From: Adam Shostack <adam@bwh.harvard.edu>
Date: Thu, 2 Feb 95 08:37:22 PST
To: Nobody@eniac.ac.siue.edu (Anonymous)
Subject: Re: How much entropy in a key press?
In-Reply-To: <199502021456.IAA01951@eniac.ac.siue.edu>
Message-ID: <199502021639.LAA15114@hermes.bwh.harvard.edu>
MIME-Version: 1.0
Content-Type: text/plain


Shannon estimates roughly 1 bit per character of English.  

RFC 1750  D. Eastlake, S. Crocker, J. Schiller,
"Randomness Recommendations for Security" is probably useful.

Adam

| Can anyone tell me how many bits of entropy there are per 7-bit ASCII
| character.  More specifically, a program wishes to generate a session
| key by prompting the user to type N random key presses.  The characters
| entered are hashed down to 128 bits by MD5 for subsequent use as a key.
| 
| What should the value of N be, such that the entropy of the user's
| string does not unnecessarily exceed the entropy of the hash?
| 
| 

-- 
"It is seldom that liberty of any kind is lost all at once."
						       -Hume