0

Why is WPA/WPA2-personal passphrase entropy different than other entropy measurements? Is this because of the way WPA/WPA2 is implemented? For example:

A passphrase of 15 lowercase letters has an entropy value of 15 x 4.7 = 70. I understand how we came to this number because it's the length of the passphrase multiplied by the entropy bits per character (which for lowercase characters is 4.7 bits).

But in my book (CWSP Certified Wireless Security Professional Official Study Guide) it says that WPA/WPA2-personal passphrases typically have 2.5 bits of entropy per character and the formula looks something like 2.5(n)+12. So, using the same number of characters as before (15), it would be 15 x 2.5 + 12 = 49.

Also, it seems like it generalizes the entropy bits per character and doesn't differentiate lowercase from numerals, etc. So I would assume this means all characters used for WPA/WPA2-personal passphrases have the same entropy value of 2.5?

I'm sure this is as clear as mud, so please tell me if anything I put doesn't make sense or needs clarification.

1
  • whoops: in trying to link to your book, I actually linked to the answer (it's in the book)
    – schroeder
    Mar 14, 2017 at 14:05

1 Answer 1

1

If you kept reading past the point where it quotes the 802.11i standard, it explains that the lowered entropy is because of the method of choosing a password.

It's not about the amount of raw entropy per character (i.e. 4.7 for single case letters) but the effective entropy as a result of a human needing to assign and remember the password later (and enter it on a tiny keyboard for a phone).

So, the math per character is the same. The effective entropy is a lot lower because people choose easy-to-remember passwords. Purely random passwords retain their stronger entropy.

1
  • I think I was too focused on there being a difference that I didn't see the answer right in front of my face! Id10t error strikes again.
    – j1m
    Mar 14, 2017 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .