Skip to main content

Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

Filter by
Sorted by
Tagged with
1 vote
1 answer
92 views

Attack vector difference when not allowing repetitions in BIP-39

We are using a 12-word scheme BIP-39 mnenemonic key generating scheme that creates an entropy of 128-bit that is then used to generate a seed that in turn derives a private key for the user. It ...
shredding's user avatar
  • 115
0 votes
1 answer
481 views

Key Entropy meaning Help

Can anyone help me understand key entropy the mathematics behind it and the uses for it? I understand most of it but I just want to understand what does $\log 2$ do like if I do. $\log 128 / \log 2 = ...
Holy Gaming Empire's user avatar
0 votes
1 answer
374 views

Does repeated xoring of the (same) key K lower the entropy of K?

If a symmetric encryption key $K$ has been generated by some recommended (NIST for example) RBG then we should have a key with high entropy. But if we xor other bit-strings (e.g. IVs, other keys, etc....
Red Book 1's user avatar
  • 1,025
2 votes
1 answer
144 views

Some considerations about PRNGs

Recently I read about pseudorandom generators and I have some observations: My conlusion is a such that a secure implementation of a PRNG had to be blocking or returning an error code when it is too ...
Gilgamesz's user avatar
  • 123
5 votes
2 answers
1k views

Consuming of entropy

When I put: sudo watch tail /proc/sys/kernel/random/entropy_avail && dd if=/dev/random of=/dev/zero It shows that available entropy is "consumed". What ...
Carol's user avatar
  • 163
1 vote
1 answer
127 views

Pseudo-random generators and pitfalls

I've read the Chapter "Randomness" from the Serious Cryptography book and it raised some questions. Namely: It is written that Mersenne Twister is proved to be cryptographically irreliable. And that ...
Carol's user avatar
  • 163
15 votes
2 answers
7k views

Calculating entropy within xkcd 936: Password Strength

When I calculate entropy for the xkcd Password Strength (comic 936) I don't get nearly the amount of entropy stated in the comic. So why doesn't the the first password "Tr0ub4dor&3" have an ...
Blafasel's user avatar
  • 163
2 votes
1 answer
82 views

The quantum key establishment protocol

Consider the quantum key establishment protocol. Assume that bit values, emitter basis, and receiver lter orientation are selected independently and uniformly at random (i.e., 50% chance for each of ...
Ashley Watson's user avatar
1 vote
0 answers
876 views

On Linux, seeding /dev/urandom does not unblock /dev/random, causing libsodium to hang? [closed]

Edit for clarity: Does the "standard" test for initialization of the Linux non-blocking entropy pool, by attempting to read 1 byte from /dev/random, ignore seeding of /dev/urandom from file at boot, ...
jksd's user avatar
  • 21
1 vote
1 answer
2k views

Perfect Secrecy prove

There was a question on my final exam, but I could not get a point. I really want to know the right answer. Question is: Suppose a cryptosystem has perfect secrecy. Prove that H(P|C) = H(P) H(...
M.J.Watson's user avatar
2 votes
3 answers
2k views

Shannon entropy of string, not same in Binary form? But just as good as a password?

This string, "Au+u1hvsvJeEXxky" has a Shannon entropy of 3.75 and a length of 16. The binary form of the string ( derived from Ascii-table ) is: 01000001 01110101 ...
joop s's user avatar
  • 93
2 votes
0 answers
78 views

How to envision entropy concentration in HKDF "extract" stage?

RFC 5869: Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, ...
Cyker's user avatar
  • 729
4 votes
2 answers
542 views

Usage and limitations of sponge functions for PRNG

This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge ...
jans's user avatar
  • 287
7 votes
3 answers
2k views

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

In this question about hardware random number generator, a discussion about the following question has been started: In order to test RNG's and entropy's quality, should test suites like ENT and ...
jans's user avatar
  • 287
0 votes
1 answer
889 views

Explaining entropy

Introductory Chemistry course, non-science majors. I am trying to explain entropy without using the word randomness. Example: a deck of 52 cards has multiple states of card order. That we may like a ...
George's user avatar
  • 17
6 votes
2 answers
769 views

NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track. Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output: ...
OliverJL's user avatar
3 votes
1 answer
199 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
asmiller's user avatar
  • 133
0 votes
2 answers
417 views

Is a cryptographic key of size $N$ equivalent to $N$ bits of entropy?

Are there any caveats to the claim that a cryptographic key of size $N$ bits and $N$ bits of entropy are equivalent?
matthewaveryusa's user avatar
5 votes
2 answers
702 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
Paul Uszak's user avatar
  • 15.5k
-2 votes
3 answers
2k views

How to interpret the entropy results for a NIST test file?

There is test data derived from pi that is supplied by NIST for validating their entropy measurement formulae listed in NIST's Recommendation for the Entropy Sources Used for Random Bit Generation. ...
Paul Uszak's user avatar
  • 15.5k
-3 votes
1 answer
900 views

Do the NIST tools on GitHub measure entropy reliably? [closed]

There is a supposed NIST tool called SP800-90B_EntropyAssessment on that Git thing. It's designed to be used in accordance with NIST's Recommendation for the Entropy Sources Used for Random Bit ...
Paul Uszak's user avatar
  • 15.5k
1 vote
3 answers
1k views

How to deterministically generate a 256 bit ECC key from 128 bits of entropy without a CSPRNG

A safe way to generate a 256 bit ECC key from 128 bits of entropy is to use a CSPRNG, according to this answer: https://crypto.stackexchange.com/a/56551/43864 However, it's difficult to find a cross ...
knaccc's user avatar
  • 4,740
1 vote
2 answers
602 views

Purpose of folding a digest in half

The Linux kernel's random driver generates randomness by hashing an entropy pool using SHA-1. From the driver's source, the SHA-1 hash is apparently folded in half before being returned: ...
forest's user avatar
  • 15.3k
4 votes
2 answers
1k views

Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key? I assume this is because 256 bit ...
knaccc's user avatar
  • 4,740
1 vote
3 answers
613 views

Strictly, is length(key) >= length(message) wrong for one time pads?

It's a common adage that for a perfectly secret one time pad, length(key) >= length(message) must hold. But that's wrong isn't it? At least very sloppy maths. Isn't the strict mathematical ...
Paul Uszak's user avatar
  • 15.5k
0 votes
1 answer
137 views

Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!) I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be ...
Therac's user avatar
  • 293
3 votes
4 answers
469 views

How many bits of entropy are leaked for every derived password from a master?

Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password? Let's take an ...
Kristopher Ives's user avatar
0 votes
1 answer
70 views

Security of seed from a dictionary

How do you calculate the total amount of combinations in the standard 12-word seed from a 2048 word dictionary? $log_2(2048^{12})$ which equals $2^{132}$? Is this the right way? And what is the "...
NetCoder's user avatar
2 votes
1 answer
855 views

Salt and pepper at both client and server sides?

Putting aside that it may sound paranoid. I know that many users tend to use the same password on many sites. Then, from an ethical point of view, I should not only be concerned about security breaks ...
ESL's user avatar
  • 123
2 votes
0 answers
122 views

Entropy of the union of two sources [closed]

I am given that $S_1=(S_1,P_1)$ and $S_2=(S_2,P_2)$ are sources, where $S_1=\{s_1,...,s_n\}$, $P_1(x_i)=p_i$ and $S_2=\{y_1,...,s_m\}$, $P_2(y_j)=q_j$. I have to find the entropy of $S_{\lambda}=(S_i ...
Silvia Rossi's user avatar
0 votes
2 answers
328 views

Can I generate same random number given same entropy value?

Given the hypothetical fact that I can predict the same entropy value used to generate a random number, can I generate the same random value, say in a Windows based python application?
Henok Yemane's user avatar
1 vote
2 answers
92 views

Are there any key exchange schemes that only require entropy on one side?

Are there any cryptographically secure (in terms of confidentiality) key exchange schemes which are usable if one partner in the connection is entirely deterministic and has absolutely no entropy? I ...
forest's user avatar
  • 15.3k
3 votes
1 answer
2k views

How can I calculate the entropy of an image? [closed]

I am searching how can I calculate the entropy of a image for a Capture The Flag. I know what is the entropy theory and I tried a pair of things: Convert the jpg image on binary image and calculate ...
Iratzar Carrasson Bores's user avatar
0 votes
1 answer
69 views

entropy calculation in data wiping

Can entropy being used as data removal verification in data wiping ? How we can implement the entropy calculation in a data wiping tool? The wiping tool will used overwriting method using single pass.
samihah kashfi's user avatar
3 votes
2 answers
758 views

RNG failing Restart Tests by NIST SP800-22?

I have data sample of 1,000,000 bytes generated by a hardware RNG. The device is certified by ENT test suite, NIST SP800-22, DIE HARDER and TestU01. I have tested my sample by SP800-...
R. Sam's user avatar
  • 389
-1 votes
2 answers
719 views

Is it possible that the entropy of a cipher system to be zero or infinite?

Entropy defined in cipher system as a measure of information or uncertainty. Is it possible to be zero or infinite? What would it mean based on Entropy formula: $$H(X)=-\sum_{x \in X} P(x) \log_2{P(...
partizanos's user avatar
3 votes
1 answer
564 views

Enumerating the bias of NIST and Pearson randomness extractors

The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
Paul Uszak's user avatar
  • 15.5k
2 votes
3 answers
643 views

Conditioning Component in Entropy Source

Given a sample of random bytes, how to determine if Entropy Source (source of random bytes) includes a Conditioning Component or not, with respect to NIST SP 800-90 B)? Thanks
R. Sam's user avatar
  • 389
3 votes
1 answer
697 views

Cracking a key using a combination of partial keys

As part of a cryptanalytic attack I've carried out, I used a divide-and-conquer strategy to divide the secret key $k$ into several equal-sized partial keys $k = {k_1, k_2, ...}$. The attack works ...
Ricardo M.'s user avatar
0 votes
1 answer
872 views

Entropy Rate of Bit String [closed]

How to calculate "Entropy Rate" of a bit string? Does "NIST Randomness Test Suite" provide any test to measure Entropy of an entropy source? How to check "biased-ness" of a bit string? Thank you in ...
R. Sam's user avatar
  • 389
1 vote
2 answers
317 views

Entropy after shuffling result of /dev/urandom

first of all: Im pretty paranoid. I am creating a seed on my linux server using the following command: cat /dev/urandom |tr -dc A-Z9|head -c${1:-81} Since I don´...
Leif's user avatar
  • 13
7 votes
2 answers
432 views

Diode vs quantum computer

Consider everyone's favourite pseudo random number generator, RANDU where V is the output of any successive iteration. $$ V_{j+1} = 65539 \cdot V_j \; mod \; 2^{31} $$ I've purposefully chosen ...
Paul Uszak's user avatar
  • 15.5k
8 votes
3 answers
9k views

Using 32 hexadecimal digits vs equivalent 16-character string password

Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file. So, for ...
Hannah Vernon's user avatar
8 votes
3 answers
3k views

If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?

If one were to create a SHA256 hash using 256 coin flips converted to hex (which, as I understand it, is as "entro-phized" as one can capture in SHA256) then take that hash as a string, combine that ...
travisjd's user avatar
0 votes
1 answer
258 views

Multi-Embedded Xor for Perfect OTP

I am looking for a perfect OTP design, so let's see if this design is good. There are 2 issues when it comes to a good OTP system, the key and the plaintext, we will use XOR as cypher: If the ...
cryptonoob400's user avatar
9 votes
2 answers
3k views

Extracting randomness from highly-biased RNG

I have a source with a very low entropy (like 3 entropy bits per 1024 source bits). But I need to construct a 128 bit seed from the source. Will it be helpful to XOR 350 bits with jump 128 bits, e.g....
Kesha's user avatar
  • 365
6 votes
3 answers
2k views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...
dt_slash's user avatar
  • 105
0 votes
2 answers
4k views

How much entropy do you need for a secure certificate generation?

So in OpenSSL you have the -engine tag for inputting your own entropy as a source for generating whatever. So if you wanted to generate a 2048-bit RSA certificate ...
Richard R. Matthews's user avatar
11 votes
1 answer
5k views

XOR a set of random numbers

Basic question about XOR and entropy - given a set $S$ of pseudo-random numbers in the range $[0,b]$, will XORing them produce a new pseudo-random number in $[0,b]$ or will the operation decrease the ...
avive's user avatar
  • 221
3 votes
2 answers
1k views

Password Entropy in bits for passwords of a certain structure

I have read this post and this post about how best to calculate a pseudo accurate entropy in bits of a password. I can do this fine for passwords of a uniform nature, such as 8 letters of an a-z range ...
Martin's user avatar
  • 135

1 2 3
4
5
8