Editing Entropy (information theory) (section)

===Limitations of entropy in cryptography===
In [[cryptanalysis]], entropy is often roughly used as a measure of the unpredictability of a cryptographic key, though its real [[Uncertainty principle|uncertainty]] is unmeasurable. For example, a 128-bit key that is uniformly and randomly generated has 128 bits of entropy. It also takes (on average) <math>2^{127}</math> guesses to break by brute force. Entropy fails to capture the number of guesses required if the possible keys are not chosen uniformly.<ref>{{cite conference |first1=James |last1=Massey |year=1994 |title=Guessing and Entropy |book-title=Proc. IEEE International Symposium on Information Theory |url=http://www.isiweb.ee.ethz.ch/archive/massey_pub/pdf/BI633.pdf |access-date=31 December 2013 |archive-date=1 January 2014 |archive-url=https://web.archive.org/web/20140101065020/http://www.isiweb.ee.ethz.ch/archive/massey_pub/pdf/BI633.pdf |url-status=live }}</ref><ref>{{cite conference |first1=David |last1=Malone |first2=Wayne |last2=Sullivan |year=2005 |title=Guesswork is not a Substitute for Entropy |book-title=Proceedings of the Information Technology & Telecommunications Conference |url=http://www.maths.tcd.ie/~dwmalone/p/itt05.pdf |access-date=31 December 2013 |archive-date=15 April 2016 |archive-url=https://web.archive.org/web/20160415054357/http://www.maths.tcd.ie/~dwmalone/p/itt05.pdf |url-status=live }}</ref> Instead, a measure called ''guesswork'' can be used to measure the effort required for a brute force attack.<ref>{{cite conference |first1=John |last1=Pliam |title=Selected Areas in Cryptography |year=1999 |chapter=Guesswork and variation distance as measures of cipher security|series=Lecture Notes in Computer Science |volume=1758 |pages=62–77 |book-title=International Workshop on Selected Areas in Cryptography |doi=10.1007/3-540-46513-8_5 |isbn=978-3-540-67185-5 |doi-access=free }}</ref>

Other problems may arise from non-uniform distributions used in cryptography. For example, a 1,000,000-digit binary [[one-time pad]] using exclusive or. If the pad has 1,000,000 bits of entropy, it is perfect. If the pad has 999,999 bits of entropy, evenly distributed (each individual bit of the pad having 0.999999 bits of entropy) it may provide good security. But if the pad has 999,999 bits of entropy, where the first bit is fixed and the remaining 999,999 bits are perfectly random, the first bit of the ciphertext will not be encrypted at all.