I am trying to understand the concept behind address randomization (ASLR). I'm reading the related wikipedia article which states:

Security is increased by increasing the search space. Thus, 
address space randomization is more effective when more 
entropy is present in the random offsets. Entropy is increased 
by either raising the amount of virtual memory area space over 
which the randomization occurs or reducing the period over which 
the randomization occurs. The period is typically implemented as 
small as possible, so most systems must increase VMA 
space randomization.

I have trouble understanding the concept of entropy related to randomization. I can understand the fact that if an attacker has to try to guess addresses from a larger address space, then the security is improved. But then in various articles online, I keep seeing the phrase n bits of entropy for randomization XYZ. What does n bits of entropy mean ? In the Wikipedia article as well, it uses variables like entropy bits of stack top (Es).

Also why does the article mean when it says that entropy is increased ... reducing the period over which the randomization occurs ?

My Understanding: I'm thinking that n bits of entropy means in effect how much of search space needs to explored by an attacker. So for a 32-bit machine, there can be 2^32 possible addresses, so ideally entropy would be 32-bit. But I read that in real cases, systems may only offer 16-bit of entropy. So does that mean that attacker needs to only explore 2^16 addresses ?

If that is true, then from the wikipedia article (focusing just on stack to make it simple):

N bit of entropy = Es - As = entropy bits of stack top - attacked bits per attempt of stack entropy

Does Es here mean the 2^32 part I mentioned above ? And what about As ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.