bachelor

3.2 Attacking the MAC 29
point, then the f function is run over and over again on h′ so as to build a chain
“on top of” h′. If at any point the function outputs a distinguished point, it
is checked in the same manner as before. However, if there is no match once a
distinguished point has been found, h can be guaranteed not to be in the table.
This is because the deterministic properties of the f; if some distinguished point
is reached after h, one can be sure that for past reconstructions of the chain
that, indeed, the chain would end in the same distinguished point.
rejsekort H f74eed6e R ewaisnshw H 491b2cb4 R bveiytoo
(continued)
H 3b7b7c75 R ewaisnshw H 491b2cb4 R bveiytoo
Figure 3.4: A cycle in a Hellman chain. The two hash values that produce the
same reduction are highlighted in red.
Finally, Hellman tables have the undesired property of causing false alarms.
This phenomenon is a corollary of Helman tables’ inherent misfeature of merging.
It can be explained by a chain in the table merging with the temporary
chain that is being constructed when a hash value is tried. The two chains will
have the same end value, but the stored chain will not contain the sought hash.
Therefore one cannot be sure that a preimage can be recovered before the chain
is rebuilt, unless the R(h) is a distinguished point. Applying any number of f
operations to R(h) might lead to merges with some chain in the Hellman table
before the preimage, leading to a false alarm.
3.2.1.2 Rainbow tables
In 2003 Philippe Oechslin presented a new approach for these time-memory
trade-offs that did away with some of the problems of the older algorithm [9]; he
narrowed down the undesired probabilities to the reduction function—Hellman
tables uses the same function for all reductions, and this causes collisions, resulting
in chains merging and cycling. Oechslin proposed a new kind of tables,
namely rainbow tables.
Rainbow tables work like the older TMTO in the sense that they facilitate
reverse lookups in hashes and other one-way functions, but they use different
reduction functions for every column in the table, resulting in merges only if
two plaintexts are the same and appear at the exact same element index of two
chains. For long chains the proability of this happening is minuscle.
To look up values in a rainbow table the attacker would take the reduce the