Skip to main content

Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

Filter by
Sorted by
Tagged with
118 votes
4 answers
79k views

How should I calculate the entropy of a password?

If part of the password is a whole regular English word, does the entropy of that part depend on the number of English words in existence, the number of English words known by the choosing algorithm, ...
this.josh's user avatar
  • 2,007
43 votes
2 answers
33k views

What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
this.josh's user avatar
  • 2,007
33 votes
1 answer
9k views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
Peter Smit's user avatar
27 votes
5 answers
7k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
Michael Aquilina's user avatar
26 votes
3 answers
12k views

How is the One Time Pad (OTP) perfectly secure?

The Wikipedia entry on One Time Pads (OTPs) states that if this cipher is used properly; ie, the keys are truly random and each part of the key is independent of every other part, it's uncrackable, ...
xyz's user avatar
  • 465
25 votes
2 answers
9k views

If you hashed a hash an infinite number of times would you end up with a unique hash?

If you took a hashing algorithm for example MD5 and repeatedly passed the output hash back into the algorithm an arbitrarily large number of times would you eventually end up with one unique hash? My ...
AceLewis's user avatar
  • 353
24 votes
2 answers
11k views

Can Shannon's entropy be used to determine if a file is encrypted?

If we have to determine a file is encrypted or not, can we use Shannon's entropy algorithm on the file? As discussed here, the entropy (in bits per byte) being closer to 0 is considered as more ...
sashank's user avatar
  • 6,194
20 votes
8 answers
16k views

Password cracking: What if attacker is lucky? [closed]

We have always measured password or private key strength by the amount of entropy it contains, but what if the attacker who cracks it is lucky. Consider the following simple scenario, we have 1 bit [...
cryptonoob400's user avatar
19 votes
2 answers
5k views

A website that identifies an RNG from its output

This happened during a discussion of RNG entropy, and the difficulty of verifying the level of entropy in a long sequence of bits (e.g. a private key.) A colleague of mine told me about a website ...
AJM's user avatar
  • 311
18 votes
3 answers
2k views

Why do "nothing up my sleeve numbers" have low entropy?

As a preface, forgive me for some of the links being from Wikipedia. I realize that academia frowns upon this. I came across this article about "nothing up my sleeve numbers". In it, it says: In ...
asteri's user avatar
  • 283
18 votes
1 answer
9k views

Where do Windows applications get entropy from?

Where does the entropy that cryptographic .NET libraries use for encryption come from? I know with Linux you can use /dev/random, but does a similar pool exist ...
Verbal Kint's user avatar
17 votes
5 answers
4k views

Examples of frauds discovered because someone tried to mimic a random sequence [closed]

[Moderator note: this question now lives there] So, I'm preparing a talk about the well known fact that humans are bad at the task of generating uniformly random sequences of numbers when asked to do ...
Swike's user avatar
  • 278
17 votes
1 answer
11k views

What to watch for with openssl generating weak keys? (low entropy)

(Disclaimer: I am regular software engineer with only basic crypto knowledge, so helpful if can be explained for a layman.) I am concerned about generating weak keys on a shared linux box with ...
Brian Armstrong's user avatar
17 votes
4 answers
4k views

How is the quality of a password calculated and what does it mean?

While using Keepass and using it to generate random passwords, I always have noticed the "quality" section but truthfully have never known what it actually means. So my questions are; How much ...
Shackrock's user avatar
  • 273
15 votes
2 answers
7k views

Calculating entropy within xkcd 936: Password Strength

When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic. So why doesn't the the first password "Tr0ub4dor&3" have an ...
Blafasel's user avatar
  • 163
15 votes
2 answers
3k views

The effect of truncated hash on entropy

Suppose I have a 128-bit random binary string (128 bits of entropy), then I hash it using SHA-256, then I take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
user40602's user avatar
  • 517
15 votes
3 answers
745 views

Turing's (still?) classified inference engine algorithm?

Does anyone know the algorithm used by Turing's Colossus inference engine, so highly classified that the Brits kept it secret for decades after WW II? Indeed, it may still be classified. Several ...
James Bowery's user avatar
15 votes
3 answers
744 views

Expected entropy in $P(x)\oplus x$ for random $x$, where $P$ is a random permutation

Let $P$ be a random permutation of $n>1$ bits. Let $F$ be the function on the same domain $\{0,1\}^n$, defined by $F(x)=P(x)\oplus x$. When $P$ is a block cipher with key a message block, that's ...
fgrieu's user avatar
  • 142k
14 votes
3 answers
3k views

Entropy of two concatenated random values

In this Intel blog posting, the author claims: The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the ...
user13741's user avatar
  • 2,627
14 votes
4 answers
617 views

Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
Corey Ogburn's user avatar
14 votes
3 answers
8k views

Why is ciphertext from low entropy plaintext not compressible?

This comes following a discussion with a colleague. My plaintext file plain consists of a about 100,000 lines of "all work and no play...". It's size is: 2.2 MB. ...
Bill's user avatar
  • 293
14 votes
1 answer
4k views

Mixing Entropy Sources by XOR?

Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ...
David's user avatar
  • 334
13 votes
3 answers
2k views

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner. When talking passwords however, the standard these days is ...
Minaj's user avatar
  • 1,090
13 votes
3 answers
8k views

What happens to entropy after hashing?

What happens to entropy after hashing? Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
user10988's user avatar
  • 183
13 votes
1 answer
1k views

Entropy when iterating cryptographic hash functions

Consider a cryptographic hash function that maps $n$-bit strings to $n$-bit strings: $$ \DeclareMathOperator{\H}{H} \DeclareMathOperator{\SHA}{SHA-256} \H(x) : \left\{0,1\right\}^{n} \mapsto \left\{0,...
Stephen Touset's user avatar
13 votes
2 answers
2k views

Is CPU timing jitter a usable entropy source?

In some virtualized environments, the only source of entropy available is CPU timing jitter. Can one get enough entropy from this source for practical uses? Also, is this secure against local side-...
Demi's user avatar
  • 4,793
13 votes
3 answers
2k views

Estimated entropy per bit given P-value of a statistical test, and number of bits tested?

Assume that a certain statistical RNG test (say from the NIST Statistical Test Suite, Dieharder, etc..) gives us a certain P-value (per the definition [*] used in NIST Special Publication 800-22), ...
fgrieu's user avatar
  • 142k
12 votes
1 answer
7k views

Relation between entropy and min-entropy

I understand that the entropy is the number of bits that can encode a set of messages. However, I don't understand what the min-entropy is and how it is related to entropy. Let's describe a simple ...
graphtheory92's user avatar
12 votes
1 answer
3k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
Blaze's user avatar
  • 551
12 votes
2 answers
5k views

Generating Encryption Keys from Biometric Fingerprint Templates

How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the ...
Joseph's user avatar
  • 221
12 votes
1 answer
2k views

How many bits of entropy does an elliptic curve key of length n provide?

A FAQ for an open source project makes the claim: Indeed, an elliptic curve key of length n provides $n/2$ bits of security. I have two questions: What is the practical difference between "bits ...
Rich Apodaca's user avatar
11 votes
1 answer
5k views

XOR a set of random numbers

Basic question about XOR and entropy - given a set $S$ of pseudo-random numbers in the range $[0,b]$, will XORing them produce a new pseudo-random number in $[0,b]$ or will the operation decrease the ...
avive's user avatar
  • 221
11 votes
5 answers
8k views

How does generating random numbers "remove entropy from your system"?

In a previous question, I quoted the --gen-random entry in the GPG Man Pages. At the end it says: PLEASE, don’t use this command unless you know what you are ...
camercu's user avatar
  • 343
11 votes
2 answers
2k views

How secure is a pronounceable password in terms of entropy?

There are some strong studies which support the use of pronounceable passwords and multiple tools which provide generation of such passwords. According to this question the entropy of a password ...
Habib's user avatar
  • 951
11 votes
2 answers
3k views

Measuring entropy for a ciphertext only attack

When bruteforcing a password (e.g. the common attacks on DES), where you have ciphertext only, you need a way to assess whether a decrypted plaintext is the right one. I believe the EFF DES machine ...
S. Robert James's user avatar
10 votes
2 answers
2k views

What is the difference between Shannon entropy and saying that tossing a 6-sided die 100 times has more than 256-bit entropy?

I'm confused. I thought that tossing a 6-sided die 100 times had a greater than 256-bit entropy because $6^{99} < 2^{256} < 6^{100}$. (A similar concept appeared in this XKCD comic, where ...
cryptonamus's user avatar
10 votes
2 answers
10k views

Estimating bits of entropy

I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What I'm having a hard time finding is any particular literature ...
Blaze's user avatar
  • 551
10 votes
2 answers
10k views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD Yarrow,...
Vincent's user avatar
  • 101
10 votes
1 answer
4k views

What should be used as a source for entropy?

I have hardware-based RNG which consists of TRNG and PRNG. TRNG is giving out a 512-bit number which is being used as a seed for PRNG. RNG is generating a 160-bit random number using PRNG and ...
user2363993's user avatar
10 votes
1 answer
1k views

Are there any authoritative definitions of "key stretching"?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
Henrick Hellström's user avatar
9 votes
6 answers
3k views

Are picture files "random enough" to be usable as a one-time pad?

Say you have a picture with 1 megapixels taken at random and with $2^{24}$ possible colours per pixel (RGB-24). That image would be unique and the possible combinations $(2^{24})^{10^6}$ immense. ...
youjustreadthis's user avatar
9 votes
4 answers
2k views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
pointernil's user avatar
9 votes
2 answers
2k views

How feasible would it be to generate 300 million public key pairs in 8 hours?

Assume there is a hypothetical situation where one would need to generate hundreds of millions of public key pairs of reasonable strength in a limited time. What would be required in terms of ...
Huckle's user avatar
  • 298
9 votes
2 answers
3k views

Extracting randomness from highly-biased RNG

I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g....
Kesha's user avatar
  • 365
9 votes
2 answers
6k views

Brute forcing CRC-32

I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad passwords....
S. Robert James's user avatar
9 votes
3 answers
2k views

Deterministically combine more than one source of entropy

What is the proper/canonical way to do this? For example, $0 < r1 < 1$ and $0 < r2 < 1$. Presuming uniformly distributed probabilities for the two, combining/averaging them is going to ...
Shad's user avatar
  • 283
9 votes
1 answer
500 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
user2398029's user avatar
8 votes
11 answers
5k views

Algorithm: How to use x and y mouse movement co-ordinates to generate random data?

Background: I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for encrypting/...
zuallauz's user avatar
  • 314
8 votes
4 answers
16k views

How hard is it to guess a 8 digit PIN?

Say that there are different live situations where you have to select own PIN numbers. Can someone say if it is possible to guess a 8 digit pin within 3 tries, given any methods or resources? Is ...
johnsmiththelird's user avatar
8 votes
3 answers
9k views

Using 32 hexadecimal digits vs equivalent 16-character string password

Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file. So, for ...
Hannah Vernon's user avatar

1
2 3 4 5
8