We have always measured password or private key strength by the amount of entropy it contains, but what if the attacker who cracks it is lucky.
Consider the following simple scenario, we have 1 bit [0,1] secret , the attacker should choose between 2 combinations, but the attacker already has a 50% chance of guessing the right one.
Now consider a 128 bit secret. It should have 2^128 combinations, so the attacker should go through
340282366920938000000000000000000000000 combinations before guessing the secret, but he actually only has to go through half of that:
170141183460469000000000000000000000000, because he probably has a 50% chance of guessing it right.
So if at each bit he has a 50% chance, that means that 1 bit is actually only half bit.
And if he is very lucky, say 90% chance, that means that 1 bit is actually only 0.1 bit.So in face of a very lucky opponent, a 128 bit password has only 12.8 bit strength.
What is your opinion about this?