As min entropy of a random variable provides the maximum probability of getting the desired realization of the random variable, which is the most conservative way of measuring the uncertainty of outcomes. Min entropy analysis is required to bound the characteristics of the attacker's perceived observation from the output of the PRNG.

  • $\begingroup$ Are you trying to measure it by observing output or by analyzing the PRNG? $\endgroup$
    – bmm6o
    Commented Mar 8, 2016 at 2:06
  • 2
    $\begingroup$ I don't see how this can work. You can't even distinguish a good PRNG from a true random source, so an entropy estimate has to grow without bound as more output is seen. $\endgroup$
    – bmm6o
    Commented Mar 8, 2016 at 5:02
  • 2
    $\begingroup$ You don't even need a calculation: It's 0. $\endgroup$ Commented Mar 8, 2016 at 8:42
  • 1
    $\begingroup$ @CodesInChaos To my annoyance and everyone's on going confusion, no one has sufficiently either equated nor differentiated between cryptographic entropy, information entropy and Kolmogorov complexity. For instance your above comment regarding H(PRNG) = 0 is diametrically opposite to bmm60's linked accepted answer, and I believe Shannon's notion of entropy... $\endgroup$
    – Paul Uszak
    Commented May 25, 2017 at 22:00
  • 1
    $\begingroup$ @PaulUszak Since this is "cryptography StackExhchange", it's safe to assume that when we talk about entropy, we are talking about cryptographic entropy. I hope that helps lifting your (quote) "on going confusion". $\endgroup$
    – e-sushi
    Commented Sep 29, 2019 at 10:42


Browse other questions tagged or ask your own question.