Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

Re^3: Creating a rainbow table for a ten-digit number: Advice?

by ww (Archbishop)
on Apr 11, 2010 at 15:48 UTC ( #834099=note: print w/replies, xml ) Need Help??


in reply to Re^2: Creating a rainbow table for a ten-digit number: Advice?
in thread Creating a rainbow table for a ten-digit number: Advice?

Either I don't understand your problem...
    or
you don't understand jethro's observation above.

If protecting the confidential, 10-digit numbers depends on your ability to "keep (a) secret" then the complexities of a rainbow table offer no advantage over a flat table of:

-------------------------------
|ID          | 10-digit number|
-------------------------------
|Abel, A     | 0123456789     |
-------------------------------
|etc,        | ad nauseum...  |
...

Either can be compromised, no matter how hard you try to "keep secret." In fact, discussions of the rainbow table often include a note that such entities are used to make recovering "secret" data easier:

  • Wikipedia: "A common application is to make attacks against hashed passwords feasible."
  • XXX (name deleted): "XXX is a Windows Password cracker based on Rainbow Tables"
  • Random discussion of web security: "Statistically, half of the key is found on average as soon as half the chain length has been reached" (caveats re complexity omitted)
  • Comment on Re^3: Creating a rainbow table for a ten-digit number: Advice?

Replies are listed 'Best First'.
Re^4: Creating a rainbow table for a ten-digit number: Advice?
by willyyam (Priest) on Apr 11, 2010 at 18:47 UTC

    What I am trying to prevent is to have a collection of "important" numbers in plaintext on a laptop, which will be moving around geographically and susceptible to theft.

    A salted hash is a good way to make sure that these numbers are not stored in plaintext - and it is easy. The issue is that I will eventually, in a secured location without network access, need to reverse this hash (hence a rainbow table).

    The laptops are already using full-disk encryption, but this provides only a single layer of defense against exposure - I am thinking about how to add another layer without doubling the number of passphrases to remember (or forget).

      What I am trying to prevent is to have a collection of "important" numbers in plaintext on a laptop

      Noone suggested that. We said specifically said to put that information in the secret database, the one "that's under lock and key (of course)".

      You're ok with haveing a secret table that maps public ids to real ids. You were thinking of implementing that table as a rainbow table. All we're suggesting is that you implement that table in a much more straightforward manner:

      work db secret db (laptop) (under lock and key) +-----------+--- +-----------+---------+ | public id | ... | public id | real id | +-----------+--- +-----------+---------+

      The public id would simply be a unique random number. (Safer than a hash, and avoids the problem of collisions.)

      Now, this assumes the database is created before being placed on the laptop, but that's consistent with everything you've told us so far. You can still use the above method if you collect the numbers in the field, but only if the field has access to the a remote service that provides the following function:

      $public_id = get_new_public_for($real_id);

        This is a good solution, save that I am not in constant contact with the people collecting the data, nor their laptops. So, to do this I would require some means of pre-arranging the relationship between "public" and "real" ids.

      Do all the laptops have all the important numbers?

      Or just each have one (or a few), and any reversal done (and the DB stored), in your secure location?


      Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
      "Science is about questioning the status quo. Questioning authority".
      In the absence of evidence, opinion is indistinguishable from prejudice.

        No, I will only be collecting a few hundred or thousand numbers, roughly split between two laptops. Reversal will be in a secure location.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://834099]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others contemplating the Monastery: (8)
As of 2020-01-23 10:19 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Notices?