彩虹桌：如何防御它们？
我最近获得了 Windows 版 l0pht-CD 并在我的 PC 上试用了它，它可以工作！！
2600hertz.wordpress。 com/2009/12/22/100-windows-xp-vista-7-密码-恢复
我正在设计一个存储 pwd 的“登录模拟器” -s 以类似的方式。当前的实现很容易受到上述攻击。请任何人都可以说明（用尽可能简单的术语）如何加强针对这种彩虹表攻击。
我的目标：构建尽可能安全的“登录模拟器”。（阅读黑客竞赛；-））
谢谢。
I recently obtained the l0pht-CD for windows and tried it out on my PC and It WORKS!!
2600hertz.wordpress.com/2009/12/22/100-windows-xp-vista-7-password-recovery
- I have also read
kestas.kuliukas.com/RainbowTables/
I'm designing a "Login-Simulator" that stores pwd-s in a similar manner. The current implementation will be vulnerable to the above attack. Plz could anyone illustrate (in as simple terms as possible), how to strengthen against such a rainbow tables attack.
MY GOAL : Build "Login-Simulator" to be as secure as possible. (Read Hacking Competition ;-) )
Thank You.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
由于彩虹表是一系列针对各种密码预先计算的哈希链，因此可以通过 添加密码的盐。由于哈希函数通常会消除输入和输出之间的大部分局部对应关系（即，输入中的微小变化会产生输出中看似不相关的大变化），因此即使是少量的盐也会非常有效。
最重要的是，盐不需要保密就能发挥作用。需要为所有可能的密码-盐组合重新计算彩虹表。
Since a rainbow table is a series of precomputed hash chains for various passwords, it is easily foiled by adding a salt to the passwords. Because hash functions usually remove much of the local correspondence between input and output (that is, a small change in input produces large, seemingly unrelated changes in output), even a small salt will be immensely effective.
Best of all, the salt does not need to be secret for this to be effective; the rainbow table needs to be recomputed for all possible password-salt combinations.
您应该使用 bcrypt，它是由专业密码学家设计的做你正在寻找的事情。
一般来说，您永远不应该发明自己的加密/散列方案。
密码学非常复杂，您应该坚持使用已被证明有效的方法。
但是，您问题的基本答案是添加随机的每用户盐，并切换到较慢的哈希值。
You should use bcrypt, which has been designed by professional cryptographers to do exactly what you're looking for.
In general, you should never invent your own encryption / hashing schemes.
Cryptography is extremely complicated, and you should stick to what has been proven to work.
However, the basic answer to your question is to add a random per-user salt, and switch to a slower hash.