Individual test details
Entropy
Shannon entropy
This test mirrors the old ent
entropy test by featuring the same scan window of 8 bits. Unfortunately for reasons described in our rationale, we have no closed form solution to this. Instead we rely on simulation for the p value directly from the empirical cumulative distribution function (eCDF) for the test statistic
You should expect
Compression
Similarly to the entropy test above, no closed form determination of a p value is possible due to the overwhelming algorithmic complexity of the test. The test statistic is the size of the compressed samples file
We rely on simulation for the p value directly from the eCDF for xz-1.9.jar
and commons-compress-1.21.jar
libraries. These jar files should not be changed without consideration of re-calibrating the test’s embedded eCDF.
You should expect
Chi
The chi-square test
The test’s approximation to the chi-squared distribution breaks down if expected frequencies are too low. It will normally be acceptable so long as no more than 20% of the categories have expected frequencies below 5. We surpass 5 by engineering the test to have an expected 34 counts per category (actually slightly greater). If we run the math ent
uses a bit window of length 8.
Bits | Categories | Threshold | Min.Length |
---|---|---|---|
9 | 512 | 19,584 | 25,000 |
10 | 1,024 | 43,520 | 50,000 |
11 | 2,048 | 95,744 | 100,000 |
12 | 4,096 | 208,896 | 300,000 |
13 | 8,192 | 452,608 | 500,000 |
14 | 16,384 | 974,848 | 1,000,000 |
And finally the p value arises from the
Mean
This is simply the result of summing all the bytes in the samples file and dividing by its length. If those bytes are random, the expectation should be 127.5. The variance of the mean is the sum of the variances, which for a discrete uniform distribution of single bytes is
From here we calculate a standard Z score,
You should expect
Pi
To compute Monte Carlo estimates of ent
’s area method because it has a smaller variance, thus is more rigorous. The graph of the function on the interval [0,1] is shown in the plot below. The curve forms a quarter circle of unit radius and the exact area under the curve is

A quarter unit circle with area .
We leverage the fact that the average value of a continuous function
We convert four byte groups of the discrete sample distribution
where the long denominator is
By magic and computing
(Thanks to Ian for magical assistance with the variance formula.)
From here we calculate a standard Z score,
You should expect
Uncorrelation
This quantity measures the extent to which each byte in the file depends upon the previous byte. We simply use a standard Java library to compute the Pearson’s correlation (R) between the original samples and another set of identical samples with a lag of 1.
The reasoning for calling this test Uncorrelation rather than Correlation as in the original ent
is that ent
displays the correlation coefficient, which is a test statistic ent
pass ent3000
“PASS”
KS
Is a simple Kolmogorov–Smirnov test. We convert eight byte tuples of the discrete sample distribution
where the long denominator is
Shells
This is fundamentally a

An example solid 3D sphere covered in thin shells.
We perform the same discrete to real byte transformation on
There is a solid core, enclosed by 99 thin shells. Magically the radii of the core and shells are such that all volumes are perfectly identical. This should result in roughly the same number of points within each, that can then be
This test is sensitive to the choice of bins. There is no optimal choice for the bin width (since the optimal bin width depends on the distribution). Most reasonable choices should produce similar, but not identical, results. For the chi-square approximation to be valid, the expected frequency should be at least 5. This test is not valid for small samples, and if some of the counts are less than five, you may need to combine some bins in the tails.
- NIST.
We’ve schemed to expect a minimum of 14 points /shell. Good enough. The magic radii are listed below, calculated from

The core and all the shells, to scale.
And finally the p value arises from the
Runs
The runs test can be used to decide if a data set is from a random process.
A run is defined as a series of increasing values or a series of decreasing values. The number of increasing
, or decreasing , values is the length of the run. In a random data set, the probability that the (i+1)th value is larger or smaller than the ith value follows a binomial distribution, which forms the basis of the runs test.
The first step in the runs test is to count the number of runs in the data sequence. We will code values above the mean as “ones” and values below the median as “zeros”. A run is defined as a series of consecutive ones (or zero) values. The observed number of runs forms the test statistic (
).
- NIST (With median cut off changed to mean by RRR).
The expected number of runs:-
and the standard deviation of the number of expected runs:-
From here we calculate a standard Normal Z score,