How many bits of entropy are leaked for every derived password from a master? Given a master password that has a lot of entropy (similar to Bitcoin HD wallet seed words, 130 bits of entropy or more) how many bits of entropy are lost per leaked generated password?

Let's take an example of the master password hello stack exchange good to see you and some passwords generated by PBKDF2 with SHA512 with 256k iterations using a tool I wrote

foo.com   mr7i?O5til?2
bar.com   PYOT1-AOhX.D
baz.com   rk!Vxf8G_HgO


Given an attacker has these generated passwords how much easier can they guess the original master password? How many if they have 2/3, 1/3, and how it compares to 0/3 as well?

Thank you!
From an information-theoretic perspective, and with an ideal password hash function,  with $k=68$ possibilities for each character of derived password, each such character leaks about $\log_2(k)\approx6.1$ bit, but only as long as that remains significantly lower than the entropy in the master password. That's a leak of about $73$ bit per derived password. With $130$ bit of entropy in master password, the entropy leak would be about $73$ bit for one derived password, and just shy of $130$ bit for more.

The example password hello stack exchange good to see you is meaningful English text, uniformly-cased, properly-spaced, without digits or punctuation, with 30 non-space characters. It is doubtful that it is representative of passwords with 130-bit entropy; I'd guesstimate 40 to 90 bit, and would not be surprised if almost no entropy remained after one derived password; or/and if that password was by far the simplest for an english speaker (thus most likely) matching a single domain / derived password pair.

However, assuming that PBKDF2-HMAC-SHA512 is unbroken (as it stands), a complete entropy leak is not enough to find the master password (or a derived password for another site) for a compute-bound adversary, as real adversaries are. The entropy computation is useful only to tell how many derived passwords are necessary to carry an attack (here, two are most likely enough, and one might be enough). The best attack remains trying all the possible master passwords, from most likely to least, against one derived password hash (which will weed out most candidate master passwords), then a second selectively in case of success.

With enough derived passwords, the expected difficulty of attack is mostly dependent on the entropy in the master password, and the parametrization of PBKDF2 (which is untold): $2^n$ iterations stretch the entropy in the master password by about $n$ extra bits.



From an information-theoretic perspective, if the master password is chosen in a finite set with probability $p_i$ for each master password and $1=\sum p_i$, it initially has entropy $H=\sum(p_i\log_2(1/p_i))$. When a derived password for a known site (or a symbol of that) gets known, that makes some master passwords impossible, some probabilities $p_i$ go to zero (and are removed from the sum) and the others are increased to $p'_i$ in proportion, so that $1=\sum p'_i$ still holds. The entropy leak is the difference between initial and residual entropy.

In other words, the entropy leak is
$$\sum_\text{all MPs}p_i\left(\log_2{1\over p_i}\right)\ -\ \sum_\text{remaining MPs}\left({p_i\over\displaystyle\sum_\text{remaining MPs}p_i}\log_2{\displaystyle\sum_\text{remaining MPs}p_i\over p_i}\right)$$

When only one master password remains possible, only the left sum remains, and the entropy leak is that of the master password.

If all master passwords are equally likely, the entropy leak is the base-2 logarithm of the ratio of the number of initially possible master passwords, to the remaining number of possible master passwords. When only one master password remains possible, the entropy leak is the base-2 log of the number of all initially possible master passwords.

Assuming the derivation function is a Pseudo Random Function, knowing one of its output (or a symbol thereof) will rule out passwords irrespective of their initial probability. With each output symbol about uniformly distributed among $k$, it can be shown that the entropy leak for $s$ revealed symbol is expected to be almost $s\log_2(k)$ if that's much less than the initial entropy; and is expected to be almost all the entropy in the initial password if $s\log_2(k)$ is much larger.