@TruthSerum Why would the entropy need to decrease?

so?

which makes no sense

A computationally unbounded attacker will be able to predict all further output once they have observed enough output to recover the seed.

but that absolutely doesn't imply that the output converges to the same sequence.

also computationally unbounded attackers are rather rare

so we don't care

What do you mean by "used up"?

If you consider AES256-CTR, an unbounded attacker only need slightly more than 256 bits of output to recover the key and thus predict all further output

that's why you need to observe slightly more than 256 bits

By 270 bits of output the seed is almost certainly uniquely determined

the conditional entropy drops to zero shortly after 256 bits of output

But each substring of 256 bits will have an entropy slightly below 256 bits, no matter where in the output it is.

But since different substrings are not independent, their combined entropy will not be the sum of their individual entropies.

yes, of course

The entropy of the full output is 256 bits.

But that doesn't stop different parts of it from having 256 bits of entropy

yes

But if you look at an particular bit, it will have an entropy of close to 1 bit by itself.

Each bit in the output contains almost a bit of entropy from the input.

But that information may be redundant with bits you already observed.

Consider a cipher with a 1 bit key which outputs simply that key repeated forever.

In that case each output bit has exactly 1 bit of entropy

but looking at more than 1 bit of output, you still only get 1 bit of entropy

Only the conditional entropy, i.e. "how much do I learn from this bit if I already know these other bits" goes to 0.

and it really hits zero pretty soon.

But even if you can completely predict the output of a sequence from a certain point on, it doesn't mean that it's identical to other sequences.

AES256-CTR will produce 2^256 different sequences of length 2^128, all of which are predictable after observing a few hundred bits of output.

But they're still completely different after that point.

@CodesInChaos unbounded attacker, does this implies a brute force of the $2^{256}$ keys ?

@Biv Yes, a computationally unbounded attacker has no problem brute forcing 2^256 keys.

BTW If you use $ around your math formula you can render them with ChatJax. ;)

I would love to be unbounded in such way (I think NSA too lol)

A computationally unbounded attacker doesn't care about your secrets because they can just have all the bitcoins.

If I were computationally unbounded, I'd enjoy playing video games at maximum quality settings and liquid smooth frame rates

@MickLH Nobody said anything about what latency their computer has.

Perhaps they need to send their message to a parallel universe which always takes 24h, no matter how simple or complex the computation.

Oh well, I guess I can settle for a precomputation that allows me maximum quality at whatever framerate my computer can seek through the data blob :P

@MickLH @MickLH: we do not have a practical attack or even distinguisher against ANSI931_TDES3, and ANSI931_AES256 adds 64 bits or headroom on both state and key. Therefore, one decade (or even a few) of technological progress won't change my assessment that ANSI931_AES256 is beyond attack (for an adversary observing only its output; practical attacks against implementations ARE conceivable).