Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

Filter by
Sorted by
Tagged with
2
votes
2answers
59 views

Entropy test vs frequency analysis

I'm currently doing the cryptopals challenges and for it's first set of problems it tells you to use frequency analysis of occurring letters to determine the likelihood of a key guess being correct ...
18
votes
2answers
4k views

A website that identifies an RNG from its output

This happened during a discussion of RNG entropy, and the difficulty of verifying the level of entropy in a long sequence of bits (e.g. a private key.) A colleague of mine told me about a website ...
6
votes
2answers
780 views

How to analyze the off-by-one error's impact on the entropy of the result?

I'm reading Jean-Philippe Aumasson's book Serious Cryptography to learn more about cryptography. On page 37, the author gives an example of Cryptocat's off-by-one error in its PRNG implementation in ...
1
vote
2answers
119 views

Iterative hashing increases number of security bits?

Whatsapp uses 5200 iterations of SHA-512 over user's public key and identity according to WhatsApp Security Whitepaper. I wonder why? According to: Why iterate 5200 times when computing Safety ...
1
vote
0answers
49 views

libgcrypt and rdrand usage

for some reasons, i was looking into libgcrypt source code and found this : https://github.com/gpg/libgcrypt/blob/b64b029318e7d0b66123015146614118f466a7a9/random/rndlinux.c#L189 if i understand this ...
1
vote
2answers
101 views

Losing entropy after re-hashing a hash

Suppose you have a string AAA that was hashed with SHA1 to produce 606ec6e9bd8a8ff2ad14e5fade3f264471e82251. If I rehash ...
8
votes
4answers
7k views

How hard is it to guess a 8 digit PIN?

Say that there are different live situations where you have to select own PIN numbers. Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources? Is ...
1
vote
0answers
62 views

What is the formula to calculate password entropy? [closed]

I saw in another thread: Is using 7-8 random words from all words of a language as password a good idea? These calculations: If we assume that English has 171,476 words. Then with 8 words the ...
1
vote
1answer
24 views

Does concatinating mutliple digests of hashes from CSRN result in a CSRN?

Kind of a noob question. Suppose; We generate 1,000 cryptographic-ally secure random numbers & store each of them in an array1. For each number in this array1, we take the hash sha256(CSRN) then ...
0
votes
0answers
48 views

Computing guessing entropy (average rank of the correct key) in attack using deep learning

I am looking for help with some issues that I have about the guessing entropy (GE) in side-channel attacks context. I have read some papers where GE is used as a metric to measure the attack's ...
2
votes
1answer
161 views

Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

Encrypting with AES-256 is widely claimed to be post-quantum secure. But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a ...
2
votes
2answers
126 views

Doubt about Shannon entropy

Let's consider a random variable X that can produce the output $c$ with probability $1/4$. I was told that $-\log_{2}(\frac{1}{4})$ represents the number of bits needed to represent $c$. But, imagine ...
4
votes
2answers
249 views

What are usable entropy sources in a headless machine without /dev/random or any cryptography API?

If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?
2
votes
2answers
75 views

Given a hash function; assuming domain % codomain = 0 and uniform collision distribution; how is entropy lost by collisions (not output truncation)?

Assuming our domain and codomain both have 4 elements, the uniform distribution of inputs to outputs means the function is injective. It is widely agreed that randomly selecting a domain element ...
4
votes
2answers
151 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
1
vote
1answer
126 views

Estimate password cracking time given Shannon Entropy

Is there some algorithm that, given the Shannon entropy of a string, compute an estimation of the time that an average home computer will take to crack the password? Thank you.
0
votes
2answers
181 views

Does character encoding change entropy?

This is a question I've been wondering for a while. Technically these two strings have the same entropy I believe: ...
1
vote
1answer
75 views

What is the most secure encryption algorithm that keeps the entropy the same or even lowers it? [closed]

On top of my mind comes caesar cipher, but that is not really secure so what is the most secure encryption algorithm that doesn't affect entropy or even lowers it? I know this might not be as ...
0
votes
1answer
93 views

Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
-1
votes
1answer
85 views

What is a popular entropy source for seeding a CSPRNG, which is actually weak and unreliable? [closed]

Say I want to seed a CSPRNG. What sources are popular, but unreliable? What sources should I even use?
0
votes
1answer
74 views

How can I estimate the amount of entropy (with JavaScript) that I'm seeding a CSPRNG with?

I am trying to determine how much entropy is going into a specific CSPRNG in JavaScript, but I can't seem to find a pure-JS client-side implementation of an entropy estimator. So, I need to find a ...
0
votes
1answer
85 views

Generating nicer diceware passwords without losing entropy

Yes, another one of those "I have found a great password-generation strategy" waiting to be shot down! It seems that although diceware aims to be a secure and user-friendly password generation ...
-2
votes
1answer
104 views

If an algorithm can not produce a true random stream, then an algorithm can not alter its entropy [closed]

Can a transform lower the Kolmogorov entropy of a true random stream and then restore that stream with out loss. If not true then this means a transform can not raise or lower the entropy.
1
vote
1answer
42 views

Looking for a formula for “Given $x_1$, $\ldots$, $x_{n-1}$, the output $F(x_1,\ldots,x_n)$ is dependent of $x_n$ and is of $l$-bits security”

Suppose I have a function $F(x_1,\ldots,x_n)$, where each $x_i$ is of $l$-bits security (suppose each $x_i$ is a binary string of length $l$). At the same time, suppose there are $n$ persons, each one ...
1
vote
1answer
157 views

AES256 key entropy requirements

Is this encryption method sensitive to weak keys? Is there any reference in the NIST on the AES key's entropy? (For example, must it have been generated from a TRNG?) Can I safely use the Microsoft ...
1
vote
0answers
110 views

how to measure/calculate guessing entropy for side channel attacks

I was going through the paper (https://link.springer.com/chapter/10.1007/978-3-319-66787-4_3), and I came across where authors says that accuracy alone is not enough as an evaluation metric and ...
0
votes
1answer
147 views

Can we estimate the amount of entropy required to generate an RSA key?

Of say 4096 bits as is a default GPG master key. I can manage the first one or so almost immediately on Ubuntu. It then runs out of entropy when generating several more RSA keys, and I'm forced ...
3
votes
2answers
314 views

Yarrow and weak cryptographic keys on macOS

Given that macOS uses Yarrow as a PRNG, and Yarrow is only capable of 160 bit outputs (/dev/random on macOS is actually Yarrow) are keys generated on macOS weaker than Linux? Even BSD has switched to ...
2
votes
3answers
217 views

Does the use of English words weaken diceware passphrases [duplicate]

A Diceware passphrase is constructed from a set of words chosen from a 7776-word database, using five dice throws to choose each word. The argument is that each word in the phrase adds about 12.92 ...
4
votes
3answers
256 views

Can a deck of cards be used as a practical source of cryptographic randomness?

This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards. The ...
2
votes
3answers
166 views

Can adding bad entropy to good entropy, make a system insecure?

For example, If I needed to generate a random number. I use a good source of entropy to generate r. Then I add values a, <...
2
votes
2answers
192 views

PBKDF and Entropy

We all regularly use password based, key derivation functions, however something that strikes me as counter intuitive is how PBKDF can somehow "stretch" the entropy of a supplied password to generate ...
3
votes
1answer
205 views

Von Neumann Extractor - Which bit is retained?

Which bit is retained in the Von Neumann debiasing algorithm? 00 and 11 are discarded and 10, 01 are retained but is the first or the second bit retained or does it matter? In other words: first: ...
1
vote
1answer
145 views

deterministic uuidv4 -> uuidv4

I need to copy a graph of elements with uuidv4s each, and separately stored relations containing element uuidv4s. On copy, I ...
2
votes
2answers
133 views

Monotonicity of min-entropy

Let $Z^t = (Y_1,\ldots,Y_t)$ be a sequence of random variables each taking values in $Y$. The random variables are not necessarily i.i.d but we know the joint distributions. i.e for every $z = (z_1,......
2
votes
1answer
125 views

Registration Code Entropy

I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system. The registration ...
0
votes
2answers
136 views

Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put ...
2
votes
2answers
192 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
2
votes
1answer
131 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
3answers
348 views

Low entropy - how does it compromise the crypto

One of the often pointed out mistake in dealing with crypto is not having enough entropy in the system. Without enough entropy the random numbers generated are not random enough. But what I am not ...
5
votes
3answers
593 views

Hardware RNG Bias

I have generator based on sampled noise (reverse-biased transistor - actually ChaosKey but that's not that important). The noise source is fed into ADC and sampled with 16bit resolution (2 bytes). ...
2
votes
1answer
115 views

Entropy of a random message chosen by an adversary from a subdomain

Assume we have a set of random bit strings: $S=\{s_1,...,s_n\}$, where each of them is of length $\lambda$ ($s_i\leftarrow\{0,1\}^{\lambda}$). We give the set $S$ to an adversary who picks one of the ...
5
votes
1answer
217 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate]

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
-1
votes
1answer
98 views

Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...
0
votes
1answer
266 views

What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, …$?

I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...
2
votes
1answer
258 views

In the Linux Kernel 4.8+, does the CSPRNG update the entropy pool?

My understanding of how /dev/urandom works is that the kernel collects true randomness from a variety of sources, and mixes them together to remove statistical bias. It does this at regular intervals ...
6
votes
3answers
285 views

What is the entropy of a Mersenne Twister (MT)?

From Serious Cryptography: "Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit ...
8
votes
5answers
959 views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
3
votes
3answers
598 views

Why is Min-entropy significant in cryptography?

Let $H_{min}$ = Min-entropy and $H$ = Shannon entropy. Unless you're gaming the system or deliberately trying to be obtuse, very rarely is $ \frac{H} {H_{min}} > 10$ from any conceivable ...
2
votes
3answers
205 views

BouncyCastle style ThreadedSeedGenerator

I've written a BouncyCastle style threaded seeder and was wondering about the predictability of the data the program generates. The reason I'm not simply using BouncyCastle is because security isn't ...

1
2 3 4 5 6