# Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

292 questions
Filter by
Sorted by
Tagged with
7k views

### How hard is it to guess a 8 digit PIN?

Say that there are different live situations where you have to select own PIN numbers. Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources? Is ...
48 views

### What is the formula to calculate password entropy? [closed]

I saw in another thread: Is using 7-8 random words from all words of a language as password a good idea? These calculations: If we assume that English has 171,476 words. Then with 8 words the ...
21 views

### Does concatinating mutliple digests of hashes from CSRN result in a CSRN?

Kind of a noob question. Suppose; We generate 1,000 cryptographic-ally secure random numbers & store each of them in an array1. For each number in this array1, we take the hash sha256(CSRN) then ...
38 views

### Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
114 views

### Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

Encrypting with AES-256 is widely claimed to be post-quantum secure. But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a ...
119 views

Let's consider a random variable X that can produce the output $c$ with probability $1/4$. I was told that $-\log_{2}(\frac{1}{4})$ represents the number of bits needed to represent $c$. But, imagine ...
235 views

### What are usable entropy sources in a headless machine without /dev/random or any cryptography API?

If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?
67 views

### Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?

Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
137 views

### Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
75 views

### Estimate password cracking time given Shannon Entropy

Is there some algorithm that, given the Shannon entropy of a string, compute an estimation of the time that an average home computer will take to crack the password? Thank you.
165 views

### Does character encoding change entropy?

This is a question I've been wondering for a while. Technically these two strings have the same entropy I believe: ...
69 views

### What is the most secure encryption algorithm that keeps the entropy the same or even lowers it? [closed]

On top of my mind comes caesar cipher, but that is not really secure so what is the most secure encryption algorithm that doesn't affect entropy or even lowers it? I know this might not be as ...
87 views

### Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
81 views

### What is a popular entropy source for seeding a CSPRNG, which is actually weak and unreliable? [closed]

Say I want to seed a CSPRNG. What sources are popular, but unreliable? What sources should I even use?
67 views

### How can I estimate the amount of entropy (with JavaScript) that I'm seeding a CSPRNG with?

I am trying to determine how much entropy is going into a specific CSPRNG in JavaScript, but I can't seem to find a pure-JS client-side implementation of an entropy estimator. So, I need to find a ...
76 views

### Generating nicer diceware passwords without losing entropy

Yes, another one of those "I have found a great password-generation strategy" waiting to be shot down! It seems that although diceware aims to be a secure and user-friendly password generation ...
104 views

### If an algorithm can not produce a true random stream, then an algorithm can not alter its entropy [closed]

Can a transform lower the Kolmogorov entropy of a true random stream and then restore that stream with out loss. If not true then this means a transform can not raise or lower the entropy.
41 views

### Looking for a formula for “Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security”

Suppose I have a function $F(x_1,\ldots,x_n)$, where each $x_i$ is of $l$-bits security (suppose each $x_i$ is a binary string of length $l$). At the same time, suppose there are $n$ persons, each one ...
119 views

### AES256 key entropy requirements

Is this encryption method sensitive to weak keys? Is there any reference in the NIST on the AES key's entropy? (For example, must it have been generated from a TRNG?) Can I safely use the Microsoft ...
85 views

### how to measure/calculate guessing entropy for side channel attacks

I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and ...
113 views

### Can we estimate the amount of entropy required to generate an RSA key?

Of say 4096 bits as is a default GPG master key. I can manage the first one or so almost immediately on Ubuntu. It then runs out of entropy when generating several more RSA keys, and I'm forced ...
288 views

### Yarrow and weak cryptographic keys on macOS

Given that macOS uses Yarrow as a PRNG, and Yarrow is only capable of 160 bit outputs (/dev/random on macOS is actually Yarrow) are keys generated on macOS weaker than Linux? Even BSD has switched to ...
200 views

### Does the use of English words weaken diceware passphrases [duplicate]

A Diceware passphrase is constructed from a set of words chosen from a 7776-word database, using five dice throws to choose each word. The argument is that each word in the phrase adds about 12.92 ...
241 views

### Can a deck of cards be used as a practical source of cryptographic randomness?

This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards. The ...
159 views

### Can adding bad entropy to good entropy, make a system insecure?

For example, If I needed to generate a random number. I use a good source of entropy to generate r. Then I add values a, <...
156 views

### PBKDF and Entropy

We all regularly use password based, key derivation functions, however something that strikes me as counter intuitive is how PBKDF can somehow "stretch" the entropy of a supplied password to generate ...
187 views

### Von Neumann Extractor - Which bit is retained?

Which bit is retained in the Von Neumann debiasing algorithm? 00 and 11 are discarded and 10, 01 are retained but is the first or the second bit retained or does it matter? In other words: first: ...
116 views

### deterministic uuidv4 -> uuidv4

I need to copy a graph of elements with uuidv4s each, and separately stored relations containing element uuidv4s. On copy, I ...
124 views

Let $Z^t = (Y_1,\ldots,Y_t)$ be a sequence of random variables each taking values in $Y$. The random variables are not necessarily i.i.d but we know the joint distributions. i.e for every $z = (z_1,...... 1answer 113 views ### Registration Code Entropy I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system. The registration ... 2answers 128 views ### Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search? I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get$N$words with a total of$M$letters and that I don't put ... 2answers 185 views ### Why should one model an entropy source in order to build a TRNG? Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "... 1answer 105 views ### NIST STS incorrect results for sample files So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ... 3answers 271 views ### Low entropy - how does it compromise the crypto One of the often pointed out mistake in dealing with crypto is not having enough entropy in the system. Without enough entropy the random numbers generated are not random enough. But what I am not ... 3answers 549 views ### Hardware RNG Bias I have generator based on sampled noise (reverse-biased transistor - actually ChaosKey but that's not that important). The noise source is fed into ADC and sampled with 16bit resolution (2 bytes). ... 1answer 112 views ### Entropy of a random message chosen by an adversary from a subdomain Assume we have a set of random bit strings:$S=\{s_1,...,s_n\}$, where each of them is of length$\lambda$($s_i\leftarrow\{0,1\}^{\lambda}$). We give the set$S$to an adversary who picks one of the ... 1answer 211 views ### Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate] Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ... 1answer 79 views ### Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad? [Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ... 1answer 206 views ### What's an entropy measure for the sequence$0, 1, 0, 1, 0, 1, …$? I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting$0, 1, 0, 1, 0, ...$and having the maximum entropy as given by$E(S)$. Shouldn't$E(S)$measure ... 1answer 212 views ### In the Linux Kernel 4.8+, does the CSPRNG update the entropy pool? My understanding of how /dev/urandom works is that the kernel collects true randomness from a variety of sources, and mixes them together to remove statistical bias. It does this at regular intervals ... 3answers 269 views ### What is the entropy of a Mersenne Twister (MT)? From Serious Cryptography: "Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit ... 5answers 939 views ### Entropy vs predictability in PRNGs If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ... 3answers 519 views ### Why is Min-entropy significant in cryptography? Let$H_{min}$= Min-entropy and$H$= Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is$ \frac{H} {H_{min}} > 10$from any conceivable ... 3answers 198 views ### BouncyCastle style ThreadedSeedGenerator I've written a BouncyCastle style threaded seeder and was wondering about the predictability of the data the program generates. The reason I'm not simply using BouncyCastle is because security isn't ... 2answers 299 views ### Does AES encrypting /dev/zero and feeding output to AES again increase entropy of the ciphertext? I just thought about what would change if would pipe the output of ... 1answer 1k views ### Relation between entropy and min-entropy I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ... 1answer 46 views ### Attack vector difference when not allowing repetitions in BIP-39 We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It ... 1answer 272 views ### Key Entropy meaning Help Can anyone help me understand key entropy the mathematics behind it and the uses for it? I understand most of it but I just want to understand what does$\log 2$do like if I do.$\log 128 / \log 2 = ...
If a symmetric encryption key $K$ has been generated by some recommended (NIST for example) RBG then we should have a key with high entropy. But if we xor other bit-strings (e.g. IVs, other keys, etc....