Entropy is a measure of information content, which can be viewed as the uncertainty in a random selection.

learn more… | top users | synonyms

5
votes
1answer
411 views

Is my password entropy calculation correct?

I have a password with a prescribed format: 111 + “2 Random lowercase letters” + “random digit” As you can see, it starts with a fixed value of ...
14
votes
2answers
690 views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
55
votes
3answers
25k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
6
votes
2answers
322 views

How can a poor RNG impact security?

I have read this article and I do somehow "understand" that the reduction of entropy makes it easier to guess. But how exactly can the security be reduced by that? Can you give a concrete scenario, ...
7
votes
2answers
404 views

The effect of truncated hash on entropy

Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
4
votes
0answers
76 views

Secure entropy extractor for thermal noise collected from camera input?

I have read this paper (pdf) which talks about measuring the entropy of thermal noise collected from camera input. They estimate the minimum entropy at about 4 bits per pixel. Probably estimating 1 ...
0
votes
1answer
70 views

What is the meaning of the overlapping region on OTP-perfect secrecy diagram?

I'm new to cryptography. I want to ask about OTP-perfect secrecy diagram like figure below: On the overlapping region (middle), notated by R(X;Y;Z). R can be calculated by I(X;Y) - I(X;Y|Z). ...
3
votes
1answer
51 views

Updating the seed key of a PRNG while maintaining initial entropy?

Consider a seed key ($n$-bit long) is completely random and entropy of random variable is $n$ and PRNG is using deterministic algorithm and that that deterministic algorithm does not add any entropy ...
9
votes
0answers
111 views

Turing's (still?) classified inference engine algorithm?

Does anyone know the algorithm used by Turing's Colossus inference engine, so highly classified that the Brits kept it secret for decades after WW II? Indeed, it may still be classified. Several ...
2
votes
2answers
72 views

How to prove a symmetric encryption scheme provides perfect secrecy?

I learned in class that in order to achieve perfect secrecy, the source of the plaintext $\mathcal{P}$ needs to be independent from the source of the encryption key $\mathcal{K}$. We also learned that ...
0
votes
0answers
39 views

autocorrelation and entropy of historical ciphers

I'm learning cryptography and come across historical ciphers such as vigenere cipher,hill cipher,random substitution and etc.I'm using cryptool for learning purposes and I have a question in mind.I've ...
0
votes
1answer
77 views

Why does AES ciphertext entropy always close to 8?

I have three binary files: 31744 byte length (1), 5712980 byte length (2) and 10806008 byte length (3). The alphabet is all 256 symbols from 00 to ff. I compute the shannon entropy, replacing ...
0
votes
0answers
18 views

Can we bound adversarial power in terms of total entropy in universe? [duplicate]

The strengths of various cryptographic primitives are often explained (though not defined) in terms of how long it would take to break under the current best known attacks. For example, apparently the ...
1
vote
0answers
71 views

How to calculate min entropy of the output of PRNG?

As min entropy of a random variable provides the maximum probability of getting the desired realization of the random variable, which is the most conservative way of measuring the uncertainty of ...
5
votes
1answer
103 views

Is the concept of provably secure hash the same as entropy smoothing hash functions?

Is the concept of provably secure hash the same as entropy smoothing hash functions? In the tutorial Sequences of Games: A Tool for Taming Complexity in Security Proofs V. Shoup shows us a proof of ...
9
votes
3answers
1k views

How is the One Time Pad (OTP) perfectly secure?

The Wikipedia entry on One Time Pads (OTPs) states that if this cipher is used properly; ie, the keys are truly random and each "part" of the key is independent of every other "part", it's uncrackable,...
1
vote
2answers
85 views

How to calculate entropy of output of a PRNG

Suppose the entropy of seed key is $H(n)$ which is $n$-bit long and random and the output bit length of the PRNG is $2^n$, which will be used as a long running key. Though it is obvious in that case, ...
2
votes
1answer
401 views

Entropy calculation

I calculated the entropy for "variable", "property" and their concatenation "variableproperty" (with e.g. the Shannon Entropy) and got $2.75, 2.5$ and $3.33$ respectively. These are all entropy per ...
2
votes
1answer
165 views

Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
1
vote
2answers
43 views

Is part of an output of secure PRNG also cryptographically secure?

Lets say I generate 192 bits using some secure PRNG. If I now take first 128 bits is it equivalent of generating 128 bits in the first place? P.S. More practical application for me is that I need a ...
6
votes
4answers
786 views

Are there any practical ways to transfer random data securely?

The owner of the random.org service recommends that you do not use randomly generated numbers from their website in cryptographic keys. This makes sense, but it got me wondering. Is it possible to ...
-3
votes
1answer
52 views

1 bit shannon entropy CPU instructions?

It has been proved, that the xor operator is suitable for entropy accumulation, due to its theoretical shannon entropy of 1 bit. There are six truth tables with ...
8
votes
1answer
140 views

Is CPU timing jitter a usable entropy source?

In some virtualized environments, the only source of entropy available is CPU timing jitter. Can one get enough entropy from this source for practical uses? Also, is this secure against local side-...
6
votes
2answers
176 views

How much entropy is generated by 'random' human keystrokes?

I'm wondering about using human input as an entropy generator. We all know humans are terrible at making up random numbers or keys or passwords. But what if we let a user 'randomly' type in some ...
4
votes
0answers
50 views

Reusing same source for single-source randomness extractor

Let $ext$ be a single-source randomness extractor which takes a $d$-bit seed and a $n$-bit source as input and produces a $m$-bit output. Suppose we have a source $X$ with min-entropy $k$. Is it ...
3
votes
2answers
134 views

Will entropy be lost by using a DRBG?

Lets assume we have a DRGB (deterministic random bit generator) which is seeded by a good true RBG (random bit generator). Before any bit has been read from the DRBG, the entropy is clearly the number ...
4
votes
5answers
211 views

How does generating random numbers “remove entropy from your system”?

In a previous question, I quoted the --gen-random entry in the GPG Man Pages. At the end it says: PLEASE, don’t use this command unless you know what you are ...
9
votes
3answers
474 views

Why do “nothing up my sleeve numbers” have low entropy?

As a preface, forgive me for some of the links being from Wikipedia. I realize that academia frowns upon this. I came across this article about "nothing up my sleeve numbers". In it, it says: ...
2
votes
1answer
85 views

Collision likelihood from /dev/urandom for VMs using the same underlying hardware

We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if ...
2
votes
2answers
176 views

Does it necessarily mean that an RSA moduli generated with poor randomness is not random?

In 2012 a group of researchers collected a large amount of RSA moduli and calculated their greatest common divisor in order to find common factors between them. By finding a common factor they could ...
0
votes
2answers
88 views

The benefit of PBKDF2 for big keyfile?

The man page of cryptsetup says: Whenever a passphrase is added to a LUKS header (luksAddKey, luksFormat), the user may specify how much the time the passphrase processing should consume. The ...
2
votes
0answers
26 views

Raw /dev/random output for keymat [duplicate]

Noob question: It is my understanding that the raw output from non-blocking /dev/random (where the kernel's entropy_avail estimate is equal to or greater than the number of random bits required) ...
3
votes
2answers
989 views

Generating unbiased numbers with a biased six sided die?

Eve takes a fair six-sided die and adds some heavy paint to the side of the die with the 6 on it. This results in a biased die that rolls a 6 with probability 2/7, and each other number (1-5) with ...
9
votes
2answers
378 views

How secure is a pronounceable password in terms of entropy?

There are some strong studies which support the use of pronounceable passwords and multiple tools which provide generation of such passwords. According to this question the entropy of a password ...
2
votes
1answer
64 views

Has there been any research on entropy efficient information-theoretically secure PRNGs?

I have an idea for an research project, but I am first wondering if it has been researched or implemented before. I think I have a way to come up with a set of PRNG algorithms which have the ...
3
votes
1answer
130 views

Is it possible to reverse the birthday attack calculation?

I find that for every 100 password salts in our database, we only average 94.73 distinct salt values (averaged over a total of around 18 million). Is there a way to take that observation and calculate ...
4
votes
2answers
856 views

Is it secure to concatenate two 16-bit random numbers into a 32-bit one?

I'm working on a security application for RF modules aimed to protect a communication between an autarkic sensor and a line-powered receiver against MITM (man-in-the-middle attacks). I decided to use ...
2
votes
2answers
288 views

Seeking special-use fingerprinting/hashing algorithm

For a project I wonder if there exists some kind of fixed-size checksumming/fingerprinting function in which based on this fingerprint given data block 1, it is easy to generate more data blocks that ...
2
votes
0answers
66 views

Detecting steganography by analysing non-significant data entropy?

I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text. I suspect, the steganography changes (elevates) ...
3
votes
2answers
533 views

Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
6
votes
3answers
2k views

Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
3
votes
2answers
202 views

Physical entropy source: How many bits entropy per byte is sufficent?

8 bit / byte would be perfect obviously. head -c 1M /dev/urandom | ent gives ~ 7.9998 bits per byte. Now, if I have a physical entropy source, how much entropy ...
3
votes
1answer
100 views

Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...
2
votes
1answer
397 views

How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and "...
2
votes
1answer
172 views

Is there a secure source of entropy on a typical microcontroller?

On a device that does not have a hardware RNG, what is the best source for entropy? Some options and pitfalls floating around: Use the ADC to read something analog: can become deterministic if ...
2
votes
2answers
180 views

Is it okay to include relative time for true random number generation?

Similar questions have been asked regarding use of time in true random number generation, but I'd like to consider using time as just one source of entropy, complementing others. True random number ...
4
votes
4answers
563 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
8
votes
2answers
548 views

How feasible would it be to generate 300 million public key pairs in 8 hours?

Assume there is a hypothetical situation where one would need to generate hundreds of millions of public key pairs of reasonable strength in a limited time. What would be required in terms of ...
10
votes
2answers
1k views

What is the difference between Shannon entropy and saying that tossing a 6-sided die 100 times has more than 256-bit entropy?

I'm confused. I thought that tossing a 6-sided die 100 times had a greater than 256-bit entropy because $6^{99} < 2^{256} < 6^{100}$. (A similar concept appeared in this XKCD comic, where ...
2
votes
0answers
45 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...