1. A New Time-Memory-Resource Trade-Off Method for Password Recovery Communications and Intelligence Information Security (ICCIIS), 2010 International Conference Authors: Wei Zhang Coll. of Compute., Nanjing Univ. of Posts & Telecommun., Nanjing, China Mengyuan Zhang ; Yiyang Liu ; Ruchuan Wang 1

2. Password crack There are two common ways to crack the password if we know the encrypted password: Brute-force attack. Try every passwords until you find the right one. Time costs may be large. Lookup table. Create a list of passwords and their encrypted results, then search them. Crack Fast but need large storage. Time-memory tradeoff 2

3. Rainbow table method Reduce function : maps hashes to plaintexts. Hash chain 3

4. Rainbow table method 4

5. 5 Example: Hash chain Give a hash “3626” 1.Can not find 3626 in h3 2.R2(3626) = 36 3.H(36) = 4202(match) 4.Look up the table and find the p1 is 25 5.H(25) = 2059 6.R(2059) = 59 7.H(59) = 3626  The plaintext is 59!!

6. The rainbow chain with multi- resources Dividing a large rainbow table into several small rainbow sub-tables. Server-Client mode – Step1: Initialize, ensure each client has corresponding rainbow tables; – Step2: Start crack password, generate crack task; – Step3: Collect the information of the clients including specialized resources; – Step4: According to the Step3 results, generate sub-tasks and dispatch to clients; – Step5: Coordinate the clients, broadcast cracked hash message to clients to cancel the cracked job; – Step6: Collect the results form the clients, close the clients’ connection, and end the whole crack task. 6

7. The rainbow chain with multi- resources 7

8. Result CPU: Pentium4 CPU 2.93GHz, Memory: 256MB, Hard Disk: 7200, Windows XP Professional SP2 8

9. Summary Large storage space and the requirement of cracking time is rainbow table’s bottleneck in single machine. Cracking resources extend the two dimensional ( space and time ) exchanging problems of original rainbow chain. 9

10. Reference M. E. Hellman, “A Cryptanalytic Time-Memory Trade-Off’, IEEE Transactions on Information Theory, Vol. IT-26, No.4, 1980,pp.401-406. http://en.wikipedia.org/wiki/Rainbow_table http://www.rainbowcrack.com 10