Dictionary attack - wikipedia Dictionary attack This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. ( February 2018 ) In cryptanalysis and computer security, a dictionary attack is a form of brute force attack technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. Contents 1 Technique 2 Pre-computed dictionary attack / Rainbow table attack 3 Dictionary attack software 4 See also 5 References 6 External links Technique A dictionary attack is based on trying all the strings in a pre-arranged listing, typically derived from a list of words such as in a dictionary ( hence the phrase dictionary attack ). In contrast to a brute force attack, where a large proportion of the key space is searched systematically, a dictionary attack tries only those possibilities which are deemed most likely to succeed. Dictionary attacks often succeed because many people have a tendency to choose short passwords that are ordinary words or common passwords, or simple variants obtained, for example, by appending a digit or punctuation character. Dictionary attacks are relatively easy to defeat, e.g. by using a passphrase or otherwise choosing a password that is not a simple variant of a word found in any dictionary or listing of commonly used passwords. Pre-computed dictionary attack / rainbow table attack It is possible to achieve a time -- space tradeoff by pre-computing a list of hashes of dictionary words, and storing these in a database using the hash as the key. This requires a considerable amount of preparation time, but allows the actual attack to be executed faster. The storage requirements for the pre-computed tables were once a major cost, but are less of an issue today because of the low cost of disk storage. Pre-computed dictionary attacks are particularly effective when a large number of passwords are to be cracked. The pre-computed dictionary need be generated only once, and when it is completed, password hashes can be looked up almost instantly at any time to find the corresponding password. A more refined approach involves the use of rainbow tables, which reduce storage requirements at the cost of slightly longer lookup - times. See LM hash for an example of an authentication system compromised by such an attack. Pre-computed dictionary attacks, or `` rainbow table attacks '', can be thwarted by the use of salt, a technique that forces the hash dictionary to be recomputed for each password sought, making precomputation infeasible, provided the number of possible salt values is large enough. Dictionary attack software Cain and Abel Crack Aircrack - ng John the Ripper L0phtCrack Metasploit Project Ophcrack See also E-mail address harvesting Key derivation function Key stretching Password cracking Password strength References Jump up ^ Jeff Atwood. `` Dictionary Attacks 101 ''. External links RFC 2828 -- Internet Security Glossary RFC 4949 -- Internet Security Glossary, Version 2 RSA BSAFE Crypto - C Glossary US Secret Service use a distributed dictionary attack on suspect 's password protecting encryption keys Testing for Brute Force ( OWASP - AT - 004 ) Retrieved from `` https://en.wikipedia.org/w/index.php?title=Dictionary_attack&oldid=864208465 '' Categories : Cryptographic attacks Hidden categories : Articles needing additional references from February 2018 All articles needing additional references Pages using RFC magic links Talk Contents About Wikipedia Català Čeština Dansk Deutsch Español فارسی Français 한국어 Italiano Монгол Nederlands 日本 語 Norsk Polski Русский Simple English Svenska Українська Tiếng Việt 11 more Edit links This page was last edited on 15 October 2018, at 20 : 00 ( UTC ). Text is available under the Creative Commons Attribution - ShareAlike License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia ® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization. About Wikipedia

Question: how to prevent dictionary attack on password hashes
Answer: by using a passphrase or otherwise choosing a password that is not a simple variant of a word found in any dictionary or listing of commonly used passwords