0

I am trying to determine how much entropy is going into a specific CSPRNG in JavaScript, but I can't seem to find a pure-JS client-side implementation of an entropy estimator.

So, I need to find a way to estimate entropy locally with pure JavaScript.

If it helps, the entropy is in an array which should be easy to manipulate.

kelalaka
  • 48,443
  • 11
  • 116
  • 196
Display Name
  • 27
  • 2
  • Estimate the entropy of what? – Natanael Aug 29 '19 at 17:56
  • 1
    To grasp why that's not doable from a theoretical standpoint, see this obligatory Dilbert strip. More seriously, consider an hypothetical such entropy estimator fed with pieces taken from a CSPRNG (or, if that estimator is a pure function, just repeatedly fed with the same input taken from a perfect entropy source). – fgrieu Aug 29 '19 at 21:02

1 Answers1

3

If someone chooses to run your program with a seed that you can't predict but an adversary can, you won't be able to tell. There is no way around this: nothing about the software can tell you what an adversary does or doesn't know; you can only use cryptography to ensure that if an adversary doesn't know a key and the message, then they can't decrypt the message.

In general, to estimate the entropy of a system, you need to have a model for how the system behaves. This is how all entropy estimation tools work: they posit some parametric model for how the input data might have been generated; then use the data to fit parameters for that model; and finally spit out the entropy of the model with the fitted parameters.

Squeamish Ossifrage
  • 48,392
  • 3
  • 116
  • 223