彩虹攻击，是指攻击者存储了一个大的密码->hash字典表Rainbow Tables。相比于普通的字典表，Rainbow Tables经过了空间优化和查找优化。 A rainbow table is a large list of pre-computed hashes for commonly-used passwords.
通过获得一系列密码hash值，攻击者可从其预先建立的Rainbow Tables中查找，若该hash值在Rainbow table中，则相应的密码也被破解了。
当密码过于简单（如仅由简单的英文字母组成）且只hash一次时，有很大的概率将通过彩虹攻击实现密码的破解。
2、How to avoid rainbow attack通过给password salt避免彩虹攻击，且salt值应有足够的随机性。
$hash = md5($salt.$password)
当salt足够random时，导致攻击者需要建立维护的Rainbow table 将会非常大而变得不切实际，所以通过给password加sufficently random salt，能有效抵抗彩虹攻击。
举例如下： If the password file is salted, then the rainbow table would have to contain “salt . password” pre-hashed. If the salt is sufficiently random, this is very unlikely. I’ll probably have things like “hello” and “foobar” and “qwerty” in my list of commonly-used, pre-hashed passwords (the rainbow table), but I’m not going to have things like “jX95psDZhello” or “LPgB0sdgxfoobar” or “dZVUABJtqwerty” pre-computed. That would make the rainbow table prohibitively large.
参考资料： 1、https://stackoverflow.com/questions/1012724/what-exactly-is-a-rainbow-attack 2、https://stackoverflow.com/questions/420843/how-does-password-salt-help-against-a-rainbow-table-attack
