Why do "nothing up my sleeve numbers" have low entropy? As a preface, forgive me for some of the links being from Wikipedia.  I realize that academia frowns upon this.

I came across this article about "nothing up my sleeve numbers".  In it, it says:


  In cryptography, nothing up my sleeve numbers are any numbers which, by their construction, are above suspicion of hidden properties.  [...]  Such numbers can be viewed as the opposite extreme of Chaitin–Kolmogorov random numbers in that they appear random but have very low information entropy.


In looking for an example of one of these numbers, I came across this Crypto Beta Q&amp;A, where the answerer says:


  [M]athematical constants like binary expansions of irrational numbers like 2√ (or roots of other numbers), e, π can be used, to show that one didn't select the numbers to create a back door.


This is what Wikipedia has to say about information entropy:


  Entropy is typically measured in bits, nats, or bans.  Shannon entropy is the average unpredictability in a random variable, which is equivalent to its information content. Shannon entropy provides an absolute limit on the best possible lossless encoding or compression of any communication, assuming that the communication may be represented as a sequence of independent and identically distributed random variables.


Based on this, I don't see why these numbers (or any possible number) can have low entropy.  It seems like all numbers have equal likelihood of being generated as a "random variable" as long as that number is within the generated range (e.g., if the number is 1564631 [assumed to be one of these kinds of numbers], and I'm looking for number between 1 and 2000000, it has an equal likelihood of being generated, regardless).

Can anyone explain this concept?  I looked at the definition of entropy, but I admit that the math is a little over my head.  I'm not sure how someone would use a number without these properties to "create a backdoor."
You're absolutely correct: numbers (or a given binary string) don't have entropy. However, a number can be sampled from a distribution that has entropy. In other words, the entropy is a property of the process used to generate a number, not of the number itself.

So if I just give you the number 4, and assure you that I picked this number uniformly at random from between 1 and 6, you have no way of knowing if I'm telling the truth. Depending on the scenario, maybe I had an ulterior motive for picking 4, rather than choosing a number at random.

The issue comes up in cryptography because when it comes time to choose the constants for an algorithm (such as SHA1, or any of the other examples in the Wikipedia article you linked), there might be mathematical arguments suggesting, "If the constants are chosen at random, then with high probability, no attacker will be able to break it." But cryptographers, being a paranoid lot, are skeptical when someone says, "Let's use this set of constants. I picked them at random, I swear." So as a compromise, they'll use constants like, say, the binary expansion of π. While we no longer have the mathematical benefit of having chosen them at random from some large pool of numbers, we can at least be more confident there was no sabotage.

These nothing-up-my-sleeve constants have low entropy because the process of choosing them didn't involve very many random choices --- compare the number of "reasonable" nothing-up-my-sleeve numbers to the number of, say, 128-bit strings they are used to produce. This is by design. If there were a large number of nothing-up-my-sleeve numbers to choose from, then it would be easier for a malicious algorithm designer to find some that suited his agenda.

A very recent and very alarming case of someone not using nothing-up-my-sleeve numbers to create a backdoor is the Dual EC DRBG standard, which is used to generate random numbers. This algorithm included two constants, P and Q, and would be secure if no one could compute f(P, Q), for a specific function f.
Given randomly chosen P and Q, this would be hard. However, if you get to choose P and Q, then you could choose P, decide what you wanted f(P, Q) to be, and then solve for Q rather easily. Now you have a backdoor.