Why does it make sense to use min-entropy for measuring cryptographic random data?

Question

Comments on Cryptographic Entropy Measurement seems to challenge the heart of NIST SP 800-90B, which proposes min-entropy as a conservative measure of entropy produced by hardware source.

[The idea of using min-entropy] has been taken to heart in the NIST SP 800-90 documents, using the most conservative measure, min-entropy. While this may make sense for cryptographic random data, it makes no sense when measuring entropy in raw random data. [section 1, page 2]

Why does it make sense to use min-entropy for measuring cryptographic random data? I would have thought it was the other way around --- sensible for measuring raw random data, not cryptographic random data --- because entropy is produced in raw random data; cryptographic random data is processed random data, which cannot increase entropy, only possibly reduce it.

The central limit theorem does not hold and confidence intervals are not well defined for [min-entropy]. If minimum entropy does not satisfy the requirements set out by either Shannon or Rényi, why is it used as the foundation for measuring entropy in cryptographic applications? [section 3.1.1, page 6]

Does min-entropy satisfy the properties of an entropy measuring function laid out by Shannon? If not, why is it being used for measuring entropy?

Update. @kodlu, the properties an entropy function $I(p)$, where $p$ is the probability of a certain event $s$ should have are:

1. $I(p) \ge 0$
2. $I(p_1, p_2) = I(p_1) + I(p_2)$ for independent events.
3. $I(p)$ is a continuous function of $p$.

Answer 1

Ignore NIST. It has more important legally binding agendas to debate outside of this forum. Use common sense.

Does min-entropy satisfy the properties of an entropy measuring function laid out by Shannon? If not, why is it being used for measuring entropy?

No. $H_{\infty}$ is to Shannon entropy as is JPEG to BMP. Shannon was interested in encoding all the data in the transmission channel. $H_{\infty}$ is lossy and the original data cannot be retrieved in it's entirety. $H_{\infty}$ is used before transmission.

entropy is produced in raw random data

Yes. So measure it. You will have a lot more luck if you can prove the data to be IID.

It boils down to this:-

1. You need to separate information entropy from cryptographic entropy.
2. We want true random bits.
3. We get them via some generic form of hardware processing.
4. Current mathematical thinking revolves around the left over hash lemma which dictates the eventual output bias.
5. The thinking is predicated on $H_{\infty}$.
6. Thus $H_{\infty}$.