Rainbow attack is an implementation of the faster Cryptanalytic Time-Memory Trade-Off technique developed by Dr Philippe Oechslin. The idea is to create the password hash tables in advance (only once), and during the recovery process, simply look up the hash in these pre-computed tables.
The speed of password-cracking is raised in a rainbow attack because the hashes are pre-calculated and thus don’t have to be generated separately on the fly as they are with dictionary and brute-force cracking techniques.
Rainbow table attacks cannot be used to crack password hashes of unlimited length. The current maximum length for Microsoft LM hashes is 14 characters, and the maximum is up to 16 characters (dictionary-based) for Windows Vista and 7 hashes (also known as NT hashes). The rainbow tables are available for download via the ophcrack site. There’s a length limitation because it needs significant time to generate these rainbow tables.
“The difference between Rainbow Tables and other dictionaries is simply in the method how the entries are stored. The Rainbow table is optimized for hashes and passwords, and thus achieves great space optimization while still maintaining good look-up speed. But in essence, it’s just a dictionary.”
If you have a good collection of rainbow tables, such as those given via the ophcrack official site and Project RainbowCrack site, you can crack passwords in seconds, minutes, or hours versus the days, weeks, or even years needed by dictionary and brute-force methods.
