Two safes sit in a showroom. The salesman says the first has "an average combination complexity of 1.75 bits per wheel," the second "2 bits per wheel." You are not a safecracker, and the numbers mean nothing to you. So here is the question you should actually ask, the one a thief asks on his first walk past your house: what is his best single try?
Chapter 4 gave you Shannon's measure — the average surprise, an honest number with one fatal habit: it averages. A choice process that behaves well on average can still offer a thief a jackpot on his very first guess. This chapter builds the measure that does not look away: the one that watches the thief's best guess instead of the process's average behavior. It is called the min-entropy, and it is the number your Bitcoin key must actually maximize.
Back to Chapter 4's loaded die: faces with chances \(\tfrac{1}{2}, \tfrac{1}{4}, \tfrac{1}{8}, \tfrac{1}{8}\), and a respectable Shannon entropy of 1.75 bits. You are allowed one guess at the next roll. Which face do you call?
Face 1, obviously — it shows half the time. Your one-try success chance is \(1/2\): fifty percent, against a fair die's 25%. Two guesses, face 1 then face 2, and you cover \(3/4\) of the future. Now compare with the fair die: two guesses there cover only \(2/4 = 1/2\). The loaded die is easier to attack than its average suggests, because the attacker does not experience the average — he experiences the most likely outcome first, the next-most-likely second, and so on, in popularity order.
That is the attacker's entire strategy, and it is free: guess the likeliest first. No mathematics beyond Chapter 2. The question for a secret is therefore not "how surprising is it on average" but "how much does the best guess buy?"
A choice process's min-entropy is the flip-count of \(1\) over the chance of its most likely outcome — the surprise of the attacker's best single guess. If the top outcome has chance \(p_{\max}\), the min-entropy is the flip-count of \(1/p_{\max}\) bits.
Run the definitions against each other. Loaded die: top chance \(1/2\), so min-entropy is the flip-count of 2 — exactly 1 bit. Fair four-sided die: top chance \(1/4\), min-entropy 2 bits. The uniform twelve-word phrase: top chance 1 in \(2^{132}\), min-entropy 132 bits. The pattern: min-entropy never exceeds Shannon entropy, and the two are equal exactly when the process is uniform — when no outcome is any likelier than any other, the best guess and the average guess are the same guess.
So the gap between the two entropies measures the attacker's discount. Loaded die: Shannon 1.75, min 1 — three quarters of a bit handed to him, a 50% first-guess success where "average behavior" advertised more. The slogan: a secret is only as strong as its most likely value.
This is not a parlor point. In December 2009, a company called RockYou — it made widgets for social networks — was breached, and about 32 million user passwords spilled into the open. They had been stored in readable form, and what they showed the world was the true shape of human choosing. The single most common password, 123456, appeared about 290,000 times — nearly one user in a hundred. The top few thousand choices covered millions of accounts.
Now measure that shape with the attacker's metric. If a process's most likely outcome comes up about nine times in a thousand, its min-entropy is the flip-count of \(1/0.009 \approx 111\): math.log2(1/0.009) prints \(6.7958\ldots\) — under 7 bits. Under seven bits, against 132 for the fairly chosen phrase. A thief who tries 123456 against a hundred accounts wins about once; a thief who tries it against a million wins about nine thousand times. That is why trying spilled passwords everywhere they might be re-used — credential-stuffing — is an industry: human-picked secrets have catastrophically low min-entropy, because humans converge on the same favorites.
Defenders count the size of the space; attackers rank the contents by likelihood. A space of millions is no defense when a few favorites cover most of it. Whenever someone measures a secret by "how many possibilities there are," ask the attacker's question: how likely is the likeliest one?
Min-entropy is not just an attacker's ruler; it is the defender's design target. It tells you exactly what "chosen properly" must mean for a Bitcoin key: the process must make every outcome equally likely, so that the most likely value sits at 1 in \(2^{256}\) and not one guess is any cheaper than the average. Uniform is not a nicety — uniform is what makes min-entropy equal the full bit-length.
And it reframes the whole rest of the book. The defense of a key reduces to two questions: does the process have enough min-entropy (are all outcomes nearly equally likely?), and does anything leak that would let an attacker rank the outcomes (knowledge shrinking the raffle, as Chapter 2 put it)? Part IV's failures are all failures of one of those two. Which raises the question this part of the book still owes: what does a fair process actually look like, physically? Where does anyone find 132 honest coin flips?
The attacker has a metric now, and it is unforgiving: the best guess prices the secret. What the metric assumes — as Chapter 2 warned — is that you can actually get a process whose outcomes are equally likely. Coins and dice are the ancient answer; computers collect stranger harvests. Chapter 6 goes to the source: where randomness physically comes from, how your operating system gathers it, why "random-looking" software is not random, and how many dice you'd roll to make a key by hand.
123456 covered nearly one user in a hundred — under 7 bits of min-entropy where uniform would give dozens. People pick favorites; favorites get guessed first.Exercise 5.1 ★ Best guess. For Chapter 4's loaded die \((\tfrac{1}{2}, \tfrac{1}{4}, \tfrac{1}{8}, \tfrac{1}{8})\): what is the attacker's one-try success chance, and what does it become after two guesses? You should get \(1/2\) and \(3/4\).
Exercise 5.2 ★ The metric on the card. What is the min-entropy of a uniformly chosen twelve-word phrase from 2,048 words? You should get exactly \(132\) bits.
Exercise 5.3 ★★ Gap analysis. A process picks A with chance \(0.9\) and B with chance \(0.1\). Compute its Shannon entropy and its min-entropy. You should get about \(0.469\) bits and about \(0.152\) bits. Which number prices an attacker's first guess?
Exercise 5.4 ★★ Popularity order pays. In the RockYou spill, the top password covered about \(0.9\%\) of 32 million accounts. About how many accounts fall to an attacker who tries only that one password against every account? You should get about \(290{,}000\).
Exercise 5.5 ★★★ A vendor tells you their key generator "has 128 bits of entropy." They mean Shannon entropy. Your threat model is a thief who gets exactly one guess. Explain why the Shannon figure does not answer your question, what additional fact about the generator would, and why "the most likely key occurs with chance \(1/2^{128}\)" is the strongest possible statement of that fact.
Sketches, not model answers — enough to check your reasoning against. The computational exercises embed their expected outputs in the exercise text.
Exercise 5.5. Shannon entropy averages the surprise over all outcomes, so a generator could pair one relatively likely key with a vast crowd of rare ones and still post a good average — while the one-guess thief walks off with the likely key. The figure that answers the one-guess threat is the min-entropy: the chance of the most likely key, which needs a fact about the maximum outcome probability, not the mean surprise. Saying the top key occurs with chance \(1/2^{128}\) says every key does (none can be likelier than the likeliest), so the process is uniform and both entropies equal 128 — the best a 128-bit space can do. Anything weaker, and the vendor's number is advertising the average while the thief shops the maximum.