entropy
termcryptographysecurity
A measure of unpredictability; in security, the randomness that makes keys and secrets hard to guess.
High entropy means an attacker cannot narrow down the possibilities, which is why keys must come from a good random source, not a predictable one. Weak entropy, a poor random generator, a low-variety password, quietly undermines otherwise strong cryptography.
Entropy is the measure of unpredictability, and in practice it is the thing that fails when cryptography fails. A key generated from a weak source is weak regardless of its length, and the failure is invisible because the output still looks random to anyone inspecting it.
The recurring cause is predictable conditions at generation time. Embedded devices and virtual machines that generate keys at first boot, before any real environmental noise has accumulated, have produced large populations of duplicate or factorable keys, discoverable by scanning public keys alone. Modern operating systems solve this with a kernel pool seeded from hardware sources, and the practical rule is to use the system's random device rather than a language's general-purpose random function, which is fast, deterministic and not for keys.
Also known as: randomness, csprng, key entropy