Entropy is a measure of information content, which can be viewed as the uncertainty in a random selection.

learn more… | top users | synonyms

17
votes
3answers
9k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
16
votes
2answers
2k views

What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
14
votes
5answers
1k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
12
votes
1answer
738 views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
10
votes
4answers
288 views

Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
9
votes
1answer
3k views

What to watch for with openssl generating weak keys? (low entropy)

(Disclaimer: I am regular software engineer with only basic crypto knowledge, so helpful if can be explained for a layman.) I am concerned about generating weak keys on a shared linux box with ...
8
votes
2answers
740 views

Measuring entropy for a ciphertext only attack

When bruteforcing a password (e.g. the common attacks on DES), where you have ciphertext only, you need a way to assess whether a decrypted plaintext is the right one. I believe the EFF DES machine ...
7
votes
1answer
408 views

Are there any authoritative definitions of “key stretching”?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
6
votes
2answers
801 views

Why is ciphertext from low entropy plaintext not compressible?

This comes following a discussion with a colleague. My plaintext file plain consists of a about 100,000 lines of "all work and no play...". It's size is: 2.2 MB. ...
6
votes
2answers
242 views

When using HMAC, does key encoding matter?

Given: H is a good hash function with block size L. K is a key of length >= L (recommended by RFC 2104). Khex and Kbase64 are ASCII encodings of K. In the HMAC algorithm, is there a good reason to ...
6
votes
0answers
157 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: A: Let users set a (low-entropy) shared password and then perform some ...
5
votes
5answers
442 views

Are picture files “random enough” to be usable as a one-time pad?

Say you have a picture with 1 megapixels taken at random and with $2^{24}$ possible colours per pixel (RGB-24). That image would be unique and the possible combinations $(2^{24})^{10^6}$ immense. ...
5
votes
9answers
835 views

Algorithm: How to use x and y mouse movement co-ordinates to generate random data?

Background: I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for ...
5
votes
1answer
112 views

estimating entropy/randomness as fail-safe mechanism

Real-world encryption systems are often not broken algorithmically but because the implementation has a bug. Sometimes the bug only happens in circumstances that could not have been foreseen, such as ...
4
votes
2answers
299 views

What happens to entropy after hashing?

What happens to entropy after hashing? Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
4
votes
2answers
1k views

Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad ...
4
votes
3answers
165 views

Deterministically combine more than one source of entropy

What is the proper/canonical way to do this? For example, $0 < r1 < 1$ and $0 < r2 < 1$. Presuming uniformly distributed probabilities for the two, combining/averaging them is going to ...
4
votes
2answers
260 views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
4
votes
1answer
331 views

Exhausting the entropy of a hash function

In the case of password storage, consider the following: I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
4
votes
1answer
132 views

Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings: $$ \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto ...
3
votes
3answers
257 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
3
votes
1answer
273 views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
3
votes
2answers
270 views

Feedback on rolling my own entropy gatherer

First of all, I don't recommend doing this. This was something I created when I didn't know better and didn't have a solution available to me. Long ago I created my own entropy gather for a ...
3
votes
1answer
160 views

How to calculate entropy of a combined key

I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys ...
3
votes
4answers
716 views

Stretching a random seed to maximize entropy

I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization. I've gathered entropy from various system metrics (free memory, ...
3
votes
2answers
155 views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
3
votes
1answer
295 views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD ...
3
votes
1answer
178 views

Seed a PRNG with random data and a password

I'd like to combine a random key file with a password to generate a secure seed for a CSPRNG. The key file is assumed to have very high entropy, but the password will be whatever the user provides. ...
3
votes
1answer
477 views

What happens to the entropy of a password when you hash it?

For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?
3
votes
1answer
94 views

Entropy test for AES Key Schedule

According to the article "Lest We Remember: Cold Boot Attacks on Encryption Keys" there is a quick and dirty entropy test that can help to find possible AES Key Schedules in memory dumps. Although ...
3
votes
2answers
661 views

Using an RSA private key simultanously as an AES encryption key to generate random numbers?

Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
3
votes
1answer
209 views

Using chi square for distinguishing between compressed and random data

I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely ...
3
votes
0answers
159 views

What aspects of information theory are used in modern cryptography? [closed]

In studying modern (and classical) cryptography, many notions from information theory crop up. Unicity distance, min-entropy, compression, encoding, etc. What parts of information theory should be ...
3
votes
2answers
175 views

Is there a cryptographic function or system in which it becomes HARDER to break as time passes?

Is there a function or system which is time depending in which the effort required to brute force the decryption increases with time? It is easy to break encryption from many years ago because ...
2
votes
2answers
397 views

Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
2
votes
2answers
233 views

Is just a bit of random, “fully random”?

I understand that hashing a datetime is a pseudo-random number, and not good in a security context. But what about hashing a datetime plus a truly-random but constant string (just a string that an ...
2
votes
2answers
231 views

Seeking special-use fingerprinting/hashing algorithm

For a project I wonder if there exists some kind of fixed-size checksumming/fingerprinting function in which based on this fingerprint given data block 1, it is easy to generate more data blocks that ...
2
votes
1answer
85 views

Seed / reseed DRBG too often?

There are limits to how much you can use a the DRBG before you have to reseed it, but are there any limits to how much you must use it before reseeding? Take the following scenarios as an example… ...
2
votes
1answer
166 views

How could block encryption in counter mode be secure from viewpoint of entropy?

A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
2
votes
1answer
265 views

Calculation of time to crack SHA-256 hash

A problem is given: 1 million users are authenticated with 9-digit PIN codes (e.g. 343534643). The PIN values are stored as hash values in a database. The hash is SHA-256, and is computed as: ...
2
votes
1answer
202 views

Shannon entropy calculation: is $H(A|R·A) = H(A)$?

Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$. Now I take a non-random $m×m$ ...
2
votes
1answer
217 views

Is this a good entropy collector and whitening technique?

I'm just reviewing a program someone wrote to provide high quality random data using an entropy collector and a hash based whitening technique. I'll try summarize the process: Collect entropy from ...
2
votes
1answer
59 views

Collecting entropy from a stream to a file

I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical ...
2
votes
1answer
76 views

How is a PRNG used in the PGP?

I'm currently reading up on the components of PGP and I am wondering what exactly the PRNG is used for. PGP uses ANSI X9.17 and entropy from a users keystrokes to generate a temporary key. So, is ...
2
votes
3answers
331 views

Entropy of system data - use all and hash, or trim least significant bits?

I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool. Here's my list of sources: Mouse position Keyboard timings (i.e. time between ...
2
votes
0answers
69 views

Entropy of Androids motion-sensor data

My app on Android uses the built-in motion sensors to collect seed-data for the PRNG (java.security.SecureRandom) that is later to be used for key-generation. The user is told to shake the device so ...
2
votes
1answer
69 views

/dev/random only needed for key generation / CPU pattern encryption

Consider the following scenarios: using OpenSSL to encrypt a file with Rijndael-256 using LUKS to encrypt a hard-drive that is used every day Exactly when is entropy from ...
1
vote
3answers
231 views

Extracting only the entropy

(I cleaned up the question a bit, It was previously titled "extracting entropy without hashing" .. thus some of the comments / answers) I'd like to extract the entropy of data without injecting ...
1
vote
2answers
96 views

Standard or guidance for entropy collection

I need to write some high-level security requirements which include a random number generator suitable for use in cryptography. I don't need something very formal, this isn't a security certification ...
1
vote
2answers
187 views

Is entropy affected by time?

I'm quite new to cryptographic systems, and today we discussed entropy at work. Since entropy is used to ensure the difficulty for an attacker to break in, I was wondering if the more time the high ...