← Entropy Atlas
Fresh or unique
Protocol challenges
A verifier sends a fresh challenge so an old valid response cannot simply be replayed.
Evaluation card
What “plenty” means here.
- Required property
- Unpredictability before issue and non-repetition during the protocol’s acceptance window.
- If it fails
- A repeated or forecast challenge lets an attacker precompute or replay an authentic response.
- Relevant attacker
- An active network attacker recording and replaying exchanges.
- The Plenty Line
- Size the challenge for the number of sessions and attack window, generate with a CSPRNG, and bind it to context.
- Why more is not automatically better
- A very long challenge still fails if the verifier accepts it twice or does not bind the response to the session.
Where it appears
Recognize the pattern.
- 01challenge–response login
- 02WebAuthn challenges
- 03anti-replay handshakes
The Plentropy rule
Protect the requirement, then stop.
Size the challenge for the number of sessions and attack window, generate with a CSPRNG, and bind it to context.
Once that claim has comfortable evidence and margin, improve the next limiting factor instead of worshipping a larger entropy number.