3 ms·

Stop rainbow attacks peeps, salt your hashes. http://crypto.stackexchange.com/questions/1776/can-you-help-me-understand-what-a-cryptographic-salt-is http://cry

• KerrickStaley 12y ago
  The author's approach doesn't actually make use of a rainbow table; he just generates a flat hash -> plaintext map. A rainbow table is a specific way of representing such a map that is more compact but takes more computation time to "access" (and also may be incomplete).
  • lumpypua 12y ago
    Right, same attack with a less sophisticated data structure.
• bazzargh 12y ago
  That applies for passwords (where you hope the data is fairly random, and unknown) but there are only 13,237 taxis in new york, and you can download the list! You'd simply try each one. The author only took hours to crack the list because he generated hashes for all possible medallion numbers, without using the list. Also, even these numbers only apply to queries where you want to discover all of the drivers for all of the data. It seems more likely to me that someone would want to know who was driving a particular taxi at a particular time, or what a particular driver was doing on a range of days. In both of these cases, the number of records you need to deal with is massively reduced, and the second attack implies you know the plaintext. So no, salting doesn't help against abuses of this data when hashing is so fast, and even using a slow KDF won't help much against the second attack.
  • delroth 12y ago
    You're assuming that the salt would be public. In practice there is no reason for it to ever be. As long as it stays private, it would be impossible to reverse HASH(salt || taxi_id) back to the taxi id.