A uniform distribution gives every possible outcome the same probability mass or density. For random-number generators, uniform output makes each candidate equally difficult to guess; even small biases can reduce the attacker’s search space. section 2.0 section 2.1
Biased choices shrink the search space
A date-formatted password appears to offer 100 million eight-digit combinations, but restricting it to valid months, days, and the previous 150 years leaves 12 × 31 × 150 = 55,800 possibilities. Biases therefore make guessing substantially easier. section 2.1.1
Uniformity also maximizes uncertainty, or entropy. For a binary outcome, entropy is H(X) = −Σ pₓ log₂ pₓ; a fair coin reaches 1 bit, while probabilities of 0.75/0.25 and 0.80/0.20 produce lower values. section 2.1.2
Apply the idea defensively:
- Use uniformly distributed random values when generating cryptographic keys, salts, or randomized ballots. section 2.1.1
- Treat deviations from uniformity as a security problem because they make likely outputs easier to guess. section 2.1
Equation 2.2
\[\begin{aligned} H(X) &= -\sum_{x \in X} p_x \log_2 p_x \notag\\ &= - p_{1} \times \log_2 (p_{1}) - p_{2} \times \log_2 (p_{2}) - ... p_{n} \times \log_2 (p_{n}) \label{equation:entropy-binary-log} \end{aligned}\]Use the entropy equation to quantify how probability imbalance reduces uncertainty. section 2.1.2
