Skip to content

Instantly share code, notes, and snippets.

View arbitraryrw's full-sized avatar

Nikola arbitraryrw

View GitHub Profile
@4k1
4k1 / sessionid_entropy.md
Last active April 6, 2023 22:53
WebAssessment: How to calculate accurate entropy of the session ID

How to calculate accurate entropy of the session ID

1. What is an entropy?

Claude Shannon says:

The entropy is a statistical parameter which measures in a certain sense, how much information is produced on the average for each letter of a text in the language. If the language is translated into binary digits (0 or 1) in the most efficient way, the entropy H is the average number of binary digits required per letter of the original language.

-- NIST Special Publication 800-63-1 - Appendix A: Estimating Password Entropy and Strength

2. Why you need to know the accurate entropy?