Entropy of two concatenated random values In this Intel blog posting, the author claims:


  The amount of work required to brute-force predict a random value that has n bits of entropy is $O(2^n)$. If you concatenate two values together, the entropy required to brute force the result becomes only $2^n + 2^n = 2^{n+1}$. By combining two n-bit random values, each with n bits of entropy, in this manner you get a random number with effectively only one additional bit of entropy.


Is this correct? My intuition suggests it would be $2n$ bits of entropy. But on the other hand, the two values are independent, so I can kind of see why it might be $n+1$ bits. Can anyone explain this?
Even in context, much of what is written in the blog post makes no sense. E.g., it says:


  While it can be argued that the DRNG is in reality just splitting a 128-bit value into two pieces and handing them to you one piece at a time, from a theoretical viewpoint this does not matter. While the original value had 128 bits of entropy, the end result is that you are handed two 64-bit numbers one at a time, each of which only has 64 bits of entropy. Because they come from a pseudorandom number generator, the entropy is additive when the values are concatenated, and the resulting 128-bit number has only 65 bits of entropy.


This is just wrong. If you have a 128-bit string that's truly uniform (i.e., has 128 bits of entropy) and split it in half then concatenate the halves, you clearly still have the original string and thus 128 bits of entropy.  The rest of the post is a similar muddle, so I wouldn't give it much credence.

Entropy of independent random strings is indeed additive, but not in the way the post says. Concatenating independent strings having entropy $n$, $m$ yields a string of entropy $n+m$, full stop. 

Note however that the strings need to be truly independent to reach this conclusion. Strings generated as outputs of a deterministic RNG algorithm will not be truly independent, and in fact their concatenation will not have any more true entropy than that of the seed provided to the RNG (and may even have less).

I don't know whether the outputs of these Intel instructions can be considered independent or not, but either way this aspect of the blog post is incorrect.