work factor calculation for brute-forcing crypto

[David Malone]

On Fri, Jul 17, 2009 at 01:37:43PM -0500, travis+ml-cryptography at subspacefield.org wrote:
> I'm curious if there's a way to express this calculation as a
> mathematical formula, rather than an algorithm, but right now I'm just
> blanking on how I could do it.

This has been dubbed the "guesswork" of a distribution by some authors,
I think originating with:

	John O. Pliam. The disparity between work and entropy in
	cryptology. http://philby.ucsd.edu/cryptolib/1998/98-24.html,
	February 1999

It turns out that its asymoptic behaviour is bit like that of Renyi
entropy, see:

	E. Arikan. An inequality on guessing and its application
	to sequential decoding. IEEE Transactions on Information
	Theory, 42:99105, Janurary 1996.

I did an explanitory writeup of this with some experiments at:

	http://www.maths.tcd.ie/~dwmalone/p/itt05.pdf

David.

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com