In computing, entropy is the randomness collected by an operating system or application for use in cryptography or other uses that require random data. This randomness is often collected from hardware sources, either pre-existing ones such as mouse movements or specially provided randomness ...

learn more… | top users | synonyms

3
votes
1answer
562 views

Open-source alternative for CryptGenRandom?

Let's say that for some reason I don't trust CryptGenRandom. Are there any open source software Windows entropy collectors to get cryptographically secure random numbers from for seeding purposes? ...
3
votes
2answers
2k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
3
votes
2answers
142 views

Reliable random seed for RNG

I want to create my computer passwords with a RNG, but I am thinking about one thing: I would use python to write that script and the RNG is controlled by one seed, most likely the time. If I would ...
3
votes
1answer
384 views

How genuine are password entropy calculations?

I apologise for perhaps the confusing title, I'll try and elaborate a little better. Many discussions I see surrounding password entropy focus on the specific context of the range of choices ...
3
votes
2answers
374 views

Credit card number entropy?

I want to confirm that this understanding is correct: A card has 16 digits plus a CV2 The first 6 digits are an issuer identification number The last digit of the 16 is a Luhn mod 10 check digit. ...
3
votes
1answer
156 views

PHP - Serializing user inputs

My entropy gathering system works by serializing user inputs: $entropy=sha1(microtime().$pepper.$_SERVER['REMOTE_ADDR'].$_SERVER['REMOTE_PORT']. ...
3
votes
3answers
239 views

When changing a password, does it have to be completely different?

When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
3
votes
2answers
307 views

How can you securely generate keys on AWS?

Our application needs to generate secure keys for long term storage on AWS using openssl. But I've seen some instance where entropy falls dangerously low on AWS machines and this doesn't appear to be ...
2
votes
3answers
1k views

Recompute Rainbow table with salt?

So, as I understand it, you prepend a password with salt before you hash it so that the resulting hash can't be used with a rainbow table to find the original password, as you could if the password ...
2
votes
4answers
337 views

If the attacker knows part of the password but not the length, does that help him in any way?

The idea behind this is that if knowing part of the password and not the length is useless, "passwords" can be easily stored in cleartext or paper since you would just add your own n characters ...
2
votes
4answers
216 views

Add a file as entropy source for /dev/random

What I have: A large file containing lots of secret, true-random bytes (yes, I'm sure they're not merely pseudo-random). I'll call it F. What I want to do: Tell Linux that it can use this file as an ...
2
votes
3answers
138 views

is it feasible to improve the entropy of XKCD #936 by using a larger dictionary?

XKCD #936 uses a limited subset of the English language, only 2000 words. I just looked it up, and the English language has over a million words, a sizeable subset of those having special characters, ...
2
votes
1answer
65 views

Usefulness of bcrypt(UUIDv4())

One of my colleagues is working on securing OAuth 2 client IDs and secrets for our OAuth server and he has come up with this scheme where he would not only use UUID v4 to generate random values, but ...
2
votes
1answer
482 views

Does client certificate authentication demand more server-side entropy?

We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
2
votes
2answers
92 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
2
votes
3answers
361 views

How secure is to seed PRNGs with the sequences from CSPRNG?

Background: Implementing online casino, I would like to use a number of PRNGs with high throughput, like MersenneTwisterFast. I know it is not cryptographically strong, but quite unpredictable when ...
2
votes
1answer
200 views

How to estimate the number of entropy bits & search space of a signature system like passtouch?

Apologies if I'm using the wrong lexicon, I'm just reading up about password systems out of interest. After seeing the xkcd strip on passphrases and coming across the passtouch system (youtube demo) ...
2
votes
0answers
129 views

Passphrase generator and strength & recovery time estimator. Right strength and randomness?

Questions about the strength of pass phrases frequently popup, as does: how to generate a strong passphrase? I tried to combine both in a tool. The free tool also includes recovery time estimations ...
1
vote
2answers
2k views

How many bits of entropy should I aim at for my password? [closed]

I mainly use 2 passwords: 1 is a 4 word full lowercase passphrase of 18 letters long which I use wherever possible. The other is basically 3 words and a digit with the first word in full uppercase and ...
1
vote
2answers
593 views

Password entropy match for alphanumeric but there are special characters in password

I have a problem cracking some of the fundamentals on passwords' entropies. Namely: I have read this article about a guy cracking DKIM of Google (maybe more noticing that the keys are only 512 bits) ...
1
vote
1answer
131 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...
1
vote
1answer
162 views

Where does /dev/random get its entropy?

I read over and over about how /dev/random gets its entropy from "hardware events." What exactly are these hardware events and how can we be sure that it is random enough?
1
vote
1answer
100 views

Minimum SHA256'd UTF8 encoded passphrase length not stored anywhere

For a passphrase that is UTF8 encoded and then SHA256'd, what is the minimum length to achieve a practically collision free result? The implementation is for a 32 byte cryptocurrency ed25519 seed ...
0
votes
6answers
557 views

Using passwords made of words

People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
0
votes
1answer
140 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
0
votes
1answer
2k views

Why is /dev/random so slow on Linux? [duplicate]

If it's true you only need about 128 bits of entropy to fuel enough data forever, why is it that /dev/random is so slow? My system has uptime of 214 days! Is it really only gathering .000000001 bits ...
0
votes
1answer
87 views

How strong is this encryption? [closed]

Given Dictionary containing 1000 three-letter words: dictionary=abc,def,ghi,jkl,mno,pqr... Randomly chosen words from the dictionary: 10-bits-passwords=abc,def,ghi Randomly chosen three words from ...
0
votes
1answer
95 views

Does adding an extra, non-entropic keyfile lower security? [duplicate]

Suppose I create two TrueCrypt volumes using keyfiles. The first volume uses a keyfile generated by TrueCrypt, whereas the second one uses the same keyfile in addition to a second, non-entropic ...
0
votes
0answers
36 views

dieharder - results interpretation [on hold]

I'm playing around with dieharder on some of my systems and have gotten some worrisome results from OS X 10.10.2 (14C109). This is running dieharder -a -g 500 so it should be testing /dev/random. I ...
-1
votes
1answer
117 views

physical access proof smart card for disk encryption [closed]

Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea. I know that ...
-4
votes
7answers
960 views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...