Guessing and entropy

By James L. Massey. 1994

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Differentially Private Password Frequency Lists (2016, positive): “In this model, guessing-entropy [34], [26]”
Guessing human-chosen secrets (2012, methodology): “Massey was perhaps the first to study the relationship [201], proving a result which is very easy to express in our notation: G̃1 ≥ H1 − 1 (3.”
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords (2012, background): “It has been demonstrated that H1 is mathematically inappropriate as a measure guessing difficulty [27]–[30].”
On the Incomparability of Entropy and Marginal Guesswork in Brute-Force Attacks (2000, methodology): “Following both Shannon [15] and Massey [9], we assume no bound on the size of .”
Estimating Renyi Entropy of Discrete Distributions (2014, methodology): “It is often used as a bound on Shannon entropy [12], [26], [29], and in many applications it replaces Shannon entropy as a measure of randomness [3], [7], [24].”
Cryptographic key generation from voice (2001, background): “The security of this scheme is characterized by guessing entropy [14, 2].”
Encountering stronger password requirements: user attitudes and behaviors (2010, methodology): “Using an optimal strategy, E[G] ≥ 2 + 1, where E[G] is the expected number of guesses and H is the entropy in bits [12].”
What's in a Name? (2020, methodology): “considered abstractly [4,23,3,20] and in the case of PINs [2], graphical passwords [6,29,22], and biometrics [1]; we synthesise previous analysis and define new metrics most applicable to trawling attackers.”
Testing metrics for password creation policies by attacking large sets of revealed passwords (2010, background): “The most notable papers covering the subject have been [7, 8], but those studies focused exclusively on the theoretical underpinnings of trying to convert the Shannon entropy to the Guessing entropy of a system, and did not verify their findings using real user passwords.”
A Hybrid Deep Learning Architecture for Privacy-Preserving Mobile Analytics (2017, background): “Moreover, the average rank is an empirical estimation of guessing entropy, which is a well-known measure of uncertainty [21] that can also be used as a measure of privacy.”
Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms (2012, background): “Massey connects entropy with password strength by demonstrating that entropy provides a lower bound on the expected number of guesses to find a text [41].”
Of passwords and people: measuring the effect of password-composition policies (2011, background): “Massey showed that entropy provides a lower bound on the expected number of guesses required to identify information; this result connects the entropy in passwords with an attacker’s ability to guess them using a bruteforce attack [9].”
A Characterization of Guesswork on Swiftly Tilting Curves (2018, background): “[3] J. L. Massey, “Guessing and entropy,” in 1994 IEEE International Symposium on Information Theory Proceedings, 1994, p. 204.”
On User Choice in Graphical Password Schemes (2004, unknown): “Given accurate values for Pr [ p ← S] for each p, a measure that indicates this ability is the “guessing entropy” [18] of passwords.”
On the Foundations of Quantitative Information Flow (2009, background): “One bound that seems promising in justifying the significance of H(H|L) is given by Clark, Hunt, and Malacaria [7] based on work by Massey [23].”
An Empirical Analysis of Traceability in the Monero Blockchain (2017, background): “First defined in [17], guessing entropy is commonly used as a measure of password strength [4].”
A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks (extended version) (2009, background): “The guessing entropy was originally defined in [23] and has been proposed to quantify the effectiveness of adaptive side-channel attacks in [19].”
IoT Goes Nuclear: Creating a ZigBee Chain Reaction (2017, methodology): “To measure the attack success, we are using the partial guessing entropy (PGE) which indicates how many (incorrect) guesses would be required for each key byte based on the information available after processing N traces [36].”