Quote:
Originally Posted by ratinox
Once they identify how the salts are generated they can use this to generate custom tables, which is orders of magnitude faster than brute force and doesn't require infinite storage.
|
It's still the same effort to build the custom table as it is to brute-force a single password - you still have to compute the hashes of all the possible passwords if you want the table to be complete.
Even for a short-ish (10 characters or so) password that takes a lot of compute, particularly if a deliberately compute-intensive hash algorithm (nested hashes, bcrypt etc.) is used.
The point of rainbow tables is that you only have to do that once to attack many passwords with the same hash - you still need to generate a separate table for each salt.