The rainbow tables are fast and effective at cracking passwords because each password is hashed the
same way. Hashes are in fact one way functions.
For example if a hacker has a rainbow table with the hash of the password spatial player any user
that has the same password will have the same hash and his password will be cracked as well.
Since most people use common passwords or reused passwords it makes cracking an easy process. To solve
this issue
a salt is used.
You can see here at the crackstation.net that it can crack only non salted hashes. Let's see what
the salt. Instead of computing and saving the hash of the password
the operating system will compute and save the hash of the password together with a salt.
The salt is a randomly generated string for each password. The salt is not secret just the password is.
Let's take a look at the file that contains the hashes of the user's passwords in Linux. That's
the shadow file from etc directory.
This is an entry for a user and a password.
This is the user, the number 6 is a code for the hash
algorithm used, 6 means sha512, and then comes the salt.
This is the salt, until the dollar sign. And then comes the hash of the password and the salt, until the
colon sign,
until this point. The salt is randomly generated for each password but it is not secret like the
password is.
It is combined with the password and added to the hashing process to force the uniqueness of the output
hash.
In other words the same password will give different hashes because of this random salt.
This mitigate passwords attacks like rainbow tables. If a hacker has found the clear text password from
the hash all other passwords that part of the same are still secure because their hash is different.
I've shown you a real example of two users that have the same password, but different hashes, in a previous
lecture where I've also explained in detail how Linux system stores
the passwords. In fact these are the users, user 1 and user to have the same password but
different hashes saved in the shadow file.
The hash is unique because the salt is unique.
I'd recommend you to watch that video again if you feel the need. Thank you.
That's all!