# Is entropy affected by time?

I'm quite new to cryptographic systems, and today we discussed entropy at work. Since entropy is used to ensure the difficulty for an attacker to break in, I was wondering if the more time the high entropy value remains the same, the more the system becomes vulnerable.

Is the concept of entropy related with the time (like a logarithm function or else)?

No. Entropy does not depend upon time. Entropy is a purely mathematical, probability-based concept.

The entropy of a distribution is some particular function of the distribution. The entropy of a random variable is the entropy of its distribution. Formally speaking, it does not make sense to speak of the entropy of a particular value; but we can talk about the entropy of a random process. For example: suppose I roll a fair 6-sided die, and get 3. It doesn't make sense to talk about the entropy of the number 3, but I can ask what is the entropy of this random process (the process of rolling a fair 6-sided die to get a random number from 1 to 6) -- it has $\lg 6$ bits of entropy, in particular. The entropy of a process is the entropy of the distribution on the possible outputs from that process.

Notice how nothing here changes with time. If I roll a fair 6-sided die today, the entropy of the result is $\lg 6$ bits. If I roll it tomorrow, the entropy of that will also be $\lg 6$ bits. If I roll a fair 6-sided die today, write down the answer, and then a decade from now look at what I wrote down and ask about its entropy, the answer will still be $\lg 6$ bits. The entropy of this random process remains $\lg 6$ bits no matter how long we wait, because its entropy depends upon the distribution of possible outputs from the random process, and that distribution is whatever it is -- it does not depend upon time.

Now in some cases it might be true that, if you use a random secret key, then the longer you use the same key, the greater the chances that an attacker can recover the key. That might be true. But it has nothing to do with entropy. The entropy doesn't change or degrade with time; the entropy of that key is what it is. All that changes is, the longer you use the key, the more chances the attacker has to try to break it. For the same amount of entropy, the more times the attacker can try to break it, the better the attacker's odds will be. So that's one sense in which the attacker's success probability (or the security of the system) might depend upon how long the system is used for -- even though the entropy of the crypto key does not depend upon that.

• I'm agree that entropy is a pure mathematical concept; but here what's on my mind. We can barely say that the security of our system is related to the key, if we choose a fixed key, there is no entropy because there is no randomness, and the system is totally vulnerable; in the other hand if we choose a random key, the entropy will be maximum for that size and the system will be more secure. Now when the system get attacked the security decrease (more time less security), like I said security is related to entropy and security is related to time. So entropy is kind of related to time i guess..
– Jaay
Jun 4, 2013 at 8:02
• @Jaay: you might say security against brute-force attacks is a function of entropy and time, but that doesn't mean entropy is a function of time. Entropy is associated with the process of selection. That's why it only makes sense to talk about the entropy of a random variable.
– Reid
Jun 4, 2013 at 14:26
• mostly just thinking out loud here, but how does this change given the fact that a truly fair dice does not exist? If an attacker can model that not-truely fair dice with more fidelity over time, the entropy does go down, right? Jun 25, 2014 at 21:43

There seems to be three different notions mixed up here. Suppose your system has a secret key, and that your question should be understood as asking how the quality of that key changes over time, and how that relates to the concept of Entropy. In such case:

1. How much entropy does a key have to have, for your system to get adequate security strength?
2. How much entropy did the key get by the way it was generated?
3. How much Shannon-entropy does the key retain by being kept secret in the long term?

Regarding the first notion, it should be stressed that the entropy of a key doesn't change, just because the limit of what counts as adequate security strength changes over time.

In cryptography, Entropy usually refers to the second notion only. One way to look at it is to note that cryptography is about systems where the entire security of your system, ultimately depends on the secrecy of the secret key. If your system does a poor job at keeping the key secret, it might be a problem with your cryptographic schemes being susceptible to cryptanalysis, or a problem with your key management. If the key doesn't stay secret because it was poorly generated, it is a problem with the amount of entropy it got from the way it was generated. Those are two different questions that have to be handled differently in cryptography, so it makes sense to define Entropy in such way that only refers to the latter.

Regarding the third question, it might however be noted that Shannon-entropy is a measure of the unpredictability of the key in a more general sense. Interpreted in absolute terms, this means that a key can only have entropy until it is generated. Once it is generated and has been used once, it gets a specific value, can only have that one value and consequently has no entropy. (This, btw, is why you can only get information theoretic security from an OTP and why it mustn't be reused.) In relative terms, the key might still be unpredictable to a specific observer (and in that sense still have entropy relative to that observer), and this kind of entropy might of course degrade over time, as the observer learns information about the key (e.g. due to cryptanalysis or because of poor key management).