“Ex Chao Ordo”

Statistical Analysis of an API Key’s Byte Distribution

DJ @ ShadowTEAM

January 27th, 2025

Abstract

In the world of cryptography, randomness is king. This paper dissects a 32-character Base64 API key, peeling back the layers of entropy and byte distribution. Through entropy analysis, frequency mapping, and a chi-square statistical barrage, we expose its non-random secrets.

Introduction

Randomness (or the lack thereof) drives the security of API keys. A seemingly chaotic 32-character string hides more than meets the eye. We ask the following:

• How random is this key?

  
  

• More importantly, what does it reveal?

Entropy

Measurement of chaos

Entropy quantifies unpredictability. We calculated the Shannon entropy for the following:

1. Base64 Key: Measurement of randomness per character.

   
   

2. Decoded Raw Bytes: Assessing byte-level entropy.

   
   

   Results

   
   

   • Base64 Entropy: 4.625 bits per character (max: 6).

     
     

   • Raw Byte Entropy: 4.335 bits per byte (max: 8).

     
     

     The key’s entropy suggests more structure than randomness. This is not pure chaos; it is engineered.

     
     

     Frequency Distribution

     Mapping the Noise

     
     

     We visualized the byte frequencies after decoding. A truly random distribution should resemble white noise.

     
     

     Figure 1: Byte Frequency Distribution Histogram

     
     

   The histogram shows:

   
   

   • Peaks at byte values (e.g. 50, 100, 200).

     
     

   • Quite a few swaths of byte values missing in action. This shouts ’structured data’.

Chi-Square Test

Performing Statistical Recon

To prove the point, we have enacted the chi-square test. Here’s the math:

Where:

• Oi: Observed byte frequency.

• Ei: Expected frequency under uniform randomness.

Results

The chi-square test yielded a statistic of χ2 = 471.5909 with a p-value of p =4.21 × 10−15.

Interpretation

When p < 0.05, randomness takes an L. In our case, p =4.21 × 10−15, confirming structured patterns in the key.
Not random, not even close.

Conclusion

This API key is not pure entropy, it's precision-engineered. The peak in frequency and reduced entropy point to embedded metadata, timestamps, or versioning. For hackers and cryptographers alike, this type of information is invaluable.

Credits

DJ @ ShadowTEAM