Comments on Cryptographic Entropy Measurement seems to challenge the heart of NIST SP 800-90B, which proposes min-entropy as a conservative measure of entropy produced by hardware source.

[The idea of using min-entropy] has been taken to heart in the NIST SP 800-90 documents, using the most conservative measure, min-entropy. While this may make sense for cryptographic random data, it makes no sense when measuring entropy in raw random data. [section 1, page 2]

Why does it make sense to use min-entropy for measuring cryptographic random data? I would have thought it was the other way around --- sensible for measuring raw random data, not cryptographic random data --- because entropy is produced in raw random data; cryptographic random data is processed random data, which cannot increase entropy, only possibly reduce it.

The central limit theorem does not hold and confidence intervals are not well defined for [min-entropy]. If minimum entropy does not satisfy the requirements set out by either Shannon or Rényi, why is it used as the foundation for measuring entropy in cryptographic applications? [section 3.1.1, page 6]

Does min-entropy satisfy the properties of an entropy measuring function laid out by Shannon? If not, why is it being used for measuring entropy?

Update. @kodlu, the properties an entropy function $I(p)$, where $p$ is the probability of a certain event $s$ should have are:

  1. $I(p) \ge 0$
  2. $I(p_1, p_2) = I(p_1) + I(p_2)$ for independent events.
  3. $I(p)$ is a continuous function of $p$.
  • $\begingroup$ What properties of an entropy function laid out by Shannon are you referring to? Also please explain your “I would have thought” reasoning to focus the question. $\endgroup$
    – kodlu
    Commented Sep 13, 2020 at 1:03
  • 1
    $\begingroup$ "Raw" data uses min-entropy because this models unpredictable random sources well (for justification for this, look up lecture notes in "Randomness Extraction", they usually justify using $H_\infty(X)$ early on). It doesn't particularly matter which measure you use for cryptographic random data, as I believe most entropy measures coincide for uniform distributions (and should also be essentially the same for distributions which are close to uniform distributions). $\endgroup$
    – Mark Schultz-Wu
    Commented Sep 13, 2020 at 3:36
  • 2
    $\begingroup$ Related prior question on min-entropy in cryptography $\endgroup$
    – SEJPM
    Commented Sep 13, 2020 at 12:24

1 Answer 1


Ignore NIST. It has more important legally binding agendas to debate outside of this forum. Use common sense.

Does min-entropy satisfy the properties of an entropy measuring function laid out by Shannon? If not, why is it being used for measuring entropy?

No. $H_{\infty}$ is to Shannon entropy as is JPEG to BMP. Shannon was interested in encoding all the data in the transmission channel. $H_{\infty}$ is lossy and the original data cannot be retrieved in it's entirety. $H_{\infty}$ is used before transmission.

entropy is produced in raw random data

Yes. So measure it. You will have a lot more luck if you can prove the data to be IID.

It boils down to this:-

  1. You need to separate information entropy from cryptographic entropy.
  2. We want true random bits.
  3. We get them via some generic form of hardware processing.
  4. Current mathematical thinking revolves around the left over hash lemma which dictates the eventual output bias.
  5. The thinking is predicated on $H_{\infty}$.
  6. Thus $H_{\infty}$.
  • $\begingroup$ Comments and brave/honest opinions please... $\endgroup$
    – Paul Uszak
    Commented Dec 24, 2020 at 1:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.