Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has in one's state of knowledge about an unknown piece of information, defined in terms of the probability distribution of possible values of the outcome or piece of information.

4
votes
2answers
75 views

Relation between entropy and min-entropy

I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ...
1
vote
1answer
30 views

Attack vector difference when not allowing repetitions in BIP-39

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It ...
0
votes
1answer
119 views

Key Entropy meaning Help

Can anyone help me understand key entropy the mathematics behind it and the uses for it? I understand most of it but I just want to understand what does $\log 2$ do like if I do. $\log 128 / \log 2 = ...
0
votes
1answer
45 views

Does repeated xoring of the (same) key K lower the entropy of K?

If a symmetric encryption key $K$ has been generated by some recommended (NIST for example) RBG then we should have a key with high entropy. But if we xor other bit-strings (e.g. IVs, other keys, etc....
2
votes
1answer
89 views

Some considerations about PRNGs

Recently I read about pseudorandom generators and I have some observations: My conlusion is a such that a secure implementation of a PRNG had to be blocking or returning an error code when it is too ...
5
votes
2answers
786 views

Consuming of entropy

When I put: sudo watch tail /proc/sys/kernel/random/entropy_avail && dd if=/dev/random of=/dev/zero It shows that available entropy is "consumed". What ...
1
vote
1answer
77 views

Pseudo-random generators and pitfalls

I've read the Chapter "Randomness" from the Serious Cryptography book and it raised some questions. Namely: It is written that Mersenne Twister is proved to be cryptographically irreliable. And that ...
15
votes
2answers
5k views

Calculating entropy within xkcd 936: Password Strength

When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic. So why doesn't the the first password "Tr0ub4dor&3" have an ...
2
votes
1answer
55 views

The quantum key establishment protocol

Consider the quantum key establishment protocol. Assume that bit values, emitter basis, and receiver lter orientation are selected independently and uniformly at random (i.e., 50% chance for each of ...
1
vote
0answers
170 views

On Linux, seeding /dev/urandom does not unblock /dev/random, causing libsodium to hang?

Edit for clarity: Does the "standard" test for initialization of the Linux non-blocking entropy pool, by attempting to read 1 byte from /dev/random, ignore seeding of /dev/urandom from file at boot, ...
0
votes
0answers
42 views

Want to know which encrypting algorithm shall I go for the wired connection RS485 the device has 52Mb memory

I have embedded Linux device in which total memory I have is 52MB. This device is distributed system in which 100 nodes can connect each other in wired connection using RS485 as master and slave ...
1
vote
1answer
172 views

Perfect Secrecy prove

There was a question on my final exam, but I could not get a point. I really want to know the right answer. Question is: Suppose a cryptosystem has perfect secrecy. Prove that H(P|C) = H(P) H(...
0
votes
3answers
170 views

Shannon entropy of string, not same in Binary form? But just as good as a password?

This string, "Au+u1hvsvJeEXxky" has a Shannon entropy of 3.75 and a length of 16. The binary form of the string ( derived from Ascii-table ) is: 01000001 01110101 ...
1
vote
0answers
41 views

How to envision entropy concentration in HKDF “extract” stage?

RFC 5869: Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key. The ...
3
votes
3answers
145 views

Usage and limitations of sponge functions for PRNG

This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge ...
7
votes
3answers
321 views

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

In this question about hardware random number generator, a discussion about the following question has been started: In order to test RNG's and entropy's quality, should test suites like ENT and ...
0
votes
0answers
25 views

Does knowing the seed state given the output, lead to potential compromise?

I see in some answers from 2014, some talk about independent sources of entropy mixed canonically with XOR with say one source which is known in advance. Assuming we are operating on bit string ...
0
votes
1answer
130 views

Explaining entropy

Introductory Chemistry course, non-science majors. I am trying to explain entropy without using the word randomness. Example: a deck of 52 cards has multiple states of card order. That we may like a ...
4
votes
2answers
137 views

NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track. Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output: ...
3
votes
1answer
62 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
0
votes
2answers
88 views

Is a cryptographic key of size $N$ equivalent to $N$ bits of entropy?

Are there any caveats to the claim that a cryptographic key of size $N$ bits and $N$ bits of entropy are equivalent?
4
votes
2answers
124 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
-3
votes
3answers
334 views

How to interpret the entropy results for a NIST test file?

There is test data derived from pi that is supplied by NIST for validating their entropy measurement formulae listed in NIST's Recommendation for the Entropy Sources Used for Random Bit Generation. ...
-4
votes
1answer
255 views

Do the NIST tools on GitHub measure entropy reliably? [closed]

There is a supposed NIST tool called SP800-90B_EntropyAssessment on that Git thing. It's designed to be used in accordance with NIST's Recommendation for the Entropy Sources Used for Random Bit ...
1
vote
3answers
342 views

How to deterministically generate a 256 bit ECC key from 128 bits of entropy without a CSPRNG

A safe way to generate a 256 bit ECC key from 128 bits of entropy is to use a CSPRNG, according to this answer: https://crypto.stackexchange.com/a/56551/43864 However, it's difficult to find a cross ...
1
vote
2answers
97 views

Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
4
votes
2answers
267 views

Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key? I assume this is because 256 bit ...
-2
votes
3answers
160 views

Strictly, is length(key) >= length(message) wrong for one time pads?

It's a common adage that for a perfectly secret one time pad, length(key) >= length(message) must hold. But that's wrong isn't it? At least very sloppy maths. Isn't the strict mathematical ...
0
votes
1answer
67 views

Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
3
votes
4answers
203 views

How many bits of entropy are leaked for every derived password from a master?

Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password? Let's take an ...
0
votes
1answer
41 views

Security of seed from a dictionary

How do you calculate the total amount of combinations in the standard 12-word seed from a 2048 word dictionary? $log_2(2048^{12})$ which equals $2^{132}$? Is this the right way? And what is the "...
2
votes
1answer
356 views

Salt and pepper at both client and server sides?

Putting aside that it may sound paranoid. I know that many users tend to use the same password on many sites. Then, from an ethical point of view, I should not only be concerned about security breaks ...
3
votes
0answers
65 views

Entropy of the union of two sources

I am given that $S_1=(S_1,P_1)$ and $S_2=(S_2,P_2)$ are sources, where $S_1=\{s_1,...,s_n\}$, $P_1(x_i)=p_i$ and $S_2=\{y_1,...,s_m\}$, $P_2(y_j)=q_j$. I have to find the entropy of $S_{\lambda}=(S_i ...
0
votes
2answers
104 views

Can I generate same random number given same entropy value?

Given the hypothetical fact that I can predict the same entropy value used to generate a random number, can I generate the same random value, say in a Windows based python application?
1
vote
2answers
66 views

Are there any key exchange schemes that only require entropy on one side?

Are there any cryptographically secure (in terms of confidentiality) key exchange schemes which are usable if one partner in the connection is entirely deterministic and has absolutely no entropy? I ...
1
vote
0answers
464 views

How can I calculate the entropy of an image?

I am searching how can I calculate the entropy of a image for a Capture The Flag. I know what is the entropy theory and I tried a pair of things: Convert the jpg image on binary image and calculate ...
0
votes
1answer
41 views

entropy calculation in data wiping

Can entropy being used as data removal verification in data wiping ? How we can implement the entropy calculation in a data wiping tool? The wiping tool will used overwriting method using single pass.
4
votes
2answers
268 views

RNG failing Restart Tests by NIST SP800-22?

I have data sample of 1,000,000 bytes generated by a hardware RNG. The device is certified by ENT test suite, NIST SP800-22, DIE HARDER and TestU01. I have tested my sample by SP800-...
-1
votes
2answers
195 views

Is it possible that the entropy of a cipher system to be zero or infinite?

Entropy defined in cipher system as a measure of information or uncertainty. Is it possible to be zero or infinite? What would it mean based on Entropy formula: $$H(X)=-\sum_{x \in X} P(x) \log_2{P(...
2
votes
0answers
86 views

Enumerating the bias of NIST and Pearson randomness extractors

The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
1
vote
3answers
107 views

Conditioning Component in Entropy Source

Given a sample of random bytes, how to determine if Entropy Source (source of random bytes) includes a Conditioning Component or not, with respect to NIST SP 800-90 B)? Thanks
1
vote
0answers
159 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
0
votes
1answer
325 views

Entropy Rate of Bit String [closed]

How to calculate "Entropy Rate" of a bit string? Does "NIST Randomness Test Suite" provide any test to measure Entropy of an entropy source? How to check "biased-ness" of a bit string? Thank you in ...
0
votes
2answers
129 views

Entropy after shuffling result of /dev/urandom

first of all: Im pretty paranoid. I am creating a seed on my linux server using the following command: cat /dev/urandom |tr -dc A-Z9|head -c${1:-81} Since I don´...
4
votes
2answers
254 views

Diode vs quantum computer

Consider everyone's favourite pseudo random number generator, RANDU where V is the output of any successive iteration. $$ V_{j+1} = 65539 \cdot V_j \; mod \; 2^{31} $$ I've purposefully chosen ...
5
votes
3answers
2k views

Using 32 hexadecimal digits vs ASCII equivalent 16-character password

Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file. So, for ...
5
votes
3answers
677 views

If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?

If one were to create a SHA256 hash using 256 coin flips converted to hex (which, as I understand it, is as "entro-phized" as one can capture in SHA256) then take that hash as a string, combine that ...
0
votes
1answer
106 views

Multi-Embedded Xor for Perfect OTP

I am looking for a perfect OTP design, so let's see if this design is good. There are 2 issues when it comes to a good OTP system, the key and the plaintext, we will use XOR as cypher: If the ...
8
votes
2answers
2k views

Extracting randomness from highly-biased RNG

I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g....
5
votes
3answers
692 views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...