Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

Filter by
Sorted by
Tagged with
8
votes
1answer
3k views

What should be used as a source for entropy?

I have hardware based RNG which consists of TRNG and PRNG. TRNG is giving out 512 bit number which is being used as seed for PRNG. RNG is generating 160 bit random number using PRNG and reseeding is ...
8
votes
1answer
291 views

Better lower bound on min-entropy

In “Randomness Condensers for Efficiently Samplable, Seed-Dependent Sources” by Dodis, Ristenpart, and Vadhan (PDF), I have seen the statement that: any tuple of distributions $(X,Z)$ is $\...
8
votes
1answer
1k views

Entropy estimation by Linux Kernel when adding entropy from TRNG

As per resources given below, after adding the bits to entropy pool, the Linux RNG estimates the amount of entropy for "credit_entropy_bits" function. It is estimating the amount of entropy of an ...
8
votes
5answers
1k views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
7
votes
2answers
448 views

Has human-generated entropy ever been a real problem?

I know the topic of human brains generating random numbers has been discussed here and in Cognitive Sciences before, but I am interested in a particular part of it: In an introductory book to ...
7
votes
3answers
1k views

Perform ENT / Dieharder on raw entropy or on whitenened entropy?

In this question about hardware random number generator, a discussion about the following question has been started: In order to test RNG's and entropy's quality, should test suites like ENT and ...
7
votes
2answers
360 views

Diode vs quantum computer

Consider everyone's favourite pseudo random number generator, RANDU where V is the output of any successive iteration. $$ V_{j+1} = 65539 \cdot V_j \; mod \; 2^{31} $$ I've purposefully chosen ...
6
votes
3answers
5k views

Using 32 hexadecimal digits vs ASCII equivalent 16-character password

Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long. The string will be used as a passphrase when encrypting a file. So, for ...
6
votes
4answers
847 views

Are there any practical ways to transfer random data securely?

The owner of the random.org service recommends that you do not use randomly generated numbers from their website in cryptographic keys. This makes sense, but it got me wondering. Is it possible to ...
6
votes
2answers
818 views

How to analyze the off-by-one error's impact on the entropy of the result?

I'm reading Jean-Philippe Aumasson's book Serious Cryptography to learn more about cryptography. On page 37, the author gives an example of Cryptocat's off-by-one error in its PRNG implementation in ...
6
votes
2answers
2k views

How can a poor RNG impact security?

I have read this article and I do somehow "understand" that the reduction of entropy makes it easier to guess. But how exactly can the security be reduced by that? Can you give a concrete scenario, ...
6
votes
2answers
898 views

Is my password entropy calculation correct?

I have a password with a prescribed format: 111 + (2 Random lowercase letters) + (random digit) As you can see, it starts with a fixed value of ...
6
votes
3answers
1k views

Is this a good entropy collector and whitening technique?

I'm just reviewing a program someone wrote to provide high quality random data using an entropy collector and a hash based whitening technique. I'll try summarize the process: Collect entropy from ...
6
votes
1answer
25k views

Calculation of time to crack a SHA-256 hash

A problem is given: 1 million users are authenticated with 9-digit PIN codes (e.g. 343534643). The PIN values are stored as hash values in a database. The hash is SHA-256, and is computed as: ...
6
votes
2answers
1k views

Is there a secure source of entropy on a typical microcontroller?

On a device that does not have a hardware RNG, what is the best source for entropy? Some options and pitfalls floating around: Use the ADC to read something analog: can become deterministic if ...
6
votes
2answers
2k views

When using HMAC, does key encoding matter?

Given: H is a good hash function with block size L. K is a key of length >= L (recommended by RFC 2104). Khex and Kbase64 are ASCII encodings of K. In the HMAC algorithm, is there a good reason to ...
6
votes
2answers
3k views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
6
votes
1answer
2k views

What happens to the entropy of a password when you hash it?

For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?
6
votes
1answer
324 views

Why does entropy halve during its extraction?

It is common to use cryptographic hash functions to extract randomness from entropy sources. One of the quantitative criteria for this is that if 2n bits of entropy are put through a hash, n bits of ...
6
votes
2answers
1k views

Random Number Generation with a Entropy pool versus Seed

To give a little background I'm currently implementing a crypto library in JavaScript. I have started porting across Linux's random number generator because its both publicly scrutinized, it is open-...
6
votes
2answers
714 views

Using chi square for distinguishing between compressed and random data

I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely ...
6
votes
3answers
310 views

What is the entropy of a Mersenne Twister (MT)?

From Serious Cryptography: "Entropy is maximized when the distribution is uniform because a uniform distribution maximizes uncertainty: no outcome is more likely than the others. Therefore, n-bit ...
6
votes
1answer
1k views

Will hashing over and over eventually give the same hash?

There are many cases in maths where doing the same thing over and over again will bring you closer to a value. Derivation of polynomials is the striking example: no matter what you start with, you end ...
6
votes
2answers
478 views

Secure entropy extractor for thermal noise collected from camera input?

I have read this paper (pdf) which talks about measuring the entropy of thermal noise collected from camera input. They estimate the minimum entropy at about 4 bits per pixel. Probably estimating 1 ...
6
votes
1answer
214 views

Weakness of Hash_DRBG when entropy is mixed in gradually

NIST SP800-A states (Appendix C p. 89): There are known problems with Hash_DRBG when the DRBG is instantiated with insufficient entropy for the requested security strength, and then later ...
5
votes
3answers
1k views

What are the dangers of using CPU clock drift for generating random data?

From what I understand, a physical source of true randomness could be achieved with a multi-core processor, by using clock drift between two or more cores. However, a processor is easier to ...
5
votes
2answers
552 views

Feedback on rolling my own entropy gatherer

First of all, I don't recommend doing this. This was something I created when I didn't know better and didn't have a solution available to me. Long ago I created my own entropy gather for a ...
5
votes
4answers
1k views

Bits of entropy needed to choose a random element from a list?

Suppose I want to choose a random element from a list of size $2^n$, for any integer $n$. (Here, random is to mean an equal probability of selecting every item.) My intuition says I'd need $n$ bits of ...
5
votes
2answers
942 views

Consuming of entropy

When I put: sudo watch tail /proc/sys/kernel/random/entropy_avail && dd if=/dev/random of=/dev/zero It shows that available entropy is "consumed". What ...
5
votes
2answers
296 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
5
votes
4answers
1k views

Stretching a random seed to maximize entropy

I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization. I've gathered entropy from various system metrics (free memory, ...
5
votes
2answers
1k views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
5
votes
3answers
2k views

If a SHA256 hash with high entropy is then hashed with one made from low entropy, is the resulting hash higher/same/lower entropy?

If one were to create a SHA256 hash using 256 coin flips converted to hex (which, as I understand it, is as "entro-phized" as one can capture in SHA256) then take that hash as a string, combine that ...
5
votes
2answers
422 views

implementing GCM with dev/urandom for a nonce

I'm currently trying to integrate GCM into my code, and I have just enough knowledge to know I'm probably doing this wrong. I know for GCM and other CTR like ciphers, using the same key with the same ...
5
votes
2answers
200 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
5
votes
1answer
229 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate]

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
5
votes
2answers
2k views

Entropy measurement from shuffled cards

A standard deck of $52$ shuffled playing cards can be used as a source of randomness. Assuming cards are not replaced as they're drawn, a full deck of cards provides $225.58$ bits of entropy $- 52!$ ...
5
votes
2answers
1k views

How much entropy is generated by 'random' human keystrokes?

I'm wondering about using human input as an entropy generator. We all know humans are terrible at making up random numbers or keys or passwords. But what if we let a user 'randomly' type in some ...
5
votes
3answers
631 views

Hardware RNG Bias

I have generator based on sampled noise (reverse-biased transistor - actually ChaosKey but that's not that important). The noise source is fed into ADC and sampled with 16bit resolution (2 bytes). ...
5
votes
2answers
325 views

What is the relationship between entropy conditioning and final output bias in a TRNG?

This question concerns the conditioning and output of true random number generators. It refers to NIST Special Publication 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It ...
5
votes
1answer
306 views

Is the concept of provably secure hash the same as entropy smoothing hash functions?

Is the concept of provably secure hash the same as entropy smoothing hash functions? In the tutorial Sequences of Games: A Tool for Taming Complexity in Security Proofs V. Shoup shows us a proof of ...
5
votes
3answers
978 views

Noisiest RF band for random number generation

I've been looking into the difference between PRNGs and proper RNG techniques. One that I particularly like is the idea of tuning a radio to a certain frequency and bandwidth and just listening to the ...
5
votes
2answers
441 views

NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track. Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output: ...
5
votes
1answer
168 views

estimating entropy/randomness as fail-safe mechanism

Real-world encryption systems are often not broken algorithmically but because the implementation has a bug. Sometimes the bug only happens in circumstances that could not have been foreseen, such as ...
5
votes
0answers
156 views

Reusing same source for single-source randomness extractor

Let $ext$ be a single-source randomness extractor which takes a $d$-bit seed and a $n$-bit source as input and produces a $m$-bit output. Suppose we have a source $X$ with min-entropy $k$. Is it ...
5
votes
1answer
777 views

Entropy of Androids motion-sensor data

My app on Android uses the built-in motion sensors to collect seed-data for the PRNG (java.security.SecureRandom) that is later to be used for key-generation. The user is told to shake the device so ...
4
votes
2answers
812 views

Tests on /dev/urandom entropy can be considered useful or not?

i want to test the entropy of my seed generator: in my case is /dev/urandom. I've read that this operation is non useful because it is the result of CSPRNG (normally not accessible). But what i ...
4
votes
2answers
1k views

Is it secure to concatenate two 16-bit random numbers into a 32-bit one?

I'm working on a security application for RF modules aimed to protect a communication between an autarkic sensor and a line-powered receiver against MITM (man-in-the-middle attacks). I decided to use ...
4
votes
2answers
377 views

Entropy Requirements for Encryption

Quality of RNGs is an important issue. As a very basic question I would like to understand, how "poor" entropy of a RNG can help an attacker to find out the whole secret. In my naive view, even is ...
4
votes
1answer
259 views

Given enough length, which string of symbols will have the greatest entropy?

Which arbitrarily long string will have the greatest entropy? A string constitued of random letters, with each letter having a probability of being picked equal to its frequency of apparition in the ...

1
2
3 4 5
7