1
$\begingroup$

There is a lot of confusion between "entropy" and "security" of a cryptographic function.

I like to visualize it as the entropy being the water, and the crypto function being a glass.

So for instance, the maximum security a hash function offers, is only as much as much entropy we add into it.

For example: If we have an n bits of entropy input and a SHA-512 hash function. The SHA-512 is like a glass that is 512 size but we pour into it n bits of water, it will only have n bits of security.

  • If n>512 then the glass is full, and the excess water drips out, meaning that every bit of entropy above that is useless, since the attacker will just brute force the glass itself
  • If n=512, then the same is true
  • If n<512, then it's easier for the attacker to go through the 2^n permunations insteand of trying 2^512 permutations

And this is easy to understand with a small example, think of a dice roll

  • It has 2.5849625007 bits of entropy
  • The entropy is a uniform random number between 1-6

If we hash the random number we won't get 512 bits of security, because if we have 2 attackers:

  • one will try to brute force the 512 bit hash of the random number
  • while the other attacker will just go through the 2^512 combinations of the input, which he will find after 2^2.58 ones

So it's obvious that we only have 2.5849625007 bits of security, even though we poured our water into a 512 bit glass.

So the size of the hash function is only a maximum security, provided if the input has minimum that amount of entropy. Otherwise the output has only as much security as the input.

Is this a correct way of interpreting cryptographic security?

|improve this question
$\endgroup$
  • 2
    $\begingroup$ With a glass full of dice and a sprinkling of hash functions, it's a little difficult to ascertain the exact question. Are you asking about the standard definition of hash function security, or something like password security /entropic content? $\endgroup$ – Paul Uszak Feb 21 '17 at 4:48
  • $\begingroup$ @PaulUszak I'm trying to interpret the relationship between the final security of a crypto function, and the input entropy. My thoughtprocess is written above. $\endgroup$ – cryptonoob400 Feb 21 '17 at 6:34
  • 1
    $\begingroup$ I guess it is an OK analogy of explain in general that the security of an output is bound to input and the security of a function itself. I'm not sure that you need an analogy for that though, and the above is just my personal opinion. $\endgroup$ – Maarten Bodewes♦ Feb 21 '17 at 10:51
  • 1
    $\begingroup$ Two measures of water that you pour won't simultaneously share the same space in the glass, thus the analogy does not account for the possibility that the hashes for two different inputs are the same. Granted, this won't happen for SHA-512, so the analogy works well enough for that, or other wide hash, and little entropy in the input. But if we try to use the analogy for the low-order 4 bits of SHA-512, or/and a hashed message with significant entropy, it breaks. For example the analogy can't explain why we can break collision-resistance of a 100-bit hash with about $2^{51}$ effort. $\endgroup$ – fgrieu Feb 21 '17 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.