2

The famous xkcd comic about password strength calculates the entropy of the 11-character password "Tr0ub4dor&3" with 28 bits of entropy.

When following the ASCII-95-chart, we have 95 possible letters, numbers and symbols for each character position. So in my understanding of entropy that password would rather be $95^{11} \,\widehat{\approx}\, 2^{73} \widehat=\, 73$ bits of entropy.

The same with the more secure passphrase example beneath, 'correcthorsebatterystaple'. They say it has 44 bits of entropy.

I would say: That's a 25-character passphrase, so it has $26^{25}\,\widehat{\approx}\, 2^{118} \widehat=\, 118$ bits of entropy.

What am I doing wrong?

sqe
  • 23
  • You are confusing theoretical entropy (that you calculated) and practical one, where the computer has a strategy to guess passwords, and do so in a somewhat similar manner all the time: using a dicitonnary, do some substitution with strange characters, add or remove a few additional characters, usually numerical in nature etc... – Martigan Mar 23 '16 at 09:30

1 Answers1

1

It is assuming that the password is in a particular format: uncommon word, eventually capitalized and with some common substitutions, followed by a number and a punctuation in unknown order.

Troubador has been assigned 16 bits of entropy being a word in a not common words dictionary.

1 bit is for the capitalyzed word.

3 bits are for the common substitutions (you know that a can be converted to 4 and o to 0, but you don't know if the user did the substitution).

Then you have 4 bits for the punctuation, 3 bits for the digit and one bit for their order.

It also states that you can add some bits to account for different password formats.

The same for the second password, you have 11 bits for every word in a common dictionary, just multiply by 4.

N74
  • 2,479