Expectation Entropy as a Password Strength Metric
<|reference_start|>Expectation Entropy as a Password Strength Metric: The classical combinatorics-based password strength formula provides a result in tens of bits, whereas the NIST Entropy Estimation Suite give a result between 0 and 1 for Min-entropy. In this work, we present a newly developed metric -- Expectation entropy that can be applied to estimate the strength of any random or random-like password. Expectation entropy provides the strength of a password on the same scale as an entropy estimation tool. Having an 'Expectation entropy' of a certain value, for example, 0.4 means that an attacker has to exhaustively search at least 40\% of the total number of guesses to find the password.<|reference_end|>
@article{reaz2024expectation,
    title={Expectation Entropy as a Password Strength Metric},
    author={Khan Reaz and Gerhard Wunder},
    journal={arXiv preprint arXiv:2404.16853},
    year={2024},
    doi={10.1109/CNS56114.2022.9947259},
    archivePrefix={arXiv},
    eprint={2404.16853},
    primaryClass={cs.CR}
}