I'm reading Jean-Philippe Aumasson's book Serious Cryptography to learn more about cryptography. On page 37, the author gives an example of Cryptocat's off-by-one error in its PRNG implementation in 2013, as shown below:
Cryptocat.random = function() {
var x, o = '';
while (o.length < 16) {
x = state.getBytes(1);
if (x[0] <= 250) {
o += x[0] % 10;
}
} return parseFloat('0.' + o)
}
The off-by-one error is found in the IF condition clause which uses <=
rather than <
. The author states that the values generated had an entropy of 45 instead of approximately 53 bits.
I'm wondering how the entropy of 45 bits is calculated.
In fact, if the code uses <
, then everything is all right: the probability of a decimal digit is equally 1/10. Thus the entropy of 16 decimal digits would be 16*10*1/10*log(10, 2) = 53.1508
.
However, in the case of the above-flawed code, the probability of decimal 0 is 26/251, and the probability of each other value is 25/251. Thus, the entropy of 16 decimal digits would be 16*(26/251*log(251/26, 2) + 9*25/251*log(251/25, 2)) = 53.149
.
I don't any clues on how to get the 45 bits entropy. Can anyone help me, please?
References: