Password entropy of famous xkcd comic

570 Views Asked by At

The famous xkcd comic about password strength calculates the entropy of the 11-character password "Tr0ub4dor&3" with 28 bits of entropy.

When following the ASCII-95-chart, we have 95 possible letters, numbers and symbols for each character position. So in my understanding of entropy that password would rather be $95^{11} \,\widehat{\approx}\, 2^{73} \widehat=\, 73$ bits of entropy.

The same with the more secure passphrase example beneath, 'correcthorsebatterystaple'. They say it has 44 bits of entropy.

I would say: That's a 25-character passphrase, so it has $26^{25}\,\widehat{\approx}\, 2^{118} \widehat=\, 118$ bits of entropy.

What am I doing wrong?

1

There are 1 best solutions below

0
On BEST ANSWER

It is assuming that the password is in a particular format: uncommon word, eventually capitalized and with some common substitutions, followed by a number and a punctuation in unknown order.

Troubador has been assigned 16 bits of entropy being a word in a not common words dictionary.

1 bit is for the capitalyzed word.

3 bits are for the common substitutions (you know that a can be converted to 4 and o to 0, but you don't know if the user did the substitution).

Then you have 4 bits for the punctuation, 3 bits for the digit and one bit for their order.

It also states that you can add some bits to account for different password formats.

The same for the second password, you have 11 bits for every word in a common dictionary, just multiply by 4.