Skip to main content

# Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

396 questions
Filter by
Sorted by
Tagged with
118 votes
4 answers
79k views

### How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
• 1,997
43 votes
2 answers
33k views

### What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
• 1,997
33 votes
1 answer
9k views

### Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
• 433
27 votes
5 answers
7k views

### Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
26 votes
3 answers
12k views

### How is the One Time Pad (OTP) perfectly secure?

The Wikipedia entry on One Time Pads (OTPs) states that if this cipher is used properly; ie, the keys are truly random and each part of the key is independent of every other part, it's uncrackable, ...
• 465
25 votes
2 answers
9k views

### If you hashed a hash an infinite number of times would you end up with a unique hash?

If you took a hashing algorithm for example MD5 and repeatedly passed the output hash back into the algorithm an arbitrarily large number of times would you eventually end up with one unique hash? My ...
• 353
24 votes
2 answers
11k views

### Can Shannon's entropy be used to determine if a file is encrypted?

If we have to determine a file is encrypted or not, can we use Shannon's entropy algorithm on the file? As discussed here, the entropy (in bits per byte) being closer to 0 is considered as more ...
• 6,194
20 votes
8 answers
16k views

### Password cracking: What if attacker is lucky? [closed]

We have always measured password or private key strength by the amount of entropy it contains, but what if the attacker who cracks it is lucky. Consider the following simple scenario, we have 1 bit [...
19 votes
2 answers
5k views

### A website that identifies an RNG from its output

This happened during a discussion of RNG entropy, and the difficulty of verifying the level of entropy in a long sequence of bits (e.g. a private key.) A colleague of mine told me about a website ...
• 311
18 votes
3 answers
2k views

### Why do "nothing up my sleeve numbers" have low entropy?

As a preface, forgive me for some of the links being from Wikipedia. I realize that academia frowns upon this. I came across this article about "nothing up my sleeve numbers". In it, it says: In ...
• 283
18 votes
1 answer
9k views

### Where do Windows applications get entropy from?

Where does the entropy that cryptographic .NET libraries use for encryption come from? I know with Linux you can use /dev/random, but does a similar pool exist ...
• 279
17 votes
5 answers
4k views

### Examples of frauds discovered because someone tried to mimic a random sequence [closed]

[Moderator note: this question now lives there] So, I'm preparing a talk about the well known fact that humans are bad at the task of generating uniformly random sequences of numbers when asked to do ...
• 278
17 votes
1 answer
11k views

### What to watch for with openssl generating weak keys? (low entropy)

(Disclaimer: I am regular software engineer with only basic crypto knowledge, so helpful if can be explained for a layman.) I am concerned about generating weak keys on a shared linux box with ...
17 votes
4 answers
4k views

### How is the quality of a password calculated and what does it mean?

While using Keepass and using it to generate random passwords, I always have noticed the "quality" section but truthfully have never known what it actually means. So my questions are; How much ...
• 273
15 votes
2 answers
7k views

### Calculating entropy within xkcd 936: Password Strength

When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic. So why doesn't the the first password "Tr0ub4dor&3" have an ...
• 163
15 votes
2 answers
3k views

### The effect of truncated hash on entropy

Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
• 517
15 votes
3 answers
745 views

### Turing's (still?) classified inference engine algorithm?

Does anyone know the algorithm used by Turing's Colossus inference engine, so highly classified that the Brits kept it secret for decades after WW II? Indeed, it may still be classified. Several ...
• 261
15 votes
3 answers
744 views

### Expected entropy in $P(x)\oplus x$ for random $x$, where $P$ is a random permutation

Let $P$ be a random permutation of $n>1$ bits. Let $F$ be the function on the same domain $\{0,1\}^n$, defined by $F(x)=P(x)\oplus x$. When $P$ is a block cipher with key a message block, that's ...
• 142k
14 votes
3 answers
3k views

### Entropy of two concatenated random values

In this Intel blog posting, the author claims: The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the ...
• 2,627
14 votes
4 answers
617 views

### Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
• 851
14 votes
3 answers
8k views

### Why is ciphertext from low entropy plaintext not compressible?

This comes following a discussion with a colleague. My plaintext file plain consists of a about 100,000 lines of "all work and no play...". It's size is: 2.2 MB. ...
• 293
14 votes
1 answer
4k views

### Mixing Entropy Sources by XOR?

Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ...
• 334
13 votes
3 answers
2k views

### Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
• 1,090
13 votes
3 answers
8k views

### What happens to entropy after hashing?

What happens to entropy after hashing? Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
• 183
13 votes
1 answer
1k views

### Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings:  \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto \left\{0,...
13 votes
2 answers
2k views

### Is CPU timing jitter a usable entropy source?

In some virtualized environments, the only source of entropy available is CPU timing jitter. Can one get enough entropy from this source for practical uses? Also, is this secure against local side-...
• 4,793
13 votes
3 answers
2k views

### Estimated entropy per bit given P-value of a statistical test, and number of bits tested?

Assume that a certain statistical RNG test (say from the NIST Statistical Test Suite, Dieharder, etc..) gives us a certain P-value (per the definition [*] used in NIST Special Publication 800-22), ...
• 142k
12 votes
1 answer
7k views

### Relation between entropy and min-entropy

I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ...
12 votes
1 answer
3k views

### How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
• 551
12 votes
2 answers
5k views

### Generating Encryption Keys from Biometric Fingerprint Templates

How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the ...
• 221
12 votes
1 answer
2k views

### How many bits of entropy does an elliptic curve key of length n provide?

A FAQ for an open source project makes the claim: Indeed, an elliptic curve key of length n provides $n/2$ bits of security. I have two questions: What is the practical difference between "bits ...
• 221
11 votes
1 answer
5k views

### XOR a set of random numbers

Basic question about XOR and entropy - given a set $S$ of pseudo-random numbers in the range $[0,b]$, will XORing them produce a new pseudo-random number in $[0,b]$ or will the operation decrease the ...
• 221
11 votes
5 answers
8k views

### How does generating random numbers "remove entropy from your system"?

In a previous question, I quoted the --gen-random entry in the GPG Man Pages. At the end it says: PLEASE, don’t use this command unless you know what you are ...
• 343
11 votes
2 answers
2k views

### How secure is a pronounceable password in terms of entropy?

There are some strong studies which support the use of pronounceable passwords and multiple tools which provide generation of such passwords. According to this question the entropy of a password ...
• 951
11 votes
2 answers
3k views

### Measuring entropy for a ciphertext only attack

When bruteforcing a password (e.g. the common attacks on DES), where you have ciphertext only, you need a way to assess whether a decrypted plaintext is the right one. I believe the EFF DES machine ...
10 votes
2 answers
2k views

### What is the difference between Shannon entropy and saying that tossing a 6-sided die 100 times has more than 256-bit entropy?

I'm confused. I thought that tossing a 6-sided die 100 times had a greater than 256-bit entropy because $6^{99} < 2^{256} < 6^{100}$. (A similar concept appeared in this XKCD comic, where ...
• 233
10 votes
2 answers
10k views

### Estimating bits of entropy

I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What I'm having a hard time finding is any particular literature ...
• 551
10 votes
2 answers
10k views

### Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD Yarrow,...
• 101
10 votes
1 answer
4k views

### What should be used as a source for entropy?

I have hardware-based RNG which consists of TRNG and PRNG. TRNG is giving out a 512-bit number which is being used as a seed for PRNG. RNG is generating a 160-bit random number using PRNG and ...
• 329
10 votes
1 answer
1k views

### Are there any authoritative definitions of "key stretching"?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
• 10.4k
9 votes
6 answers
3k views

### Are picture files "random enough" to be usable as a one-time pad?

Say you have a picture with 1 megapixels taken at random and with $2^{24}$ possible colours per pixel (RGB-24). That image would be unique and the possible combinations $(2^{24})^{10^6}$ immense. ...
9 votes
4 answers
2k views

### Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
• 235
9 votes
2 answers
2k views

### How feasible would it be to generate 300 million public key pairs in 8 hours?

Assume there is a hypothetical situation where one would need to generate hundreds of millions of public key pairs of reasonable strength in a limited time. What would be required in terms of ...
• 298
9 votes
2 answers
3k views

### Extracting randomness from highly-biased RNG

I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g....
• 365
9 votes
2 answers
6k views

### Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad passwords....
9 votes
3 answers
2k views

### Deterministically combine more than one source of entropy

What is the proper/canonical way to do this? For example, $0 < r1 < 1$ and $0 < r2 < 1$. Presuming uniformly distributed probabilities for the two, combining/averaging them is going to ...
• 283
9 votes
1 answer
500 views

### PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
• 523
8 votes
11 answers
5k views

### Algorithm: How to use x and y mouse movement co-ordinates to generate random data?

Background: I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for encrypting/...
• 314
8 votes
4 answers
16k views

### How hard is it to guess a 8 digit PIN?

Say that there are different live situations where you have to select own PIN numbers. Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources? Is ...
8 votes
3 answers
9k views

### Using 32 hexadecimal digits vs equivalent 16-character string password

Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file. So, for ...