Distributed Computing Rainbow Tables

Hi sec_ware

I cannot see anything wrong with your argument, even if your numbers may not be absolutely accurate. I think they clearly indicate the ball park that we are dealing with. And you were only looking at the MD5 hash?

Downloading huge tables would hardly be an option, as who would host these huge tables and have the bandwidth to support people downloading them? :confused:

The big ones I have seen come on DVDs or CDs, and quite a lot of them. Who is going to pay for the media, burn it then ship it? After all, the people who would notionally subscribe to this project would only be contributing computer time?

Who would assemble the end result. Burn it to DVDs, process requests, pack the product and ship it? That takes TIME as well as money.

Anyway, most of us would have to spend a fair amount on the additional storage required to handle huge rainbow tables. In fact, I suspect that a lot would have to build a whole new box :eek:

I just think that the whole project would be too large and costly.

If you look at SETI and Folding, they have a properly funded and organised administrative infrastructure to collect and collate data, and they are not sending massive files to the contributors.

Just my thoughts

Hi Nihil


The numbers (alphabet, password-length) are taken for illustrative purposes
only, as well as the algorithm chosen. I had a MD5 implementation at hand,
so I used it. DES and MD4, although used in the [NT]LM, are of no interest
for my purposes :)


I think, you made the point.
Useful tables are computationally expensive and huge. Standard distribution
channels are not suited for those kind of products. Who is interested in
100+ DVD's except specialised companies, global players and government/military,
and in addition, has the necessary equipment? And who is offering such a service
with profit worth the effort? Sarca[1] sells 18 Gbyte LM Hash Tables on 5 DVD's
for 95 Euro...Cheap, but you won't come far with those tables I claim.


In a home-user environment, tables of dictionary-like entries would be more promising,
and can be generated locally in principle as effective as by downloading it...


Cheers.

[1] http://sarcaprj.wayreth.eu.org/

I can tell you where you're wrong. :p First, I'm talking about using LM hashes, and if you read the rainbowcrack faq you'll see that MD5 takes way less time to compute. Also, your estimated size of the rainbow table is rather huge.

Edit: No one host needs to host these. I sugested using Bittorrent in my first post, which means the people that downloaded it would also host it.

Jareds,

I see your points - and you are right from you point of view and sources.
Let me elaborate :)

My choice MD5 did not reflect your initial goal. You would like to generate
LM hashes rainbow table. Note, I have assumed 3.5 Mio hashes a second
for MD5 (but benchmarked 2 Mio. hashes), while Oechslin[1] achieved in
2003 700.000 a second for LM...

My estimate of the required table size is based on the assumption of a
100% crack. One entry in my table (unoptimised) requires 7 bytes for the
password and 16 bytes for the MD5 hash about 24 bytes per hash :)
The number of possible values is based on your alphabet: I took a
huge number of elements (70), hence my estimate.

The number of elements in the alphabet, the length of the password, but
also the to be achieved percentage of successful "cracks" does massively
influence the size of the keyspace = size of disk storage.

Example configuration 4: (from antsight.com[2]): LM hash!
Plaintext-Password: 1-7 bytes
Alphabet: 68 bytes
Success-Rate: 99.9%
Disk-usage: 119 GB !

If you want a useful, accurate table, this is the amount of
storage you will need, disregarding the computation time,
for <=7 byte passwords!

Cheers.

[1] http://lasecwww.epfl.ch/~oechslin/pu...s/crypto03.pdf , p4
[2] http://www.antsight.com/zsl/rainbowc...igurations.htm

jareds411

Quote:

---

Also, your estimated size of the rainbow table is rather huge.

---

I am sure that you must appreciate that a set of rainbow tables to handle a Win2K or XP pass of 127 characters is going to be rather substantial, particularly with all keyboard AND ASCII characters included?

Quote:

---

No one host needs to host these. I sugested using Bittorrent in my first post, which means the people that downloaded it would also host it.

---

Oh sure, on their itsy bitsy home computers? :D For these tables to be any good they HAVE to be big. And bittorrent is just a file sharing app like any other.................someone has to pay for the bandwidth.

Now I get 0.5 Gb a day on my ADSL plan. That would be like 120 days worth for 60Gb tables that you can buy for $800? With me paying for the electricity, the wear and tear on my equipment, and taking the risk of an electrical fire?...............and that would be me doing nothing myself..........

Anyway, the question has not been raised, so I shall...............this stuff is for cracking passwords, not a generally approved activity?..............and I am going to leave my system open to people who want that sort of stuff.............. :rolleyes:

No Way!

Quote:

---

And bittorrent is just a file sharing app like any other.................someone has to pay for the bandwidth.

---

Actualy it was designed specificaly to share large files. It is far from like any other file sharing app.http://www.bittorrent.com/introduction.html

Gives a fair over view of how it works

Jinxy,

Bittorrent is not designed for the size/volume that we are talking about here. Neither are most home ADSL services. Hence it is effectively no different from any other file sharing system, it is just as impractical as the rest.

Unless you wish to be limited to proof of concept type offerings as I mentioned earlier.

My cable internet gets unlimited bandwidth. :P

As an experiment I thought I would d/l one of the free rainbow tables. 10 gig let's see how long it takes.

There is only 10 seeds and 11 leachers and i'm not at full speed yet. So i'm looking at about 24 hours.

Seems doable to me.

Quote:

---

Originally posted here by nihil
I don't think that the "free" ones are much more than proof of concept exercises. AFAIK they will only work with 7 character passes.

The amount of computing power and effort required to set up full blown tables makes it highly unlikely that they will be provided free.

i2c

You will notice that the tables in your link are missing the "€" symbol. :D

---

Just an FYI, the LM hash tables availble there are for 1-7 and a standard LM hash used by windows is two seperate 7 character hashes pushed together so these tables can be used for pass up to 14 character

edit = there is rainbowtables.shmoo.com