Questions tagged [entropy]
Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.
399
questions
3
votes
3
answers
946
views
How can we know how good a TRNG is?
Imagine that a perfect TRNG generates 100 bits, which are then fed into a high quality PRNG such as ChaCha20, which generates 1000 bits.
How many bits of entropy is in the 1000 bits? Depends on who is ...
- 163
0
votes
1
answer
89
views
Reversing XOR operation
Consider the XOR operation,
$$A = B \oplus C$$
I know $A$ but I don't know $B$ or $C$.
Question: Can I get $B$ or $C$ from $A$ ?
- 43
2
votes
1
answer
76
views
Public Key Calculation in LMS
In RFC 8554 "Leighton-Micali Hash-Based Signatures", in section 4.3, the generation of the public key is described. The iterative hash function inputs is $I \| u32str(q) \| u16str(i) \| ...
- 1,106
-1
votes
1
answer
115
views
Password entropy, or at least establishing reasonable upper and lower bounds on it
I use, and have always used, cryptographically secure randomness as a source for my passwords. However, the final coding of that random stream into something a website will accept as a password has ...
- 406
2
votes
1
answer
103
views
Does the actual length of a password or salt provide any additional entropy to that contained within them?
I refer to the following wiki description of the Argon2 key derivation function:-
...
- 15.7k
5
votes
1
answer
232
views
Are USB TRNGs still useful given the recent /dev/(u)random merger?
I'm referencing Jason A. Donenfeld's Random number generator enhancements for Linux 5.17 and 5.18 available here. In summary:-
significant outward-facing change is that /dev/random and /dev/urandom ...
- 15.7k
3
votes
1
answer
186
views
equivalence between entropic perfect secrecy and single probability
i'm new to information theory.
I know the standard perfect secrecy definition:
$$
P(M=m|C=c) = P(M=m) ,
$$
for all $m$ and $c$, respectively the message and the cypher.
Now, i can use the entropic ...
- 33
5
votes
3
answers
958
views
Is this probability negligible?
Let $X \in \{0,1\}^{2n}$ be a uniformly distributed random string and $Y \in \{0,1\}^{2n}$ such that $H(Y) = n$.
Does this imply that $Pr(X=Y) = 2^{-n}$? If it's not, is this probability necessarily ...
1
vote
2
answers
128
views
Relation between seed entropy of a CSPRNG and the output entropy
Since Linux 5.18, the internal state of the ChaCha-based CSPRNG is a 256 bits (32 bytes) BLAKE2s hash. There is also a fast key erasure mechanism which reseeds the CSPRNG every minute (source).
I know ...
- 223
3
votes
2
answers
813
views
How much entropy is lost due to collision?
If entropy is hashed with SHA-256 for example, and the input has exactly 256 entropy bits, how much entropy is reduced after hashing due to collision? Is there any reference that explains how to ...
3
votes
1
answer
373
views
Entropy extraction from a Zener diode TRNG
My project is to build a true random number generator that relies on the avalanche effect in a Zener diode. This for a messaging device that uses one-time-pad encryption. Reading about similar ...
- 163
0
votes
0
answers
46
views
Entropy output from 256-bit Argon2 input [duplicate]
I would like to deterministically derive two different 256-bit keys from a single passphrase -- one used as an ECDSA private key, the other as a symmetric key for AES-GCM.
Would a KDF output ...
1
vote
2
answers
100
views
Should I Test A PRNG Using A Fixed Entropy Source For Its Seed?
I want to test a C implementation of Hash_DRBG—which test_demo.c file I will modify to produce random binaries indefinitely to STDOUT as to be used by piping its output—using DIEHARDER for a research. ...
- 35
3
votes
1
answer
527
views
Is there any way to measure entropy of encryption algorithms in python?
I am new to cryptography and I am trying to find a way to measure ciphertext entropy of encryption algorithms such as AES, Chacha20, etc for a school project. Is there any way to do it on Python? I ...
- 43
1
vote
1
answer
123
views
Manual entropy collection from sources with an arbitrary base
I'm writing a tool for manually collecting entropy from sources like coins and dice, and I'm wondering how to best deal with the case where the desired number of bits of entropy is not representable ...
- 13
0
votes
1
answer
61
views
How large should a seed possibility space be to generate a secure ECDSA key pair?
I have a function that generates a random 16 character length (upper + lower case letters plus numbers) seed password:
...
- 1
0
votes
2
answers
154
views
From Entropy's perspective how Encryption affects a Message?
How Ciphers, specifically, Substitution Ciphers and Transposition Ciphers manipulate the Entropy of Plaintext w/wo the aid of Entropy Source?
Reversely, how Decryption manipulates the entropy of ...
- 153
1
vote
1
answer
333
views
How strong should my password manager's master password be?
I use an offline password manager, I want to use a future proof very strong master password and I'm going to choose one of these options from the EFF's large wordlist, a randomly chosen 8 word ...
- 11
2
votes
1
answer
123
views
Alternative definition of secret sharing using entropy
I ame reading the paper "Secret-Sharing schemes: A survey" by Amos Beimel. Here there are two definitions of secret sharing.
The first one states:\
A distribution scheme $\langle \Pi,\mu \...
- 93
1
vote
0
answers
210
views
Can someone give a comprehensive guide on how to run NIST SP 800 90B entropy assessment c code in windows? [closed]
I am trying to run the github code in windows 11. I don't know what all I need to install in my laptop to run the C++ code. It would be a great help if someone can point out the steps to run the code.
- 11
3
votes
1
answer
257
views
Does PBKDF2 HMAC 512 really only produce a maximum of ~128 bits of entropy? Regardless of input?
Andreas Antonopoulos effectively states: an input of 256bits of entropy into PBKDF2-HMAC-SHA512 will ONLY output a 64 byte hash containing ~128 bits of entropy. He states the algorithm essentially ...
- 33
3
votes
2
answers
158
views
A HRNG that is NIST 800-90 compliant is not suitable for use for OTP generation right?
A HRNG that is NIST 800-90 compliant must use a DRBG in some way regardless of whether it adheres to a RBG1, RBG2 RBG3(XOR), or RBG3(RS) construction. This violates the requirement that the OTP is ...
- 65
3
votes
2
answers
761
views
Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?
NIST 800-90C defines 3 classes of random bit generation (RBG) constructions: RBG1, RBG2 and RBG3. All constructions must include a DRBG from NIST SP 800-90A. The particular construction in question is ...
- 65
3
votes
6
answers
4k
views
Would sending audio fragments over a phone call be considered a form of cryptology?
I have been wondering if sending audio fragments over a phone call would be considered a form of cryptology.
Let's say that you own two mobile phones and say that one of your phones is on the Verizon ...
user109643
1
vote
0
answers
124
views
Predicting compromised OpenSSL 3.0 DRBG
The OpenSSL 3.0 rand function's DRBG uses the getrandom() system call to get 48 bytes of secure entropy from the kernel. It also ...
- 145
5
votes
3
answers
521
views
Maximum entropy of a hash function?
Let $H(h,k)$ be the expected entropy of some random oracle $X:\left\{0,1\right\}^h \to \left\{0,1\right\}^k$, where $h$ does not necessarily equal $k$.
Then, is it true that $\lim\limits_{h\to\infty}...
- 343
2
votes
0
answers
47
views
Proving the minimal entropy of Dilithium-QROM?
I am working with the securit yof CRYSTAL's Dilithium signature in the QROM. I am working with Kiltz et al.'s approach through lossy ID-schemes and looking at the proof of minimal entropy for the $DFS[...
- 335
0
votes
0
answers
78
views
Hashing a seed full of entropy with a cryptographic hash function and emiting a key with the same size as input: can a collision attack occurs?
I read this in the documentation of HighwayHash:
By contrast, 'strong' hashes such as SipHash or HighwayHash require
infeasible attacker effort to find a hash collision (an expected 2^32
guesses of m ...
- 393
5
votes
2
answers
595
views
Conditional entropy between ciphertext, plaintext and the key
If we have a (possibly imperfect) cryptosystem that generates ciphertext $C$ from plaintext $P$ and key $K$, we have:
$H(C, P, K) = H(C | P, K) + H(P, K)$
where $H$ is entropy.
My question is why ...
- 51
3
votes
2
answers
413
views
How to calculate probability of cracking a password from entropy?
I am working on a project for my maths assessment where I research the effect of complexity and length on a given password. Currently, I am working on calculating the probability of guessing a ...
- 33
1
vote
2
answers
286
views
Entropy for TLS 1.2: how much is needed for linux servers?
I am trying to fix issues with a server where the server keeps freezing up and needs to be restarted. I recently started hearing about entropy and it importance to secure tls keys in linux. The one ...
2
votes
2
answers
961
views
Entropy of a counter
I wondered whether my understanding of entropy is correct, that a 256-bit counter that starts at 0 and counts to 2^256 - 1 by a <...
- 141
17
votes
5
answers
4k
views
Examples of frauds discovered because someone tried to mimic a random sequence [closed]
[Moderator note: this question now lives there]
So, I'm preparing a talk about the well known fact that humans are bad at the task of generating uniformly random sequences of numbers when asked to do ...
- 278
1
vote
1
answer
317
views
Can I use a cryptographic hash function such as sha256 for Randomness Extraction [duplicate]
I want to transform a semi random input to a shorter, uniformly random bit string. Assuming there is enough entropy in the semi random input, can I use a collision resistant hash function to extract ...
1
vote
1
answer
120
views
Hashing a seed together with a block counter and using as a encipherment scheme: Will this have the same security in bits as the seed used?
A user of this forum said that the whole entropy of a seed goes to the hashed result if using a counter and also that is suitable for key generation even if the internal state or digest size of the ...
- 887
1
vote
0
answers
426
views
Configuring entropy source for OpenSSL [closed]
I'm using OpenSSL 1.0.2 and FOM 2.16 and am trying to figure out a way to draw entropy from Intel (RDRAND/RDSEED) if it's available, and from the Linux OS (/dev/random or /dev/urandom) if it's not. ...
- 11
2
votes
2
answers
110
views
How does combining data affect the resulting file entropy?
If i add a password which has (X) bits of entropy as a tag to a picture which has (Y) bits of entropy, will the resulting image have an entropy equal to (X + Y) ?
How many bits of entropy i get if i ...
- 57
0
votes
1
answer
420
views
Does hashing a secret/seed make it effectively 2X less secure?
In many cryptocurrency projects I noticed that 32-byte seeds/secrets are hashed to arrive at new 32-byte keys.
The reason why is because you can then, with the addition to an index, use the same seed ...
- 303
1
vote
0
answers
100
views
Password entropy requirements for online dictionary attacks on OPAQUE?
My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
- 83
1
vote
1
answer
691
views
How to calculate entropy of a specific cryptosystem?
I want to calculate the entropy of a specific cryptosystem such as the Caesar cipher or Vernam cryptosystem etc but I don't quite understand how to do so. Any help?
5
votes
1
answer
494
views
What are the key difference between Shannon entropy and Guessing Entropy?
Any body can explain, what are the key differences between Shannon entropy and Guessing Entropy? In some research I got entropy uses binary search or balanced Huffman tree. Guesswork uses linear and ...
- 51
2
votes
1
answer
111
views
For any numbers $a, b$, what are the operators $X, Y$ such that revealing $a\ X\ b$ and $a\ Y\ b$ doesn't reveal info about $a,b$?
Previously I thought about a pair of 8-bit uniformly distributed random numbers $(a,b) \in \{0,1\}^8$, and $X$ to be bitwise XOR, $Y$ to be 8-bit addition. But it turned out that revealing $a \text{ ...
- 573
2
votes
3
answers
242
views
What does $(a+b) \bmod{256}$ and $a$ XOR $b$ reveal about $a, b$?
Say $a$ and $b$ are some uniform random $8$ bits so that the entropy of $a$ and $b$ is 8 bits each.
If I show you $(a+b) \bmod{256}$ and $a$ XOR $b$, then what can you tell about $a$ and $b$? Or how ...
- 573
2
votes
1
answer
122
views
What is the methodology for selecting symbol bit length and window size when performing Shannon Entropy Analysis?
When performing Shannon Entropy analysis on something like an RNG or a file, you must:
Select a symbol bit length and number of samples would will perform analysis on at a time (IE: windows size)
...
- 183
0
votes
1
answer
74
views
Mapping number into number with big algorithmic entropy - how to do it?
I need to parameterize some PRNG, let's assume I need 32-bit numbers. But when numbers doesn't look very random it gives bad results. The creators of SplitMix had similar problem (note that from what ...
- 1,241
3
votes
1
answer
199
views
Extractor and Min-Entropy proof
I'm following a course that speaks about cryptography. In this course we talked about Min-Entropy ($H_{\infty}$) and Extractor. To show that an extractor $Ext:\{0,1\}^n \rightarrow \{0,1\}^l$ that ...
2
votes
1
answer
2k
views
Which hashing function is good enough for session IDs?
Background
I'm building a URL shortener, and the URL to shorten may contain a SessionId.
For the URL shortener to not compromise the security of the SessionId, I must use a shortening strategy that ...
- 131
8
votes
1
answer
211
views
Where did Whitfield Diffie say "If you can make random numbers, you can have a private conversation"?
I've seen the following (alleged) quotation on this site and other places:-
If you can make random numbers, you can have a private conversation.
-Whitfield Diffie.
Yet we (Google & me) can't ...
- 15.7k
1
vote
0
answers
56
views
Could anybody help by applying a secure multiparty secret sharing scheme?
Suppose that we have a multi-secret sharing scheme as it is described in the literature
Let there be $I$ agents and say that $S$ is the space of the (uniform) random variables $s=(s_1,s_2,\cdots,s_I)\...
- 279
0
votes
1
answer
50
views
Is the Secret sharing scheme thresholds of variable of interest shared related with the entropy of the variable?
Is the $t$ out of $n$, namely $(t,n)$, threshold in the secret sharing scheme related to the entropy of the random variable that is shared according to the scheme?
What changes in the secret sharing ...
- 279