Entropy is a measure of information content, which can be viewed as the uncertainty in a random selection.

learn more… | top users | synonyms

24
votes
3answers
11k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
18
votes
2answers
3k views

What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
15
votes
5answers
2k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
14
votes
1answer
895 views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
11
votes
1answer
3k views

What to watch for with openssl generating weak keys? (low entropy)

(Disclaimer: I am regular software engineer with only basic crypto knowledge, so helpful if can be explained for a layman.) I am concerned about generating weak keys on a shared linux box with ...
10
votes
5answers
335 views

Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
9
votes
3answers
701 views

Entropy of two concatenated random values

In this Intel blog posting, the author claims: The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the ...
9
votes
2answers
801 views

Measuring entropy for a ciphertext only attack

When bruteforcing a password (e.g. the common attacks on DES), where you have ciphertext only, you need a way to assess whether a decrypted plaintext is the right one. I believe the EFF DES machine ...
8
votes
1answer
199 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
7
votes
1answer
247 views

Is there a cryptographic function or system in which it becomes HARDER to break as time passes?

Is there a function or system which is time depending in which the effort required to brute force the decryption increases with time? It is easy to break encryption from many years ago because ...
7
votes
1answer
436 views

Are there any authoritative definitions of “key stretching”?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
6
votes
9answers
1k views

Algorithm: How to use x and y mouse movement co-ordinates to generate random data?

Background: I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for ...
6
votes
3answers
119 views

Why do “nothing up my sleeve numbers” have low entropy?

As a preface, forgive me for some of the links being from Wikipedia. I realize that academia frowns upon this. I came across this article about "nothing up my sleeve numbers". In it, it says: ...
6
votes
2answers
935 views

Why is ciphertext from low entropy plaintext not compressible?

This comes following a discussion with a colleague. My plaintext file plain consists of a about 100,000 lines of "all work and no play...". It's size is: 2.2 MB. ...
6
votes
2answers
280 views

When using HMAC, does key encoding matter?

Given: H is a good hash function with block size L. K is a key of length >= L (recommended by RFC 2104). Khex and Kbase64 are ASCII encodings of K. In the HMAC algorithm, is there a good reason to ...
5
votes
5answers
497 views

Are picture files “random enough” to be usable as a one-time pad?

Say you have a picture with 1 megapixels taken at random and with $2^{24}$ possible colours per pixel (RGB-24). That image would be unique and the possible combinations $(2^{24})^{10^6}$ immense. ...
5
votes
2answers
462 views

What happens to entropy after hashing?

What happens to entropy after hashing? Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
5
votes
2answers
249 views

Generating Encryption Keys from Biometric Fingerprint Templates

How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the ...
5
votes
3answers
213 views

Deterministically combine more than one source of entropy

What is the proper/canonical way to do this? For example, $0 < r1 < 1$ and $0 < r2 < 1$. Presuming uniformly distributed probabilities for the two, combining/averaging them is going to ...
5
votes
1answer
117 views

estimating entropy/randomness as fail-safe mechanism

Real-world encryption systems are often not broken algorithmically but because the implementation has a bug. Sometimes the bug only happens in circumstances that could not have been foreseen, such as ...
4
votes
1answer
379 views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
4
votes
2answers
285 views

Feedback on rolling my own entropy gatherer

First of all, I don't recommend doing this. This was something I created when I didn't know better and didn't have a solution available to me. Long ago I created my own entropy gather for a ...
4
votes
1answer
146 views

Mixing Entropy Sources by XOR?

Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ...
4
votes
2answers
1k views

Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad ...
4
votes
2answers
305 views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
4
votes
1answer
382 views

Exhausting the entropy of a hash function

In the case of password storage, consider the following: I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
4
votes
4answers
789 views

Stretching a random seed to maximize entropy

I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization. I've gathered entropy from various system metrics (free memory, ...
4
votes
1answer
155 views

Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings: $$ \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto ...
4
votes
1answer
217 views

Using chi square for distinguishing between compressed and random data

I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely ...
3
votes
4answers
335 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
3
votes
2answers
99 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
3
votes
2answers
245 views

Is just a bit of random, “fully random”?

I understand that hashing a datetime is a pseudo-random number, and not good in a security context. But what about hashing a datetime plus a truly-random but constant string (just a string that an ...
3
votes
1answer
195 views

How to calculate entropy of a combined key

I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys ...
3
votes
2answers
258 views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
3
votes
1answer
65 views

Entropy Loss of KDFs

Am I losing any entropy when using KDFs, such as the ones in NIST Special Publication 800-108? For example, can I derive 128-bit session keys from a (uniformly random) 128-bit master key?
3
votes
1answer
561 views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD ...
3
votes
1answer
195 views

Seed a PRNG with random data and a password

I'd like to combine a random key file with a password to generate a secure seed for a CSPRNG. The key file is assumed to have very high entropy, but the password will be whatever the user provides. ...
3
votes
1answer
589 views

What happens to the entropy of a password when you hash it?

For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?
3
votes
1answer
157 views

Entropy test for AES Key Schedule

According to the article "Lest We Remember: Cold Boot Attacks on Encryption Keys" there is a quick and dirty entropy test that can help to find possible AES Key Schedules in memory dumps. Although ...
3
votes
1answer
66 views

Collecting entropy from a stream to a file

I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical ...
3
votes
2answers
677 views

Using an RSA private key simultanously as an AES encryption key to generate random numbers?

Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
3
votes
2answers
90 views

Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?

I'm unsure of how exactly the salt is manipulated by scrypt and its potential contribution if any to overall password entropy if passwords & salts are stored only in human memory for a ...
3
votes
0answers
89 views

Will hashing over and over eventually give the same hash?

There are many cases in maths where doing the same thing over and over again will bring you closer to a value. Derivation of polynomials is the striking example: no matter what you start with, you end ...
3
votes
0answers
134 views

Entropy of Androids motion-sensor data

My app on Android uses the built-in motion sensors to collect seed-data for the PRNG (java.security.SecureRandom) that is later to be used for key-generation. The user is told to shake the device so ...
3
votes
0answers
164 views

What aspects of information theory are used in modern cryptography? [closed]

In studying modern (and classical) cryptography, many notions from information theory crop up. Unicity distance, min-entropy, compression, encoding, etc. What parts of information theory should be ...
2
votes
1answer
257 views

Is AES key length a size of the key or entropy?

While educating my self I'm having hard time to understand what an 128 bit AES key actually means? Is it a key length or entropy? Please explain to me trough following example (assuming AES): ...
2
votes
2answers
181 views

Seed / reseed DRBG too often?

There are limits to how much you can use a the DRBG before you have to reseed it, but are there any limits to how much you must use it before reseeding? Take the following scenarios as an example… ...
2
votes
2answers
564 views

Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
2
votes
1answer
102 views

Is it possible to get better randomness by using multiple PRNGs?

I don't know if this question even makes sense, but: Is there be any benefit or impact to some sort of hierarchical (e.g. a PRNG drives the decision for which PRN to pull from a set of PRNGs) or ...
2
votes
2answers
236 views

Seeking special-use fingerprinting/hashing algorithm

For a project I wonder if there exists some kind of fixed-size checksumming/fingerprinting function in which based on this fingerprint given data block 1, it is easy to generate more data blocks that ...