Min-entropy is a conservative way to measure unpredictability.
Instead of asking how uncertain a source is on average, min-entropy focuses on the outcome an attacker should guess first: the most likely outcome.
That makes the concept especially useful in cryptographic random-number generation, where security depends on how difficult a value is to predict under the best available guessing strategy.
NIST's SP 800-90 series uses min-entropy when reasoning about unpredictability in random bit generation. NIST IR 8427 states that the series measures unpredictability in terms of min-entropy and uses the concept when discussing full-entropy bit strings.[1]
In short
For a discrete random variable X, min-entropy is commonly written as:
Hmin(X) = -log2(max P(X = x))
The key term is max P(X = x): the probability of the most likely possible outcome.
If one value occurs much more often than the others, an attacker will choose that value first. Min-entropy captures that worst-case guessing advantage.
A simple example
Imagine a source that emits one bit at a time.
If 0 and 1 each occur with probability 0.5, the best one-shot guess succeeds half of the time. The min-entropy is one bit.
Now imagine the source emits 0 with probability 0.75 and 1 with probability 0.25.
The best strategy is obvious: guess 0. The success probability is 0.75, so the source has less than one bit of min-entropy per sample.
The physical sample still contains one bit of data. It just does not contain one full bit of worst-case unpredictability.
That difference — data length versus entropy — is fundamental.
Why bit length is not entropy
A 256-bit string is 256 bits long. That does not automatically mean it contains 256 bits of entropy.
Suppose a flawed generator can produce only a small subset of all possible 256-bit strings, or heavily favors some outputs over others. The strings may look long and complicated while remaining far easier to guess than an ideal 256-bit value.
So statements such as “the system outputs 256-bit random values” are incomplete from a security perspective.
A more meaningful question is:
How much unpredictability is conservatively justified in those values?
This is why entropy estimation belongs alongside output length and throughput when evaluating a random number generator.
Min-entropy vs Shannon entropy
Shannon entropy and min-entropy are both useful, but they answer different questions.
Shannon entropy is central to information theory and characterizes average uncertainty. Min-entropy is deliberately focused on the highest-probability event.
For cryptographic randomness, that pessimistic viewpoint is valuable because an adversary is not required to guess uniformly. An attacker can exploit structure, bias, side information, implementation weaknesses, or a distribution that favors certain outcomes.
Min-entropy asks what the strongest first guess looks like under the modeled distribution.
That does not make Shannon entropy “wrong.” It means the two measures serve different purposes.
Why NIST uses min-entropy
NIST SP 800-90B specifies design principles and requirements for entropy sources used in random bit generation and includes methods for estimating entropy.[2]
NIST IR 8427 explains that the SP 800-90 series measures unpredictability using min-entropy and discusses the assumption used for full-entropy bit strings.[1]
The practical motivation is conservative accounting. If a raw source produces samples that are biased, correlated, or partially predictable, a system should not simply count every raw bit as a full bit of entropy.
The claimed entropy rate should be supported by the source model and evaluation method.
Full entropy in the SP 800-90 context
NIST IR 8427 describes a full-entropy bit string as one whose entropy is equal to its length in the ideal case and discusses the practical SP 800-90 assumption for treating a bit string as full entropy.[1]
This is an important nuance: “full entropy” in standards work is a technical concept with precise assumptions, not a casual synonym for “looks very random.”
For QRNG.io, that distinction is useful because it prevents overclaiming. A system should not call output full entropy merely because it passes generic statistical tests.
Min-entropy and conditioning
Raw entropy sources often produce biased or correlated data.
Conditioning can transform those samples into output with better statistical properties. For example, a conditioning function may compress a larger amount of raw input into a smaller amount of output.
But deterministic conditioning does not manufacture unpredictability that was absent from its input.
If the input contains a conservatively estimated amount of entropy, the output length and security claims still need to be justified by that entropy budget and the properties of the conditioning process.
This is why “the output looks uniform after conditioning” is not enough to establish how much entropy the source contributed.
Min-entropy and QRNG
A QRNG begins with a quantum physical process, but a complete device observes that process through real electronics.
Those measurements can contain quantum contributions, classical contributions, bias, drift, correlations, quantization effects, and implementation artifacts.
A credible QRNG therefore needs more than the statement “the source is quantum.” It needs a model that explains how the physical process maps to digital samples and how much unpredictable information can conservatively be credited to those samples.
Min-entropy gives engineers a way to express that conservative uncertainty.
Throughput is not entropy rate
High output throughput can be useful. It is not the same thing as high entropy throughput.
An implementation could sample a physical signal extremely quickly while each raw sample contains only a fraction of a bit of min-entropy. The design may then need to accumulate and condition multiple samples before producing output that satisfies its security requirements.
When evaluating a source, separate at least three quantities:
- raw sample rate — how quickly measurements are digitized;
- estimated entropy rate — how much unpredictability is conservatively credited to those samples;
- final output rate — how quickly conditioned or generated random bits are delivered.
Confusing those quantities can lead to exaggerated claims.
A useful engineering example
Imagine two devices that both output 100 megabits per second.
Device A samples a well-characterized source, estimates entropy conservatively, monitors the source continuously, and conditions according to an explicit entropy budget.
Device B produces the same number of bits per second but provides no defensible model of how much entropy exists in each raw sample.
The identical output rate tells you almost nothing about which architecture deserves greater confidence.
The entropy model is the missing information.
What min-entropy does not tell you by itself
A min-entropy estimate is important, but it is not a complete security assessment.
It does not by itself establish:
- that the physical model is correct;
- that the source is quantum;
- that all environmental failure modes were tested;
- that implementation bugs are absent;
- that conditioning is correct;
- that interfaces are secure;
- that a device has passed a formal validation program.
It is one critical part of a larger evidence chain.
Questions to ask when someone quotes an entropy number
If a vendor or paper gives an entropy figure, ask:
- Entropy of what — raw samples, conditioned output, or a final generator?
- Which entropy measure is being used?
- What model or assumptions support the estimate?
- Was the data treated as IID or non-IID?
- What operating conditions were evaluated?
- How are source failures detected?
- Does the output rate respect the claimed entropy budget?
- Is the number tied to a specific standard, validation method, or peer-reviewed analysis?
A number without context can be misleading even when the mathematics is correct.
Summary
Min-entropy measures unpredictability from a worst-case guessing perspective.
That makes it particularly useful in cryptographic random-number generation, where a source should be evaluated against what an attacker could exploit rather than only against how random the output appears.
For QRNG and other physical entropy sources, conservative min-entropy estimation helps connect the physics and measurement system to the amount of cryptographic unpredictability that can responsibly be claimed.
Evaluating quantum entropy? Explore the iQrypto Evaluation Kit.
Sources and further reading
- NIST, IR 8427: Discussion on the Full Entropy Assumption of the SP 800-90 Series — https://csrc.nist.gov/pubs/ir/8427/final
- NIST, SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation — https://csrc.nist.gov/pubs/sp/800/90/b/final
- NIST, Random Bit Generation publications — https://csrc.nist.gov/Projects/random-bit-generation/publications
- QRNG.io, Why Entropy Matters in Cybersecurity — https://www.qrng.io/articles/why-entropy-matters-in-cybersecurity
- QRNG.io, What Makes a QRNG Trustworthy? — https://www.qrng.io/articles/what-makes-a-qrng-trustworthy