How to properly calculate password entropy

Question

I am very confused with calculating password entropy i know that the formula is E = log2(RL). where E is password entropy, R is the range of available characters, and L is the password length. but what i if don't have the password length. Imagine there is a company that has 5 millions users and decided to use English alphabet (26 characters) for creating random password for each user (passwd length is not decided yet) the password will be hashed using SHA-256 .... hash = SHA - 256 (nickname + passwd).

• How to calculate or plot password entropy in terms of passwd length in this case ?
• How long does it take to crack even one password if using a GPU that can process 370200 hash/s ?

Answer 1

E = log2(RL)

That would be a good formula, if passwords were randomly and uniformly chosen across the character set. (Although wouldn't it be R^L?). Unfortunately humans are ludicrously non-uniformly random in choosing passwords; someone's password is far more likely to be password123 than ensr33nuo95 even though they are both 11 lowers and numbers.

Another way to think about password entropy is to assume some guessing strategy, and then ask how many guesses until you guess correctly. For example my "guess order" might be:

• Try top 1 million most common password from breach data
• Try all English words in alphabetical order, with and without caps, with !@#$%^. at the end, with 1337 s*bs, etc
• Repeat for pairs of words, with and without spaces
• Repeat for triplets of words, with and without spaces
• etc

Then for a given password you can compute

E = log2(num_guesses_until_correct) = log2(pos_in_guess_list)

This entropy measure is clearly just an estimate because it depends heavily on which guessing algorithm / guess order I assumed. For example, my guessing algorithm above would never try qazwsxedc even though it's an obvious keyboard pattern.

---

Real entropy estimators are heuristic, I think giving your password a base score for length, and then taking off points for dictionary words, keyboard patterns, etc, giving extra points for caps and symbols. If done right, the entropy estimate should line up roughly with the number of guesses it would take an attacker using standard wordlists and algorithms.

If you want to take a look at a real entropy estimator, then take a look at zxcvbn/src/scoring.coffee.

Answer 2

Yes, the entropy of a password generated with a truly secure random source for P would be E = log2(P^L)

However, you said that you are "randomly" generating a password but you did not specify how the random value would be generated. And therein lies the real risk.

Mathematical random number generators aren't actually random. They are just math formulas that are created with the intent of producing numbers that are statistically evenly distributed, but there is no attempt to make them unguessable. They are more properly known as Pseudo-Random Number Generators (PRNGs). These algorithms are initialized with a value called the seed, and each time they are called they return a different number, producing a stream of values. If the seed value is repeated, the stream of numbers generated will be repeated. This is very useful for re-running simulations with the same statistically random data, but it is not good for security. If an attacker guesses the seed value, they would know all the passwords that were generated. And if an attacker sees a sequence of random numbers produced by the algorithm, they can use the sequence to compute the internal state of the algorithm, and recover the seed.

For security purposes, random numbers need an additional property, and that is to be unguessable. This means using a special type of random number generator called a Cryptograhpically Secure Pseudo-Random Number Generator (CS-PRNG), and a better initial source of entropy than a static seed value.

If you use a simple PRNG to generate your passwords, they will have literally no entropy and will be vulnerable to an attacker who understands them. However, if you use a good quality CS-PRNG, they'll actually be secure, and then you can compute entropy.