Comments on Cryptographic Entropy Measurement

Random data and the entropy contained within is a critical component of information security. Minimum entropy (min entropy, H∞) is the base measurement defined by NIST and what many of their entropy tests are based on. However minimum entropy does not satisfy the basic requirements for an entropy measurement in either Shannon’s original document [7] or in Rényi’s generalization of entropy [6]. This document suggests a different way forward with a reclassification of entropy into two classes. With this differentiation, measurement tools are simplified and allow for more accurate assessments of entropy. 1 Information Security and Entropy Random data and the entropy it contains is a critical component of information security. Predictable – i.e., poor cryptographic random – can make an otherwise secure system weak. Three NIST1 documents detail standards on random data: SP800-90B [9] Specifics on obtaining ‘raw’ or ‘true’ random data; 1US National Institute of Standards and Technology 2019 Juniper Networks, Inc. 1 SP800-90A [2] Specifics on the oxymoronically named (yet ubiquitous) deterministic random bit generation, or DRBG; SP800-90C [1] Specifics on combining 90A and 90B for cryptographic use. While these documents implicitly differentiate between raw (90B) and cryptographic (90A,C) random, the measurement of entropy within them is similar. This indifferent treatment of random data types makes the testing process messy and unreliable. Cryptographic applications tend to favor more conservative views: assume the worst to maximize security. This idea has been taken to heart in the NIST SP800-90 documents, using the most conservative measure, min-entropy (H∞). While this may make sense for cryptographic random data 2, it makes no sense when measuring entropy in raw random data. Accurate measuring tools, used conservatively, give a much better picture of what ever is being measured. No one would use a conservative ruler that was always a centimeter too short, nor would they use a conservative thermometer that was always a degree higher. This paper differentiates the types of random data and their properties. It is hoped that this clarification will lead to simpler, more accurate tests and also help with the design of new entropy extenders (i.e., DRBG). 2 What is Entropy and How do we measure it. In information theory, entropy in data is defined by two equivalent definitions: 1. The measure of randomness in data; 2There is a serious issue if min and mean entropy are not equivalent in cryptographic random data. 2019 Juniper Networks, Inc. 2 2. The amount of information contained in data. Note that entropy is relative. It is not a solid, physical entity. Entropy depends on perspective or what is known and unknown about the data to a given entity. Once viewed, all information in the data is known to the viewer (zero entropy in the viewers perspective), but the data still contains entropy to non-viewers. The belief that entropy is something that has a classical, fixed measure is false and causes many interpretation issues. Knowledge of underlying entropy is represented in a probability distribution. Assume that there are r possible states {xj | 0 < j ≤ r}, with state j having probability pr(xj) = pj of occurring, with P = pj ∣∣∣∣∣ 0 < j ≤ r; 0 ≤ pj ≤ 1; r ∑