What Is Entropy In Cryptography?
Tags: cryptography, education, programming, security
Published: 2020-02-14 14:18:21

---
title: What Is Entropy In Cryptography?
published: true
date: 2020-02-14 14:17:58 UTC
tags: cryptography,education,programming,security
canonical_url: https://qvault.io/2020/02/14/what-is-entropy-in-cryptography/?utm_source=rss&utm_medium=rss&utm_campaign=what-is-entropy-in-cryptography
---

By Lane Wagner – [@wagslane](https://twitter.com/wagslane) on Twitter

![](https://qvault.io/wp-content/uploads/2020/02/maxresdefault-1-1024x576.jpg)<figcaption>Perpetual Motion Machine</figcaption>

If you are familiar with the [laws of thermodynamics](https://en.wikipedia.org/wiki/Laws_of_thermodynamics), you may recognize the second law as dealing with entropy. In the realm of physics, entropy represents the degree of disorder in a system. Because systems tend to degrade over time, thermodynamic energy becomes less available to do mechanical work. In cryptography, [entropy](https://en.wikipedia.org/wiki/Entropy_(computing)) has a distinct but similar meaning.

In cryptography, [entropy](https://en.wikipedia.org/wiki/Entropy_(computing)) refers to the randomness collected by a system for use in algorithms that require random data. A lack of good entropy can leave a cryptosystem vulnerable and unable to encrypt data securely.

## Computers are Deterministic

Deterministic machines do exactly what we tell them to do.

Every.

Single.

Time.

In order to coax a machine into doing something random, we have to introduce a source of random input from outside the machine.

**Linux**

Let’s take a look at how the average Linux machine generates secure random numbers. Because Linux is conveniently open-source, here is a link to _[random.c](https://github.com/torvalds/linux/blob/master/drivers/char/random.c)_ a file responsible for a randomness driver. By taking a look at the comments at the top of the file, we learn:

*We must try to gather "environmental noise" from the computer's environment, which must be hard for outside attackers to observe, and use that to generate random numbers. In a Unix environment, this is best done from inside the kernel.*

*Sources of randomness from the environment include inter-keyboard timings, inter-interrupt timings from some interrupts, and other events which are both (a) non-deterministic and (b) hard for an outside observer to measure.*

When a user is clicking around or typing, those timings (along with other system timings), are used as inputs to a pool of randomness, an “entropy pool”. Since these events could happen at any time, and it would be hard to predict when they will happen in advance.

![](https://qvault.io/wp-content/uploads/2020/02/gross-jacuzzi-pool-water.jpg)<figcaption>Entropy Pool, Probably</figcaption>

Again, from the comments:

*When random bytes are desired, they are obtained by taking the SHA hash of the contents of the "entropy pool".*

To sum up, random data is added to an entropy pool constantly. This randomness is based on hard to predict events within the machine. When a user desires randomness, a [hash](https://qvault.io/2020/01/01/very-basic-intro-to-hash-functions-sha-256-md-5-etc/) is taken of the entropy pool and the result is supplied to the user. When we call any secure randomness function on a Linux machine, we are likely using this driver or one very similar to it.

## How Much Entropy?

A Linux machine that has sufficient entropy in its pool will usually contain 4096 bits of randomness. This is more than enough for several secure calculations to be performed. For perspective, a very strong private key typically contains 256 bits of entropy. If you want to see how much your Linux machine currently has available, you can use the following command:

```
cat /proc/sys/kernel/random/entropy_avail
```

If you have any comments or questions, reach out to me on [twitter](https://twitter.com/wagslane)!

## Thanks For Reading

Lane on Twitter: [@wagslane](https://twitter.com/wagslane)

Lane on Dev.to: [wagslane](https://dev.to/wagslane)

Download Qvault: [https://qvault.io](https://qvault.io/)

The post [What Is Entropy In Cryptography?](https://qvault.io/2020/02/14/what-is-entropy-in-cryptography/) appeared first on [Qvault](https://qvault.io).