping for something to happen.

High Speed Computer Keyboard Typing by Professional Hacker(welcomia)S
Hollywood hacker at work (Photo Credit : welcomia/Shutterstock)

Recommended Video for you:

If you wish to buy/license this video, please write to us at admin@scienceabc.com.

What Is A Brute Force Attack?

One common and rather simplistic method of hacking into an account is called a brute force attack. Essentially, you take a guess at all possible passwords until you arrive at the right one. That’s the only case where you would probably incessantly jab at your keyboard. However, considering the length of the average password, there are at least a billion possible variations. You’d need to try countless combinations of letters, numbers, and symbols before arriving at the right one. Ain’t nobody got time for that. Moreover, passwords are not stored in servers as the original string of text, but are instead stored in a format known as hash values.

Digital crime by an anonymous hacker(Rawpixel.com)s
In a brute force attack, you literally try every word possible to break into an online account (Photo Credit : Rawpixel.com/Shutterstock)

What Are Hash Values?

When companies store your account passwords on their servers, they don’t just store them as simple text. If they did, a simple ‘CRTL-F’ search would lead to the discovery of any password and its associated account. That’s where a hash algorithm proves to be useful. When you set a password for your account, a “hashing algorithm” is run on that string of text to convert it into a “hash value”. A hash value is essentially an encrypted form of the original text. Moreover, you cannot use a “reverse algorithm” to bring the hash value back to its original form. What one could do is “reduce” the hash value to create a new word. In some very unlikely cases, this word may be the original set of string input.

Tags icon line symbol(JustDOne)s
By running a hash algorithm, the original password text is obscured from the prying eyes of hackers (Photo Credit : JustDOne/Shutterstock)

When you log in to your email account or social media website, the system can run the same hash algorithm on your password text and compare the result with the hash value it has on file. While this adds an extra layer of security, hackers could simply have a collection of thousands of passwords and their corresponding hash values. In fact, these collections do exist online and are called “hacker dictionaries”.

What Are Hacker Dictionaries?

To simplify the process, hackers created huge databases full of the most frequently used passwords and their corresponding hash values. When a hash value matches one stored in a hacker dictionary, they simply use the original text corresponding to the hash value as the password and voila, they’re in. Of course, this trick only proves useful in the case of ‘common’ passwords. In other words, if your password is “password” or “password123” or some other infinitely popular password, then your account will get broken into. It’s only a matter of time. In fact, if your password is “password”, a basic brute force attack would more than suffice.

A stream of binary matrix code on the screen(Pogorelova Olga)s
Hacker dictionaries could look like the Matrix code (if you decided to use a green font on a black background) (Photo Credit : Pogorelova Olga/Shutterstock)

What if the password associated with an account is not a common one? What if it’s a random 8-letter word like “scrabble”? Hacker dictionaries could solve the issue of uncommon words by adding as many words as possible to their dictionary. However, storage is finite. Creating a hacker dictionary with every possible word would result in an unmanageably heavy file, much like an actual hardbound dictionary. One would have to lug around a data storage center every time they wanted to crack open an email account.

Also Read: How Are Hackers Able To Figure Out Passwords When There Is A Maximum Limit Of Entering Incorrect Passwords?

What Are Rainbow Tables?

To address this problem of file size, hackers came up with the concept of Rainbow Tables. Rainbow tables are basically indistinguishable from hacker dictionaries at first glance. They include a word, and next to it, its hash value. However, in the case of a Rainbow Table, the original word is hashed. The resultant hash value is ‘reduced’ to create a new word. Then that word is hashed. The new hash is reduced and the resultant word is hashed yet again. This process of hashing and reducing is done about one hundred thousand times. The one hundred thousandth hash value is stored along with the original text.

A Rainbow Table contains a long chain (about 100,000 links) of hash values in each row, instead of just one word and its hash. Essentially, a Rainbow Table can fit 100,000 words in a single row, as opposed to a hacker dictionary, which can fit just one. As a result, it can contain millions of words without having a proportionately large file size. Think of a rainbow table as a color palette. Each row of the table is a particular color, but each color has about 100,000 shades. Thus, we could store the color red, but have access to scarlet, maroon, burgundy, vermillion and many more shades without requiring any extra storage space.

Set of multicolored watercolor dots(Velazquez77)s (1)
A Rainbow Table is essentially a color palette (Photo Credit : Velazquez77/Shutterstock)

How Rainbow Tables Attack Work?

The hash value in a website server is compared against the list of hash values in the Rainbow Table. If there is a match, the corresponding original text is checked against the password that a person is trying to crack. If it’s right, voila, we’re in. If not, then the hash value is reduced to get the next original text in the chain. That text is tested against the password. Basically, we go down the whole chain of values through hashing and reducing at each step until arriving at a value that matches the password. This can still be quite a long, drawn-out process. Moreover, at present, we have Rainbow Tables that are able to crack passwords only up to 10 characters in length. Furthermore, these tables can’t handle complex, gibberish passwords.

This is why a lot of websites force you to somehow complicate your password. Add a capital letter, include a symbol, or have a number somewhere in between. A string of letters, numbers, and symbols, when hashed, would create a hash value that would rarely be a part of any hacker library or Rainbow Table. As a result, it makes for a super-strong password!

Also Read: If Websites Don’t Store Your Password On Their Servers, How Are They Able To Tell You The Strength Of Your Password?

How well do you understand the article above!

Can you answer a few questions based on the article you just read?

References (click to expand)
  1. Password attacks and countermeasures | University of Houston-Clear Lake - www.uhcl.edu
  2. Rainbow Tables- www.cs.utexas.edu
  3. Lecture 24: The Dictionary Attack and the Rainbow-Table .... Purdue University
Share This Article

Suggested Reading

Was this article helpful?
Help us make this article better
Scientific discovery can be unexpected and full of chance surprises. Take your own here and learn something new and perhaps surprising!

Follow ScienceABC on Social Media:

About the Author

Abhishek Kulkarni is an investment banker turned writer and standup comedian. After a graduate degree in business administration and a stint at Citigroup, Abhishek decided to give it all up to follow his passion for the creative arts. Presently he sits in an armchair indulging in whimsical thought, writing on topics that tempt his curiosity and moonlighting as a comic in the city of Bombay