Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has in one's state of knowledge about an unknown piece of information, defined in terms of the probability distribution of possible values of the outcome or piece of information.

Filter by
Sorted by
Tagged with
0
votes
1answer
66 views

Can we estimate the amount of entropy required to generate an RSA key?

Of say 4096 bits as is a default GPG master key. I can manage the first one or so almost immediately on Ubuntu. It then runs out of entropy when generating several more RSA keys, and I'm forced ...
3
votes
2answers
228 views

Yarrow and weak cryptographic keys on macOS

Given that macOS uses Yarrow as a PRNG, and Yarrow is only capable of 160 bit outputs (/dev/random on macOS is actually Yarrow) are keys generated on macOS weaker than Linux? Even BSD has switched to ...
2
votes
3answers
165 views

Does the use of English words weaken diceware passphrases [duplicate]

A Diceware passphrase is constructed from a set of words chosen from a 7776-word database, using five dice throws to choose each word. The argument is that each word in the phrase adds about 12.92 ...
4
votes
3answers
202 views

Can a deck of cards be used as a practical source of cryptographic randomness?

This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards. The ...
2
votes
3answers
147 views

Can adding bad entropy to good entropy, make a system insecure?

For example, If I needed to generate a random number. I use a good source of entropy to generate r. Then I add values a, <...
1
vote
2answers
83 views

PBKDF and Entropy

We all regularly use password based, key derivation functions, however something that strikes me as counter intuitive is how PBKDF can somehow "stretch" the entropy of a supplied password to generate ...
3
votes
1answer
157 views

Von Neumann Extractor - Which bit is retained?

Which bit is retained in the Von Neumann debiasing algorithm? 00 and 11 are discarded and 10, 01 are retained but is the first or the second bit retained or does it matter? In other words: first: ...
1
vote
1answer
59 views

deterministic uuidv4 -> uuidv4

I need to copy a graph of elements with uuidv4s each, and separately stored relations containing element uuidv4s. On copy, I ...
2
votes
2answers
95 views

Monotonicity of min-entropy

Let $Z^t = (Y_1,\ldots,Y_t)$ be a sequence of random variables each taking values in $Y$. The random variables are not necessarily i.i.d but we know the joint distributions. i.e for every $z = (z_1,......
2
votes
1answer
81 views

Registration Code Entropy

I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system. The registration ...
0
votes
2answers
103 views

Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put ...
2
votes
2answers
158 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
2
votes
1answer
69 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
3answers
175 views

Low entropy - how does it compromise the crypto

One of the often pointed out mistake in dealing with crypto is not having enough entropy in the system. Without enough entropy the random numbers generated are not random enough. But what I am not ...
5
votes
3answers
486 views

Hardware RNG Bias

I have generator based on sampled noise (reverse-biased transistor - actually ChaosKey but that's not that important). The noise source is fed into ADC and sampled with 16bit resolution (2 bytes). ...
2
votes
1answer
112 views

Entropy of a random message chosen by an adversary from a subdomain

Assume we have a set of random bit strings: $S=\{s_1,...,s_n\}$, where each of them is of length $\lambda$ ($s_i\leftarrow\{0,1\}^{\lambda}$). We give the set $S$ to an adversary who picks one of the ...
4
votes
1answer
197 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate]

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
-1
votes
1answer
59 views

Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...
0
votes
1answer
148 views

What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, …$?

I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...
2
votes
1answer
126 views

In the Linux Kernel 4.8+, does the CSPRNG update the entropy pool?

My understanding of how /dev/urandom works is that the kernel collects true randomness from a variety of sources, and mixes them together to remove statistical bias. It does this at regular intervals ...
5
votes
3answers
223 views

What is the entropy of a Mersenne Twister (MT)?

From Serious Cryptography: "Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit ...
8
votes
5answers
861 views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
3
votes
3answers
310 views

Why is Min-entropy significant in cryptography?

Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $ \frac{H} {H_{min}} > 10$ from any conceivable ...
2
votes
3answers
167 views

BouncyCastle style ThreadedSeedGenerator

I've written a BouncyCastle style threaded seeder and was wondering about the predictability of the data the program generates. The reason I'm not simply using BouncyCastle is because security isn't ...
4
votes
2answers
236 views

Does AES encrypting /dev/zero and feeding output to AES again increase entropy of the ciphertext?

I just thought about what would change if would pipe the output of ...
4
votes
1answer
592 views

Relation between entropy and min-entropy

I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ...
1
vote
1answer
42 views

Attack vector difference when not allowing repetitions in BIP-39

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It ...
0
votes
1answer
194 views

Key Entropy meaning Help

Can anyone help me understand key entropy the mathematics behind it and the uses for it? I understand most of it but I just want to understand what does $\log 2$ do like if I do. $\log 128 / \log 2 = ...
0
votes
1answer
65 views

Does repeated xoring of the (same) key K lower the entropy of K?

If a symmetric encryption key $K$ has been generated by some recommended (NIST for example) RBG then we should have a key with high entropy. But if we xor other bit-strings (e.g. IVs, other keys, etc....
2
votes
1answer
99 views

Some considerations about PRNGs

Recently I read about pseudorandom generators and I have some observations: My conlusion is a such that a secure implementation of a PRNG had to be blocking or returning an error code when it is too ...
5
votes
2answers
845 views

Consuming of entropy

When I put: sudo watch tail /proc/sys/kernel/random/entropy_avail && dd if=/dev/random of=/dev/zero It shows that available entropy is "consumed". What ...
1
vote
1answer
88 views

Pseudo-random generators and pitfalls

I've read the Chapter "Randomness" from the Serious Cryptography book and it raised some questions. Namely: It is written that Mersenne Twister is proved to be cryptographically irreliable. And that ...
15
votes
2answers
5k views

Calculating entropy within xkcd 936: Password Strength

When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic. So why doesn't the the first password "Tr0ub4dor&3" have an ...
2
votes
1answer
59 views

The quantum key establishment protocol

Consider the quantum key establishment protocol. Assume that bit values, emitter basis, and receiver lter orientation are selected independently and uniformly at random (i.e., 50% chance for each of ...
1
vote
0answers
431 views

On Linux, seeding /dev/urandom does not unblock /dev/random, causing libsodium to hang? [closed]

Edit for clarity: Does the "standard" test for initialization of the Linux non-blocking entropy pool, by attempting to read 1 byte from /dev/random, ignore seeding of /dev/urandom from file at boot, ...
1
vote
1answer
330 views

Perfect Secrecy prove

There was a question on my final exam, but I could not get a point. I really want to know the right answer. Question is: Suppose a cryptosystem has perfect secrecy. Prove that H(P|C) = H(P) H(...
0
votes
3answers
440 views

Shannon entropy of string, not same in Binary form? But just as good as a password?

This string, "Au+u1hvsvJeEXxky" has a Shannon entropy of 3.75 and a length of 16. The binary form of the string ( derived from Ascii-table ) is: 01000001 01110101 ...
1
vote
0answers
50 views

How to envision entropy concentration in HKDF “extract” stage?

RFC 5869: Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key. The ...
3
votes
3answers
215 views

Usage and limitations of sponge functions for PRNG

This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge ...
7
votes
3answers
679 views

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

In this question about hardware random number generator, a discussion about the following question has been started: In order to test RNG's and entropy's quality, should test suites like ENT and ...
0
votes
1answer
192 views

Explaining entropy

Introductory Chemistry course, non-science majors. I am trying to explain entropy without using the word randomness. Example: a deck of 52 cards has multiple states of card order. That we may like a ...
4
votes
2answers
253 views

NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track. Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output: ...
3
votes
1answer
77 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
0
votes
2answers
149 views

Is a cryptographic key of size $N$ equivalent to $N$ bits of entropy?

Are there any caveats to the claim that a cryptographic key of size $N$ bits and $N$ bits of entropy are equivalent?
3
votes
2answers
207 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
-3
votes
3answers
597 views

How to interpret the entropy results for a NIST test file?

There is test data derived from pi that is supplied by NIST for validating their entropy measurement formulae listed in NIST's Recommendation for the Entropy Sources Used for Random Bit Generation. ...
-3
votes
1answer
527 views

Do the NIST tools on GitHub measure entropy reliably? [closed]

There is a supposed NIST tool called SP800-90B_EntropyAssessment on that Git thing. It's designed to be used in accordance with NIST's Recommendation for the Entropy Sources Used for Random Bit ...
1
vote
3answers
536 views

How to deterministically generate a 256 bit ECC key from 128 bits of entropy without a CSPRNG

A safe way to generate a 256 bit ECC key from 128 bits of entropy is to use a CSPRNG, according to this answer: https://crypto.stackexchange.com/a/56551/43864 However, it's difficult to find a cross ...
1
vote
2answers
174 views

Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
4
votes
2answers
422 views

Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key? I assume this is because 256 bit ...