I am trying to understand the concept behind address randomization (ASLR). I'm reading the related wikipedia article which states:
Security is increased by increasing the search space. Thus, address space randomization is more effective when more entropy is present in the random offsets. Entropy is increased by either raising the amount of virtual memory area space over which the randomization occurs or reducing the period over which the randomization occurs. The period is typically implemented as small as possible, so most systems must increase VMA space randomization.
I have trouble understanding the concept of
entropy related to randomization. I can understand the fact that if an attacker has to try to guess addresses from a larger address space, then the security is improved. But then in various articles online, I keep seeing the phrase
n bits of entropy for randomization XYZ. What does
n bits of entropy mean ? In the Wikipedia article as well, it uses variables like
entropy bits of stack top (Es).
Also why does the article mean when it says that
entropy is increased ... reducing the period over which the randomization occurs ?
I'm thinking that
n bits of entropy means in effect how much of search space needs to explored by an attacker. So for a 32-bit machine, there can be
2^32 possible addresses, so ideally entropy would be 32-bit. But I read that in real cases, systems may only offer 16-bit of entropy. So does that mean that attacker needs to only explore
2^16 addresses ?
If that is true, then from the wikipedia article (focusing just on stack to make it simple):
N bit of entropy = Es - As = entropy bits of stack top - attacked bits per attempt of stack entropy
Does Es here mean the 2^32 part I mentioned above ? And what about As ?