Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

Filter by
Sorted by
Tagged with
8
votes
4answers
7k views

How hard is it to guess a 8 digit PIN?

Say that there are different live situations where you have to select own PIN numbers. Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources? Is ...
1
vote
0answers
48 views

What is the formula to calculate password entropy? [closed]

I saw in another thread: Is using 7-8 random words from all words of a language as password a good idea? These calculations: If we assume that English has 171,476 words. Then with 8 words the ...
1
vote
1answer
21 views

Does concatinating mutliple digests of hashes from CSRN result in a CSRN?

Kind of a noob question. Suppose; We generate 1,000 cryptographic-ally secure random numbers & store each of them in an array1. For each number in this array1, we take the hash sha256(CSRN) then ...
0
votes
0answers
38 views

Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
2
votes
1answer
114 views

Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

Encrypting with AES-256 is widely claimed to be post-quantum secure. But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a ...
2
votes
2answers
119 views

Doubt about Shannon entropy

Let's consider a random variable X that can produce the output $c$ with probability $1/4$. I was told that $-\log_{2}(\frac{1}{4})$ represents the number of bits needed to represent $c$. But, imagine ...
4
votes
2answers
235 views

What are usable entropy sources in a headless machine without /dev/random or any cryptography API?

If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?
2
votes
2answers
67 views

Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?

Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
4
votes
2answers
137 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
1
vote
1answer
75 views

Estimate password cracking time given Shannon Entropy

Is there some algorithm that, given the Shannon entropy of a string, compute an estimation of the time that an average home computer will take to crack the password? Thank you.
0
votes
2answers
165 views

Does character encoding change entropy?

This is a question I've been wondering for a while. Technically these two strings have the same entropy I believe: ...
1
vote
1answer
69 views

What is the most secure encryption algorithm that keeps the entropy the same or even lowers it? [closed]

On top of my mind comes caesar cipher, but that is not really secure so what is the most secure encryption algorithm that doesn't affect entropy or even lowers it? I know this might not be as ...
0
votes
1answer
87 views

Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
-1
votes
1answer
81 views

What is a popular entropy source for seeding a CSPRNG, which is actually weak and unreliable? [closed]

Say I want to seed a CSPRNG. What sources are popular, but unreliable? What sources should I even use?
0
votes
1answer
67 views

How can I estimate the amount of entropy (with JavaScript) that I'm seeding a CSPRNG with?

I am trying to determine how much entropy is going into a specific CSPRNG in JavaScript, but I can't seem to find a pure-JS client-side implementation of an entropy estimator. So, I need to find a ...
0
votes
1answer
76 views

Generating nicer diceware passwords without losing entropy

Yes, another one of those "I have found a great password-generation strategy" waiting to be shot down! It seems that although diceware aims to be a secure and user-friendly password generation ...
-2
votes
1answer
104 views

If an algorithm can not produce a true random stream, then an algorithm can not alter its entropy [closed]

Can a transform lower the Kolmogorov entropy of a true random stream and then restore that stream with out loss. If not true then this means a transform can not raise or lower the entropy.
1
vote
1answer
41 views

Looking for a formula for “Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security”

Suppose I have a function $F(x_1,\ldots,x_n)$, where each $x_i$ is of $l$-bits security (suppose each $x_i$ is a binary string of length $l$). At the same time, suppose there are $n$ persons, each one ...
1
vote
1answer
119 views

AES256 key entropy requirements

Is this encryption method sensitive to weak keys? Is there any reference in the NIST on the AES key's entropy? (For example, must it have been generated from a TRNG?) Can I safely use the Microsoft ...
1
vote
0answers
85 views

how to measure/calculate guessing entropy for side channel attacks

I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and ...
0
votes
1answer
113 views

Can we estimate the amount of entropy required to generate an RSA key?

Of say 4096 bits as is a default GPG master key. I can manage the first one or so almost immediately on Ubuntu. It then runs out of entropy when generating several more RSA keys, and I'm forced ...
3
votes
2answers
288 views

Yarrow and weak cryptographic keys on macOS

Given that macOS uses Yarrow as a PRNG, and Yarrow is only capable of 160 bit outputs (/dev/random on macOS is actually Yarrow) are keys generated on macOS weaker than Linux? Even BSD has switched to ...
2
votes
3answers
200 views

Does the use of English words weaken diceware passphrases [duplicate]

A Diceware passphrase is constructed from a set of words chosen from a 7776-word database, using five dice throws to choose each word. The argument is that each word in the phrase adds about 12.92 ...
4
votes
3answers
241 views

Can a deck of cards be used as a practical source of cryptographic randomness?

This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards. The ...
2
votes
3answers
159 views

Can adding bad entropy to good entropy, make a system insecure?

For example, If I needed to generate a random number. I use a good source of entropy to generate r. Then I add values a, <...
2
votes
2answers
156 views

PBKDF and Entropy

We all regularly use password based, key derivation functions, however something that strikes me as counter intuitive is how PBKDF can somehow "stretch" the entropy of a supplied password to generate ...
3
votes
1answer
187 views

Von Neumann Extractor - Which bit is retained?

Which bit is retained in the Von Neumann debiasing algorithm? 00 and 11 are discarded and 10, 01 are retained but is the first or the second bit retained or does it matter? In other words: first: ...
1
vote
1answer
116 views

deterministic uuidv4 -> uuidv4

I need to copy a graph of elements with uuidv4s each, and separately stored relations containing element uuidv4s. On copy, I ...
2
votes
2answers
124 views

Monotonicity of min-entropy

Let $Z^t = (Y_1,\ldots,Y_t)$ be a sequence of random variables each taking values in $Y$. The random variables are not necessarily i.i.d but we know the joint distributions. i.e for every $z = (z_1,......
2
votes
1answer
113 views

Registration Code Entropy

I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system. The registration ...
0
votes
2answers
128 views

Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put ...
2
votes
2answers
185 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
2
votes
1answer
105 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
3answers
271 views

Low entropy - how does it compromise the crypto

One of the often pointed out mistake in dealing with crypto is not having enough entropy in the system. Without enough entropy the random numbers generated are not random enough. But what I am not ...
5
votes
3answers
549 views

Hardware RNG Bias

I have generator based on sampled noise (reverse-biased transistor - actually ChaosKey but that's not that important). The noise source is fed into ADC and sampled with 16bit resolution (2 bytes). ...
2
votes
1answer
112 views

Entropy of a random message chosen by an adversary from a subdomain

Assume we have a set of random bit strings: $S=\{s_1,...,s_n\}$, where each of them is of length $\lambda$ ($s_i\leftarrow\{0,1\}^{\lambda}$). We give the set $S$ to an adversary who picks one of the ...
5
votes
1answer
211 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate]

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
-1
votes
1answer
79 views

Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...
0
votes
1answer
206 views

What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, …$?

I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...
2
votes
1answer
212 views

In the Linux Kernel 4.8+, does the CSPRNG update the entropy pool?

My understanding of how /dev/urandom works is that the kernel collects true randomness from a variety of sources, and mixes them together to remove statistical bias. It does this at regular intervals ...
6
votes
3answers
269 views

What is the entropy of a Mersenne Twister (MT)?

From Serious Cryptography: "Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit ...
8
votes
5answers
939 views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
3
votes
3answers
519 views

Why is Min-entropy significant in cryptography?

Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $ \frac{H} {H_{min}} > 10$ from any conceivable ...
2
votes
3answers
198 views

BouncyCastle style ThreadedSeedGenerator

I've written a BouncyCastle style threaded seeder and was wondering about the predictability of the data the program generates. The reason I'm not simply using BouncyCastle is because security isn't ...
4
votes
2answers
299 views

Does AES encrypting /dev/zero and feeding output to AES again increase entropy of the ciphertext?

I just thought about what would change if would pipe the output of ...
8
votes
1answer
1k views

Relation between entropy and min-entropy

I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ...
1
vote
1answer
46 views

Attack vector difference when not allowing repetitions in BIP-39

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It ...
0
votes
1answer
272 views

Key Entropy meaning Help

Can anyone help me understand key entropy the mathematics behind it and the uses for it? I understand most of it but I just want to understand what does $\log 2$ do like if I do. $\log 128 / \log 2 = ...
0
votes
1answer
106 views

Does repeated xoring of the (same) key K lower the entropy of K?

If a symmetric encryption key $K$ has been generated by some recommended (NIST for example) RBG then we should have a key with high entropy. But if we xor other bit-strings (e.g. IVs, other keys, etc....
2
votes
1answer
105 views

Some considerations about PRNGs

Recently I read about pseudorandom generators and I have some observations: My conlusion is a such that a secure implementation of a PRNG had to be blocking or returning an error code when it is too ...