Problem - Kevin Tafuro

the byte is even, he reduces the number of guesses necessary to 27 (128), in which
case the byte has only 7 bits of entropy.
We can have fractional bits of entropy. If we have one bit, and it has a 25% chance of
being a 0 and a 75% chance of being a 1, the attacker can do 50% better at guessing
it than if the bit were fully entropic. Therefore, there is half the amount of entropy in
that bit.
In public key cryptography, n-bit keys contain far fewer than n bits of
entropy. That is because there are not 2 n possible keys. For example,
in RSA, we are more or less limited by the number of primes that are n
bits in size.
Random numbers with lots of entropy are difficult to come by, especially on a deterministic
computer. Therefore, it is generally far more practical to gather enough
entropy to securely seed a cryptographic pseudo-random number generator. Several
issues arise in doing so.
First, how much entropy do you need to seed a cryptographic generator securely?
The short answer is that you should try to give as much entropy as the random number
generator can accept. The entropy you get sets the maximum security level of
your data protected with that entropy, directly or indirectly. For example, suppose
you use 256-bit AES keys, but chose your key with a PRNG seeded with 56 bits of
entropy. Any data encrypted with the 256-bit AES key would then be no more secure
than it would have been had the data been encrypted with a 56-bit DES key.
Then again, it’s incredibly hard to figure out how much entropy a piece of data contains,
and often, estimates that people believe to be conservative are actually large
overestimates. For example, the digits of π appear to be a completely random
sequence that should pass any statistical test for randomness with flying colors. Yet
they are also completely predictable.
We recommend that if you have done a lot of work to figure out how much entropy
is in a piece of data and you honestly think you have 160 bits there, you still might
want to divide your estimate by a factor of 4 to 8 to be conservative.
Because entropy is so easy to overestimate, you should generally cryptographically
postprocess any entropy collected (a process known as whitening) before using it. We
discuss whitening in Recipe 11.16.
Second, most cryptographic pseudo-random number generators take a fixed-size
seed, and you want to maximize the entropy in that seed. However, when collecting
entropy, it is usually distributed sparsely through a large amount of data. We discuss
methods for turning data with entropy into a seed in Recipe 11.16. If you have
an entropy source that is supposed to produce good random numbers (such as a
hardware generator), you should test the data as discussed in Recipe 11.18.
Determining What Kind of Random Numbers to Use | 571
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.