1
$\begingroup$

I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various password lengths. This is the last column of Table A.1.

I'm pretty sure they are just using the formula (given previously in the Appendix):

$$ H=\log_2(94^\ell)=\ell\log_2(94)\approx \ell\times6.55458885168\;, $$ where $\ell$ is the password length. But when I apply this formula I get slightly different values then are found in the NIST publication for basically every entry in the table. For example, for $\ell=10$, I find $H=65.546$ whereas they have $H=65.9$. Am I just missing something stupid here? Or are they?

Below I have also included some python I used to create a table of entropy for password lengths from 0 to 40 (from 94 character alphabet) in order to compare with the NIST publication. Where am I (or they) going wrong here?

>>> a=math.log(94,2)
>>> a
6.554588851677638
>>> for i in xrange(41):
...     print i, i*a
... 
0 0.0
1 6.55458885168
2 13.1091777034
3 19.663766555
4 26.2183554067
5 32.7729442584
6 39.3275331101
7 45.8821219617
8 52.4367108134
9 58.9912996651
10 65.5458885168
11 72.1004773685
12 78.6550662201
13 85.2096550718
14 91.7642439235
15 98.3188327752
16 104.873421627
17 111.428010479
18 117.98259933
19 124.537188182
20 131.091777034
21 137.646365885
22 144.200954737
23 150.755543589
24 157.31013244
25 163.864721292
26 170.419310144
27 176.973898995
28 183.528487847
29 190.083076699
30 196.63766555
31 203.192254402
32 209.746843254
33 216.301432105
34 222.856020957
35 229.410609809
36 235.96519866
37 242.519787512
38 249.074376364
39 255.628965215
40 262.183554067
| improve this question | |
$\endgroup$
  • $\begingroup$ Those figures assume that humans pick password randomly. Whether or not the calculus is fine matters less than the fact that this assumption is overly optimistic and should be nixed from any serious document ! $\endgroup$ – Alexandre Yamajako Apr 14 '15 at 11:57
  • $\begingroup$ Yup. I understand that assuming completely randomly distributed passwords is very much overly optimistic. But, I don't think that issue is taken into account at all in the last column of Table A.1... with respect to the actual values in Table A.1, do you know why they don't match up with the specified formula? $\endgroup$ – hft Apr 14 '15 at 13:42
1
$\begingroup$

When NIST put together the table A.1, they accidentally used a 96 character alphabet for that last column, not a 94 character one. One way to see this is looking at the bottom most entry; they list that $log_2(b^{40}) \approx 263.4$, where $b$ is the alphabet size they used. If we solve for $b$, we get $b \approx 96.002...$.

| improve this answer | |
$\endgroup$
  • $\begingroup$ That seems like a reasonable explaination since the l=1 and l=40 results match up. But for l=30 I find 30*log(96,2)=197.5, whereas they wrote 197.2... So... is this document just super sloppy or what? Also all the numbers in the second to last column of the table (for ten character alphabet) also are "slightly off"... $\endgroup$ – hft Apr 14 '15 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.