Are dices for generating seed words fair?

[o_e_l_e_o]

so are you going to admit that storing your seed phrase in such a place is highly risky?

Not necessarily.

I'm not a fan of any back up system for seed phrases where the compromise of a single back up results in you losing your coins. Because of this, I exclusively use either wallets generated from both a seed phrase and an additional passphrase, or multi-sig wallets. And as I have said before, I would always recommend having at least two back ups of any important information. So in such a case where I am storing a back up in a safe deposit box, then if the bank makes a mistake and drills out my box, I have not lost my wallet since I have additional back ups elsewhere, and my funds cannot be stolen since one back up on its own is insufficient to compromise my wallets.

If you only have one back up, and someone discovering that one back up gives them all the information required to steal your coins, then you are already in a highly risky situation.

[1714316033]

1714316033

[1714316033]

1714316033

[larry_vw_1955]

Not necessarily.

ok thanks for the clarification. seems like you thought of everything.

[LoyceV]

but then we get into other questions such as "what is an acceptable level of bias in an experiment where you perform it some number of times, be that 1000, or more?"

When considering generating private keys for bitcoin, then my answer is zero. I don't see why you would settle for anything less. This is why I advocate for using coin flips with von Neumann's algorithm, since by doing this you can be certain you have eliminated any bias in your coin, as well as not introduced any new bias by performing randomness extraction or other processes you don't fully understand on your data.

By coincidence, I stumbled upon an article about bias in coin tosses. It reminded me about this topic, hence the 10 month bump.

TL;DR: if you start a coin toll with heads up, there's a 50.8% chance you'll end up with heads.

"According to the Diaconis model, precession causes the coin to spend more time in the air with the initial side facing up," a new team writes in a pre-print paper that has not yet been peer-reviewed. "Consequently, the coin has a higher chance of landing on the same side as it started (i.e., ‘same-side bias’)."

Diaconis found, from a smaller ideal number of coin tosses recorded and analyzed, that coins land on the same side they were tossed from around 51 percent of the time. The new team recruited 48 people to flip 350,757 coins from 46 different currencies, finding that overall, there was a 50.8 percent chance of the coin showing up the same side it was tossed from.

Delving into the data further, they found that coin tosses are highly variable between people, with some showing a strong same-side bias and others having none at all – coin tosses may come down (ever so slightly) to the tosser.

Further reading: Fair coins tend to land on the same side they started: Evidence from 350,757 flips.

There are older articles also claiming a similar (51/49) distribution, but as far as I've found the recent research had the largest sample size.

[philipma1957]

but then we get into other questions such as "what is an acceptable level of bias in an experiment where you perform it some number of times, be that 1000, or more?"

When considering generating private keys for bitcoin, then my answer is zero. I don't see why you would settle for anything less. This is why I advocate for using coin flips with von Neumann's algorithm, since by doing this you can be certain you have eliminated any bias in your coin, as well as not introduced any new bias by performing randomness extraction or other processes you don't fully understand on your data.

By coincidence, I stumbled upon an article about bias in coin tosses. It reminded me about this topic, hence the 10 month bump.

TL;DR: if you start a coin toll with heads up, there's a 50.8% chance you'll end up with heads.

"According to the Diaconis model, precession causes the coin to spend more time in the air with the initial side facing up," a new team writes in a pre-print paper that has not yet been peer-reviewed. "Consequently, the coin has a higher chance of landing on the same side as it started (i.e., ‘same-side bias’)."

Diaconis found, from a smaller ideal number of coin tosses recorded and analyzed, that coins land on the same side they were tossed from around 51 percent of the time. The new team recruited 48 people to flip 350,757 coins from 46 different currencies, finding that overall, there was a 50.8 percent chance of the coin showing up the same side it was tossed from.

Delving into the data further, they found that coin tosses are highly variable between people, with some showing a strong same-side bias and others having none at all – coin tosses may come down (ever so slightly) to the tosser.

Further reading: Fair coins tend to land on the same side they started: Evidence from 350,757 flips.

There are older articles also claiming a similar (51/49) distribution, but as far as I've found the recent research had the largest sample size.

So if you have a 51 to 49 percent bias on all your picks it still to the 24th power.

so effectively the bias mean a 24 word seed is more like a 22 word seed or am I wrong

[Medusah]

So if you have a 51 to 49 percent bias on all your picks it still to the 24th power.

What number are you raising to the 24?

If there is 50.8% chance for heads and 49.2% for tails, then you can calculate the entropy like that:

Code:

H(X) = - P(heads) * log2(P(heads)) - P(tails) * log2(P(tails)) = - 0.508 * log2(0.508) - 0.492 * log2(0.492) = 0.999815327

So tossing a coin gives you 0.999815327 bits of entropy.  If you toss it 256 times, it will give you 255.95 bits which are sufficient.

[LoyceV]

If there is 50.8% chance for heads and 49.2% for tails, then you can calculate the entropy like that:

Code:

H(X) = - P(heads) * log2(P(heads)) - P(tails) * log2(P(tails)) = - 0.508 * log2(0.508) - 0.492 * log2(0.492) = 0.999815327

I read it, but can't believe it. That would mean a dice that rolls heads 3.25% times more often than it rolls tails would only lose 0.02% of the entropy after 256 rolls.
I know it's been a while since I studied statistics, so bear with me. Let's say we have a 3-sided coin, with 2 sides heads and 1 side tails.
Using your formula, that gives:

Code:

- 0.6667 * log2(0.6667) - 0.3333 * log2(0.3333) = 0.9183

I would expect this 2-to-1-dice to create much less entropy. Please convince me you used the correct formula.

[Medusah]

I read it, but can't believe it. That would mean a dice that rolls heads 3.25% times more often than it rolls tails would only lose 0.02% of the entropy after 256 rolls.

Yes.

I would expect this 2-to-1-dice to create much less entropy. Please convince me you used the correct formula.

You are correct.  I used Shannon's formula.  There are many good answers about the "why" part in here:  https://math.stackexchange.com/questions/331103/intuitive-explanation-of-entropy

[o_e_l_e_o]

TL;DR: if you start a coin toll with heads up, there's a 50.8% chance you'll end up with heads.

I think far more interesting than that headline figure is the data they have given in Table 1. Of their 48 participants, 10 had the opposite result and showed a bias to the coin landing on the opposite side it started, and there were a handful of participants with a very severe bias, with one showing a bias of 60/40. So they key take away I think is not "51/49 bias of the same side you started with", but rather "everyone has their own individual bias when flipping a coin".

Given that, and given that each coin itself will also have its own intrinsic bias, then again the solution is the simple one I've outlined many times before - use a von Neumann debiasing approach, but with the additional caveat that you should start each flip from the same position (i.e. heads face up). That way any bias in either the coin or your technique is completely eliminated and you will always end up with a completely random result.

[larry_vw_1955]

Given that, and given that each coin itself will also have its own intrinsic bias, then again the solution is the simple one I've outlined many times before - use a von Neumann debiasing approach, but with the additional caveat that you should start each flip from the same position (i.e. heads face up). That way any bias in either the coin or your technique is completely eliminated and you will always end up with a completely random result.

the thing about that von neumann method is if the person rolling the dice knows they are using it then they also know that only the first flip matters. the 2nd flip never affects anything. except whether to use the result of the first flip or not. with all of that information in their head, they're not going to be flipping the first and second flips the same way. probably not.

example lets say you had this series of flips:

HH HT HT HT and then say your next flip was H you would be thinking "I don't want this to be T because we shouldn't be having too many H in a row"...so subconsciously your mind would be making you flip the coin so that the coin landed on H.

so i don't think it can get rid of that type of bias.

[o_e_l_e_o]

so i don't think it can get rid of that type of bias.

I don't think many people have the ability to alter their coin flipping technique to make one side or the other more likely. But even so, if you wanted to protect against this then don't learn the results, and that way the results cannot bias your flipping technique.

Two options for this. If you have someone you trust completely with your bitcoin (such as a spouse), then have them note the results from the flips for you, while you don't even look. If you don't have someone you trust completely, then film the process using an airgapped device and watch the video back after you have made several hundred flips (on average with an unbiased coin you will need to make 512 flips to generate 128 bits of entropy).

[Medusah]

(on average with an unbiased coin you will need to make 512 flips to generate 128 bits of entropy).

For anyone who does not know:  the von Neumann method involves counting results only half of the time ('HH', 'TT' are not counted).  So for every two coin tosses which are 'HT' or 'TH' you add 1 bit.  So 1 bit for every 4 coin tosses on average.

I have not tried it.  Sounds the most secure, but tiring too.   

[o_e_l_e_o]

For anyone who does not know:  the von Neumann method involves counting results only half of the time ('HH', 'TT' are not counted).  So for every two coin tosses which are 'HT' or 'TH' you add 1 bit.  So 1 bit for every 4 coin tosses on average.

You can actually make it more efficient, but I've never bothered to talk about how you would do this on the forum since it is far easier and safer to just stick to the basic method and keep flipping until you have enough entropy. The more efficient method involves considering more than just pairs of flips. We know that HT and TH are equally probable, so by the same logic HH TT and TT HH are also equally probable. And these runs of matching pairs do not need to be consecutive. HH HT TT and TT HT HH are also equally probable, for example.

So you flip your coin, and for every HT you write down 0, and for every TH you write down 1. But then you also generate a completely separate second level sequence. For every HH you write down H in this second level sequence, and for every TT you write down T. You then run von Neumann's algorithm across this new sequence as well, generating 0s and 1s as before, but also generating Hs and Ts as described in a new third level sequence.

You can iterate this as many times as you like, and theoretically approach the maximum possible entropy you can extract from each flip. In practice, additional efficiency gains after probably the third level or so are probably outweighed by the increased complexity.

[larry_vw_1955]

I don't think many people have the ability to alter their coin flipping technique to make one side or the other more likely. But even so, if you wanted to protect against this then don't learn the results, and that way the results cannot bias your flipping technique.

that's correct. that's only way to make sure.

Two options for this. If you have someone you trust completely with your bitcoin (such as a spouse), then have them note the results from the flips for you, while you don't even look.

the only way i would accept that solution is if you hand over your completed private key and wallet details to your spouse once done.

If you don't have someone you trust completely, then film the process using an airgapped device and watch the video back after you have made several hundred flips (on average with an unbiased coin you will need to make 512 flips to generate 128 bits of entropy).

correct. that's what i thought you might say.  thats what i would have said.  

so under the assumption that HT and TH have equal probability that method seems good for eliminating bias but there is that assumption. i guess most people accept it as a fact. which seems not unreasonable to want to do i guess.   to test that assumption one could take their particular coin and toss it a million times and see how often HT and TH showed up. should be about 500k times each. not sure where the cutoff would be to determine the assumption was problematic. maybe around 480k vs 520 ?

[o_e_l_e_o]

so under the assumption that HT and TH have equal probability that method seems good for eliminating bias but there is that assumption.

That's not an assumption - it's pure math.

Let's say your coin is biased to 60% heads, 40% tails. The probability of HT is 0.6*0.4 = 0.24. The probability of TH is 0.4*0.6 = 0.24. The probability is identical. This is the whole premise behind von Neumann's algorithm - you know HT and TH are equally probable without the need to perform any statistical testing of your coin.

[NotATether]

By coincidence, I stumbled upon an article about bias in coin tosses. It reminded me about this topic, hence the 10 month bump.

TL;DR: if you start a coin toll with heads up, there's a 50.8% chance you'll end up with heads.

This is the important part:

Delving into the data further, they found that coin tosses are highly variable between people, with some showing a strong same-side bias and others having none at all – coin tosses may come down (ever so slightly) to the tosser.

Some people have the bias and others don't.

It makes me think: What would a device with a spring to launch the coin do? It would almost certainly eliminate all bias in coin tosses - provided it is engineered properly - and it could even be made into a wearable on your hand that you can use to emulate a traditional coin toss.

[larry_vw_1955]

That's not an assumption - it's pure math.

you're assuming that the outcome of one coin toss does not have any affect on the outcome of the one after it. you model that as though they are "independent" events but that needs to be tested to make sure that is actually the case, don't you think? otherwise how do you know?

Let's say your coin is biased to 60% heads, 40% tails. The probability of HT is 0.6*0.4 = 0.24. The probability of TH is 0.4*0.6 = 0.24. The probability is identical. This is the whole premise behind von Neumann's algorithm - you know HT and TH are equally probable without the need to perform any statistical testing of your coin.

forget about the formulas. talk about the real world tests that justify why they are independent. what tests have you done?   did you flip a coin 10,000 times and count how many HT and TH you got? if not then there could be some systematic bias in the situation that you just arent aware of.

now i'm not saying that this method is inferior to just flipping a biased coin, surely its better than just that.

[o_e_l_e_o]

you're assuming that the outcome of one coin toss does not have any affect on the outcome of the one after it.

As far as the coin goes, it makes no difference. The coin doesn't remember the previous result, and so previous tosses have no bearing on future tosses.

As far as you go, then the solution is as above. If you don't learn the outcome of the first toss, then it cannot bias any subsequent tosses.

[LoyceV]

It makes me think: What would a device with a spring to launch the coin do? It would almost certainly eliminate all bias in coin tosses - provided it is engineered properly - and it could even be made into a wearable on your hand that you can use to emulate a traditional coin toss.

My gut feeling tells me this spring would create the same result every time, because the initial conditions are the same. Unless the spring tension varies, in that case the spring tension becomes your random and you need to make sure there's no bias in it. Or the way you load the coin into the machine.
Just for fun: here's a Machine Flips a Coin 10,000 Times.

[philipma1957]

so under the assumption that HT and TH have equal probability that method seems good for eliminating bias but there is that assumption.

That's not an assumption - it's pure math.

Let's say your coin is biased to 60% heads, 40% tails. The probability of HT is 0.6*0.4 = 0.24. The probability of TH is 0.4*0.6 = 0.24. The probability is identical. This is the whole premise behind von Neumann's algorithm - you know HT and TH are equally probable without the need to perform any statistical testing of your coin.

This finally hit me why it is wrong. The flipping must be done blindfolded and gloved to avoid a biased flipper that does not like your method.

Your assumption is that the coin is biased not the flipper. If it is the flipper your method is not good. Ie the flipper may subconsciously be able to take a neutral perfect coin and make it do heads 60-40

or tails 40-60 on any toss. So he would ruin the neumann method. unless he flips it gloved and blindfolded.

[pinggoki]

My gut feeling tells me this spring would create the same result every time, because the initial conditions are the same. Unless the spring tension varies, in that case the spring tension becomes your random and you need to make sure there's no bias in it. Or the way you load the coin into the machine.
Just for fun: here's a Machine Flips a Coin 10,000 Times.

Wouldn't the coin itself a factor to this too? Especially if you're not using the same coin to do the same flip on the machine and another factor is the atmosphere of the surrounding area and the hardness of the surface where the coin is going to land, the air resistance is always neglected in theory but in practical application, that's always considered right? And regarding the hardness of the surface, there's also the small grooves if the surface isn't smooth. Am I pedantic over this stuff or those can be considered a factor to the fairness of the flip?

We did that kind of experiment back in my freshmen year in college although it's a programming test where we set the times a coin is flipped and then the computer returns the results of the set times that the coin was flipped.