Questions tagged [entropy]

Entropy is a measure of how predictable the outcome of a random process is, or how much uncertainty one has about an unknown quantity in one's state of knowledge, defined in terms of the probability distribution on possible outcomes or quantities.

Filter by
Sorted by
Tagged with
4
votes
2answers
1k views

Chopping off SHA-256 entropy?

I have a NoSQL key-value database. I want to insert couple million of records to it. For the key generation, I'm, using a prefix (something like data-one-) and ...
4
votes
1answer
2k views

Exhausting the entropy of a hash function

In the case of password storage, consider the following: I have an idea that one can exhaust the entropy of input to the MD5 function by using a 128 bit random value as the password (indeed, any hash ...
4
votes
2answers
371 views

Does AES encrypting /dev/zero and feeding output to AES again increase entropy of the ciphertext?

I just thought about what would change if would pipe the output of ...
4
votes
2answers
649 views

Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key? I assume this is because 256 bit ...
4
votes
1answer
369 views

Can key hardening compensate lack of entropy?

In the context of an offline brute-force attack on encrypted data at rest (say, a password-protected AES encrypted file), is a password with 64 bits of entropy and 65536 rounds of key hardening just ...
4
votes
3answers
315 views

Can a deck of cards be used as a practical source of cryptographic randomness?

This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards. The ...
4
votes
2answers
2k views

Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
4
votes
2answers
154 views

Are the GPS coordinates a good source of entropy?

Are the GPS coordinates (latitude and longitude) a good source of entropy? If yes, why? If no, why? The question would investigate on the fact if the GPS location data can be used as source of entropy ...
4
votes
2answers
279 views

What are usable entropy sources in a headless machine without /dev/random or any cryptography API?

If I have a headless machine (no mouse movements, no keyboard presses, or user input), without any cryptography CSPRNG APIs, where can I collect entropy from?
4
votes
1answer
412 views

Are the first 4 bytes of a Ed25519 public key random?

We are using the Ed25519 signature scheme (which uses Curve25519). A key pair is generated by generating the secret key from random data and then computing the 32-byte (256-bit) public key from said ...
4
votes
1answer
121 views

Relationship between the use of a mask and entropy

This is part of an assignment and I'm not sure what conclusion I'm supposed to draw from the result. We were supposed to generate two 1024 bytes words, one using an algorithm that randomly generate 0 ...
4
votes
1answer
150 views

Strength of key derived from a hash function considering the birthday attack

When a hash function is used to derive a key from a shared secret (either by simply hashing the shared secret or using a more robust construct like HKDF) what's the strength of the derived material? ...
4
votes
1answer
968 views

How to handle entropy and CTR DRBG for TLS on embedded system?

I am trying to use mbedTLS on a STM32-Nucleo microcontroller (STM32F746). The TLS library wants a RNG function (naturaly), the STM32 has a hardware RNG verified according to NIST SP 800-22. The ...
4
votes
2answers
7k views

TRNG vs PRNG - Entropy?

How much more entropy gives a Hardware Random Number Generator or True Random Number Generator compared to a Pseudo Random Number Generator? I know it depends on which TRNG is used, but I'm thinking ...
4
votes
2answers
2k views

How many bits of entropy can I expect from /dev/urandom in iOS?

Apple's latest security documentation indicates that it now uses CTR_DRBG for generating pseudo-random numbers (previously Yarrow instead of CTR_DRBG), using "timing variations during boot" and "...
4
votes
1answer
168 views

Entropy Loss of KDFs

Am I losing any entropy when using KDFs, such as the ones in NIST Special Publication 800-108? For example, can I derive 128-bit session keys from a (uniformly random) 128-bit master key?
4
votes
1answer
1k views

Entropy test for AES Key Schedule

According to the article "Lest We Remember: Cold Boot Attacks on Encryption Keys" there is a quick and dirty entropy test that can help to find possible AES Key Schedules in memory dumps. Although ...
4
votes
2answers
1k views

Using an RSA private key simultanously as an AES encryption key to generate random numbers?

Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
3
votes
2answers
2k views

Generating unbiased numbers with a biased six sided die?

Eve takes a fair six-sided die and adds some heavy paint to the side of the die with the 6 on it. This results in a biased die that rolls a 6 with probability 2/7, and each other number (1-5) with ...
3
votes
2answers
478 views

Meaning of entropy of a bitstring in NIST SP 800 - 90A

From NIST SP 800 - 90A from January 2012 (see http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf), page 6: For the purposes of this Recommendation, an n-bit string is said to have ...
3
votes
2answers
1k views

Physical entropy source: How many bits entropy per byte is sufficent?

8 bit / byte would be perfect obviously. head -c 1M /dev/urandom | ent gives ~ 7.9998 bits per byte. Now, if I have a physical entropy source, how much entropy ...
3
votes
4answers
302 views

How many bits of entropy are leaked for every derived password from a master?

Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password? Let's take an ...
3
votes
2answers
387 views

How to prove a symmetric encryption scheme provides perfect secrecy?

I learned in class that in order to achieve perfect secrecy, the source of the plaintext $\mathcal{P}$ needs to be independent from the source of the encryption key $\mathcal{K}$. We also learned that ...
3
votes
1answer
6k views

How to accurately calculate Unicity Distance for English?

The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 ...
3
votes
2answers
461 views

Is just a bit of random, “fully random”?

I understand that hashing a datetime is a pseudo-random number, and not good in a security context. But what about hashing a datetime plus a truly-random but constant string (just a string that an "...
3
votes
2answers
126 views

How much entropy do I need to add to passwords if they are NOT used in conjunction with logins

I'm building a system to authenticate users to a website via a single use login token. This token can either be included in links OR typed in directly by the user as a code. Because of that second ...
3
votes
3answers
288 views

Usage and limitations of sponge functions for PRNG

This HRNG uses SHA3 as a sponge function (in its device driver) to inflate ots raw source output to many MByte/s. They compare this output rate to the output of other HRNG which don't use a sponge ...
3
votes
3answers
191 views

Is a large random number cryptographically equivalent to the product of multiple smaller ones?

Say I create a 256-bit key by taking a random number between $0$ and $2^{256}-1$. Would it be cryptographically equivalent to generate $8$ numbers $r_1\dots r_8$ between $0$ and $31$, and combining ...
3
votes
2answers
596 views

Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key?

Since ECC over P-256 provides only 128 bits of security, I'd like to cut corners and generate a private key using HKDF to generate 32 bytes of key material from an input secret that's only 16 bytes ...
3
votes
1answer
2k views

Entropy calculation

I calculated the entropy for "variable", "property" and their concatenation "variableproperty" (with e.g. the Shannon Entropy) and got $2.75, 2.5$ and $3.33$ respectively. These are all entropy per ...
3
votes
2answers
347 views

Yarrow and weak cryptographic keys on macOS

Given that macOS uses Yarrow as a PRNG, and Yarrow is only capable of 160 bit outputs (/dev/random on macOS is actually Yarrow) are keys generated on macOS weaker than Linux? Even BSD has switched to ...
3
votes
2answers
1k views

Password Entropy in bits for passwords of a certain structure

I have read this post and this post about how best to calculate a pseudo accurate entropy in bits of a password. I can do this fine for passwords of a uniform nature, such as 8 letters of an a-z range ...
3
votes
2answers
593 views

Detecting the amount of entropy used for random number generation

I am majoring in computer science but I have recently become obsessively interested in information theory and cryptography. I have read some articles about entropy and random number generators. I ...
3
votes
1answer
1k views

How to calculate entropy of a combined key

I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys $X$...
3
votes
2answers
166 views

Formula for bits of entropy per bit, when combining bits with XOR

Assume that bits $A$ and $B$ each have .5 bits of entropy per bit. The two-bit result of the concatenation $A‖B$ has 1 bit of entropy total, and it retains the entropy density of .5 bits of entropy ...
3
votes
1answer
101 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
3
votes
2answers
406 views

Will entropy be lost by using a DRBG?

Lets assume we have a DRGB (deterministic random bit generator) which is seeded by a good true RBG (random bit generator). Before any bit has been read from the DRBG, the entropy is clearly the number ...
3
votes
1answer
215 views

Is it possible to reverse the birthday attack calculation?

I find that for every 100 password salts in our database, we only average 94.73 distinct salt values (averaged over a total of around 18 million). Is there a way to take that observation and calculate ...
3
votes
1answer
231 views

Is this JS library using openssl genrsa -rand improperly?

pem, a JS wrapper around openssl, has the following code in it: var params = ['genrsa', '-rand', '/var/log/mail:/var/log/messages', keyBitsize ]; Am ...
3
votes
1answer
86 views

Randomness extractors from Bourgain’s breakthrough- applications?

Some exciting progress to pure mathematics is due to Bourgain Springer - Multilinear Exponential Sums in Prime Fields Under Optimal Entropy Condition on the Sources with applications to randomness ...
3
votes
1answer
275 views

Von Neumann Extractor - Which bit is retained?

Which bit is retained in the Von Neumann debiasing algorithm? 00 and 11 are discarded and 10, 01 are retained but is the first or the second bit retained or does it matter? In other words: first: ...
3
votes
1answer
2k views

about entropy and random number generator

I am reading an article about cryptography of information and Pseudo Random Number Generator. The article said using 1$28$-bit entropy PRNG is safe in some cases of cryptography. I am not familiar ...
3
votes
1answer
110 views

Has there been any research on entropy efficient information-theoretically secure PRNGs?

I have an idea for an research project, but I am first wondering if it has been researched or implemented before. I think I have a way to come up with a set of PRNG algorithms which have the ...
3
votes
1answer
384 views

Seed a PRNG with random data and a password

I'd like to combine a random key file with a password to generate a secure seed for a CSPRNG. The key file is assumed to have very high entropy, but the password will be whatever the user provides. ...
3
votes
2answers
562 views

RNG failing Restart Tests by NIST SP800-22?

I have data sample of 1,000,000 bytes generated by a hardware RNG. The device is certified by ENT test suite, NIST SP800-22, DIE HARDER and TestU01. I have tested my sample by SP800-...
3
votes
1answer
370 views

Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
3
votes
1answer
145 views

Collecting entropy from a stream to a file

I have a potentially infinite stream of data originating in some physical phenomena that may expose random behavior (due to quantum effects, thermal noise, the butterfly effect in chaotic dynamical ...
3
votes
2answers
1k views

Dice rolls as entropy source?

I would like to generate a 128 bit random number with dices, but I have heard that dices are pretty biased, especially low quality (non casino dices). Would it make sense to generate a higher bit ...
3
votes
1answer
300 views

Detecting steganography by analysing non-significant data entropy?

I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text. I suspect, the steganography changes (elevates) ...
3
votes
1answer
293 views

Hashing entropy with only 128 bits of internal state

I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher. As the key size is ...

1 2
3
4 5
7