Expectation Entropy as a Password Strength Metric
Khan Reaz, Gerhard Wunder · 2022
The classical combinatorics-based password strength formula provides a result in tens of bits, whereas the NIST Entropy Estimation Suite give a result between 0 and 1 for Min-entropy. In this work, we present a newly developed metric - Expectation entropy that can be applied to estimate the strength of any random or random-like password. Expectation entropy provides the strength of a password on the same scale as an entropy estimation tool. Having an Expectation entropy of a certain value, for example, 0.4 means that an attacker has to exhaustively search at least 40% of the total number of guesses to find the password.