Comments on Cryptographic Entropy Measurement seems to challenge the heart of NIST SP 800-90B, which proposes min-entropy as a conservative measure of entropy produced by hardware source.
[The idea of using min-entropy] has been taken to heart in the NIST SP 800-90 documents, using the most conservative measure, min-entropy. While this may make sense for cryptographic random data, it makes no sense when measuring entropy in raw random data. [section 1, page 2]
Why does it make sense to use min-entropy for measuring cryptographic random data? I would have thought it was the other way around --- sensible for measuring raw random data, not cryptographic random data --- because entropy is produced in raw random data; cryptographic random data is processed random data, which cannot increase entropy, only possibly reduce it.
The central limit theorem does not hold and confidence intervals are not well defined for [min-entropy]. If minimum entropy does not satisfy the requirements set out by either Shannon or Rényi, why is it used as the foundation for measuring entropy in cryptographic applications? [section 3.1.1, page 6]
Does min-entropy satisfy the properties of an entropy measuring function laid out by Shannon? If not, why is it being used for measuring entropy?
Update. @kodlu, the properties an entropy function $I(p)$, where $p$ is the probability of a certain event $s$ should have are:
- $I(p) \ge 0$
- $I(p_1, p_2) = I(p_1) + I(p_2)$ for independent events.
- $I(p)$ is a continuous function of $p$.