encryption - RAR passwords, why don't rainbow tables work? -

encryption - RAR passwords, why don't rainbow tables work? -

i've been looking around encryption , i've seen several implementations of rainbow tables work charm on passwords (say windows).

i'm yet see implementation of rainbow attack on rar file. why so. makes rar encryption more secure , immune these sorts of attacks?

a rainbow table optimization inverting hash functions: finding password when have hash. although not strictly necessary here, recommend reading what rainbow tables , how used? has explanation clears few mutual misconceptions.

there 2 parts rar encryption (or uses password encrypt data). first, encryption key derived password, using key derivation function (kdf). encryption key used encrypt or decrypt data.

even if kdf hash function, rainbow table wouldn't help: attacker not have output of kdf. when password used authentication, output of kdf what's stored in database. when password used encryption, output of kdf secret key attacker after.

in case, rainbow tables help against unsalted hashes. winrar uses kdf (pbkdf2) includes salt.

a kdf transforms variable-length string fixed-size key. key property of kdf must distinct map input strings distinct keys. cryptographic hash function (sha-1, sha-256, …) achieves this. when input string human-provided password, there 2 other of import properties hash function not accomplish on own:

if 2 people take same password, must not end having same key. the kdf must slow compute, attacker cannot find password brute force.

a salt achieves first property. sec property achieved doing this: take password, append salt, hash lot; take hash, append salt, hash lot; repeat many times.

a rainbow table optimization compute preimages through “one-way” functions: functions easy compute in 1 direction nigh-impossible inverse, i.e. given x easy compute y=f(x) given y there no known method find x such y=f(x) other somehow guessing x , checking. hash functions this. encryption symmetric key not this: attacker cannot compute f more can compute inverse. hence rainbow tables cannot help breaking symmetric encryption.

encryption passwords rainbowtable