Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has in one's state of knowledge about an unknown piece of information, defined in terms of the probability distribution of possible values of the outcome or piece of information.

0
votes
0answers
42 views

entropy in cryptography ciphertext known attack [closed]

Is entropy of plaintext (given ciphertext) is equal to the entropy of key (given ciphertext) ? that is H(P|C) = H(K|C);
2
votes
1answer
48 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
3answers
133 views

Low entropy - how does it compromise the crypto

One of the often pointed out mistake in dealing with crypto is not having enough entropy in the system. Without enough entropy the random numbers generated are not random enough. But what I am not ...
5
votes
3answers
416 views

Hardware RNG Bias

I have generator based on sampled noise (reverse-biased transistor - actually ChaosKey but that's not that important). The noise source is fed into ADC and sampled with 16bit resolution (2 bytes). ...
2
votes
2answers
111 views

Entropy of a random message chosen by an adversary from a subdomain

Assume we have a set of random bit strings: $S=\{s_1,...,s_n\}$, where each of them is of length $\lambda$ ($s_i\leftarrow\{0,1\}^{\lambda}$). We give the set $S$ to an adversary who picks one of the ...
4
votes
1answer
186 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate]

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
-1
votes
1answer
52 views

Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...
0
votes
1answer
126 views

What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, …$?

I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...
2
votes
1answer
58 views

In the Linux Kernel 4.8+, does the CSPRNG update the entropy pool?

My understanding of how /dev/urandom works is that the kernel collects true randomness from a variety of sources, and mixes them together to remove statistical bias. It does this at regular intervals ...
5
votes
3answers
189 views

What is the entropy of a Mersenne Twister (MT)?

From Serious Cryptography: "Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit ...
8
votes
5answers
830 views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
2
votes
3answers
178 views

Why is Min-entropy significant in cryptography?

Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $ \frac{H} {H_{min}} > 10$ from any conceivable ...
2
votes
3answers
148 views

BouncyCastle style ThreadedSeedGenerator

I've written a BouncyCastle style threaded seeder and was wondering about the predictability of the data the program generates. The reason I'm not simply using BouncyCastle is because security isn't ...
4
votes
2answers
168 views

Does AES encrypt /dev/null and feed output to AES again increase entropy of the ciphertext?

I just thought about what would change if would pipe the output of openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt < /dev/zero | pv -pterb ...
4
votes
1answer
217 views

Relation between entropy and min-entropy

I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ...
1
vote
1answer
41 views

Attack vector difference when not allowing repetitions in BIP-39

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It ...
0
votes
1answer
158 views

Key Entropy meaning Help

Can anyone help me understand key entropy the mathematics behind it and the uses for it? I understand most of it but I just want to understand what does $\log 2$ do like if I do. $\log 128 / \log 2 = ...
0
votes
1answer
53 views

Does repeated xoring of the (same) key K lower the entropy of K?

If a symmetric encryption key $K$ has been generated by some recommended (NIST for example) RBG then we should have a key with high entropy. But if we xor other bit-strings (e.g. IVs, other keys, etc....
2
votes
1answer
93 views

Some considerations about PRNGs

Recently I read about pseudorandom generators and I have some observations: My conlusion is a such that a secure implementation of a PRNG had to be blocking or returning an error code when it is too ...
5
votes
2answers
814 views

Consuming of entropy

When I put: sudo watch tail /proc/sys/kernel/random/entropy_avail && dd if=/dev/random of=/dev/zero It shows that available entropy is "consumed". What ...
1
vote
1answer
83 views

Pseudo-random generators and pitfalls

I've read the Chapter "Randomness" from the Serious Cryptography book and it raised some questions. Namely: It is written that Mersenne Twister is proved to be cryptographically irreliable. And that ...
15
votes
2answers
5k views

Calculating entropy within xkcd 936: Password Strength

When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic. So why doesn't the the first password "Tr0ub4dor&3" have an ...
2
votes
1answer
58 views

The quantum key establishment protocol

Consider the quantum key establishment protocol. Assume that bit values, emitter basis, and receiver lter orientation are selected independently and uniformly at random (i.e., 50% chance for each of ...
1
vote
0answers
376 views

On Linux, seeding /dev/urandom does not unblock /dev/random, causing libsodium to hang?

Edit for clarity: Does the "standard" test for initialization of the Linux non-blocking entropy pool, by attempting to read 1 byte from /dev/random, ignore seeding of /dev/urandom from file at boot, ...
1
vote
1answer
262 views

Perfect Secrecy prove

There was a question on my final exam, but I could not get a point. I really want to know the right answer. Question is: Suppose a cryptosystem has perfect secrecy. Prove that H(P|C) = H(P) H(...
0
votes
3answers
265 views

Shannon entropy of string, not same in Binary form? But just as good as a password?

This string, "Au+u1hvsvJeEXxky" has a Shannon entropy of 3.75 and a length of 16. The binary form of the string ( derived from Ascii-table ) is: 01000001 01110101 ...
1
vote
0answers
45 views

How to envision entropy concentration in HKDF “extract” stage?

RFC 5869: Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key. The ...
3
votes
3answers
175 views

Usage and limitations of sponge functions for PRNG

This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge ...
7
votes
3answers
527 views

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

In this question about hardware random number generator, a discussion about the following question has been started: In order to test RNG's and entropy's quality, should test suites like ENT and ...
0
votes
1answer
170 views

Explaining entropy

Introductory Chemistry course, non-science majors. I am trying to explain entropy without using the word randomness. Example: a deck of 52 cards has multiple states of card order. That we may like a ...
4
votes
2answers
200 views

NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track. Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output: ...
3
votes
1answer
71 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
0
votes
2answers
121 views

Is a cryptographic key of size $N$ equivalent to $N$ bits of entropy?

Are there any caveats to the claim that a cryptographic key of size $N$ bits and $N$ bits of entropy are equivalent?
3
votes
2answers
180 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
-3
votes
3answers
460 views

How to interpret the entropy results for a NIST test file?

There is test data derived from pi that is supplied by NIST for validating their entropy measurement formulae listed in NIST's Recommendation for the Entropy Sources Used for Random Bit Generation. ...
-4
votes
1answer
392 views

Do the NIST tools on GitHub measure entropy reliably? [closed]

There is a supposed NIST tool called SP800-90B_EntropyAssessment on that Git thing. It's designed to be used in accordance with NIST's Recommendation for the Entropy Sources Used for Random Bit ...
1
vote
3answers
489 views

How to deterministically generate a 256 bit ECC key from 128 bits of entropy without a CSPRNG

A safe way to generate a 256 bit ECC key from 128 bits of entropy is to use a CSPRNG, according to this answer: https://crypto.stackexchange.com/a/56551/43864 However, it's difficult to find a cross ...
1
vote
2answers
144 views

Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
4
votes
2answers
333 views

Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key? I assume this is because 256 bit ...
0
votes
3answers
195 views

Strictly, is length(key) >= length(message) wrong for one time pads?

It's a common adage that for a perfectly secret one time pad, length(key) >= length(message) must hold. But that's wrong isn't it? At least very sloppy maths. Isn't the strict mathematical ...
0
votes
1answer
76 views

Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
3
votes
4answers
217 views

How many bits of entropy are leaked for every derived password from a master?

Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password? Let's take an ...
0
votes
1answer
44 views

Security of seed from a dictionary

How do you calculate the total amount of combinations in the standard 12-word seed from a 2048 word dictionary? $log_2(2048^{12})$ which equals $2^{132}$? Is this the right way? And what is the "...
2
votes
1answer
455 views

Salt and pepper at both client and server sides?

Putting aside that it may sound paranoid. I know that many users tend to use the same password on many sites. Then, from an ethical point of view, I should not only be concerned about security breaks ...
3
votes
0answers
72 views

Entropy of the union of two sources

I am given that $S_1=(S_1,P_1)$ and $S_2=(S_2,P_2)$ are sources, where $S_1=\{s_1,...,s_n\}$, $P_1(x_i)=p_i$ and $S_2=\{y_1,...,s_m\}$, $P_2(y_j)=q_j$. I have to find the entropy of $S_{\lambda}=(S_i ...
0
votes
2answers
110 views

Can I generate same random number given same entropy value?

Given the hypothetical fact that I can predict the same entropy value used to generate a random number, can I generate the same random value, say in a Windows based python application?
1
vote
2answers
71 views

Are there any key exchange schemes that only require entropy on one side?

Are there any cryptographically secure (in terms of confidentiality) key exchange schemes which are usable if one partner in the connection is entirely deterministic and has absolutely no entropy? I ...
1
vote
0answers
604 views

How can I calculate the entropy of an image?

I am searching how can I calculate the entropy of a image for a Capture The Flag. I know what is the entropy theory and I tried a pair of things: Convert the jpg image on binary image and calculate ...
0
votes
1answer
47 views

entropy calculation in data wiping

Can entropy being used as data removal verification in data wiping ? How we can implement the entropy calculation in a data wiping tool? The wiping tool will used overwriting method using single pass.
4
votes
2answers
329 views

RNG failing Restart Tests by NIST SP800-22?

I have data sample of 1,000,000 bytes generated by a hardware RNG. The device is certified by ENT test suite, NIST SP800-22, DIE HARDER and TestU01. I have tested my sample by SP800-...