Are dices for generating seed words fair?

[testingelcrypto]

after reading more about the subject i come to the conclusion that dice rolling is better even if i dont use fair dice.

i used this calculator https://planetcalc.com/2476/ and i found that a die that comes 50% number 1 and the rest of numbers just 10% if i roll it 100 times i still get 216 bits of entrupy.

Am i thinking correct?

[BlackHatCoiner]

after reading more about the subject i come to the conclusion that dice rolling is better even if i dont use fair dice.

It is faster, and most likely sufficient if rolled enough.

Am i thinking correct?

Yes, if you roll it 100 times, then even if it seems completely biased towards 1, it will generate enough entropy. That's the Shannon equation for measuring uncertainty.

I have demonstrated it in here. The probability of a number being 50%, and the rest 5 being 10% each, still gives 2.16 bits of entropy on each roll, which is 0.42 less than in a completely unbiased dice, but enough nevertheless if you simply roll it a few times more.

It simply takes time to verify that the dice won't fare worse than that. In contrast, coin flipping using von Neumann's method necessitates no precautionary measures.

[testingelcrypto]

Depends how certain you want to be that your coin is fair. You can never be 100% sure your coin is fair, but you can asymptotically approach 100% with increasing confidence of ruling out ever smaller biases. For example, to exclude a 55/45 bias with 99% confidence, you would need to flip the coin 664 times. However, to exclude a 51/49 bias with 99% confidence, you would need to flip the coin 16,589 times.

A more practical approach would be to simply use the von Neumann approach I alluded to above. Take any coin and flip it in twice. If the first flip is heads and the second flip is tails, write down 0. If the first flip is tails and the second flip is heads, write down 1. If the two flips are both heads or both tails, don't write down anything. Repeat until you have 128 zeros or ones written down. This method completely eliminates any bias in the coin and produces a uniformly distributed output. It will require a lot less flips than any method to test whether or not your coin is actually fair.

Is this really necessary ? A coin that flips 0.75 heads and 0.25 tails still has 0.81 entropy. just flip it 156 times to be sure you have a good seed phrase. And if you are paranoid go for 200 flips and you are good to go. You only get cracked if the coin is really a bad coin where it goes tails only less than 15% of the time.

Do you agree?

[testingelcrypto]

is the entropy for a die really over 1 bit? if the seed its all zeros and one even if the die has 6 faces its always 50% 50% because we will have to do something like from 1 to 3 choose ZERO from 4 to 6 choose ONE.

[BlackHatCoiner]

does anybody really trust casino dices?

It is said that casino dice is the most fair piece of dice.

is the entropy for a die really over 1 bit? if the seed its all zeros and one even if the die has 6 faces its always 50% 50% because we will have to do something like from 1 to 3 choose ZERO from 4 to 6 choose ONE.

As I have showed in here, a dice that produces near 1 bit of entropy is understandably insecure from the human eye. You can check out how frequent '1's I have got with 75% frequency, it makes a splash. And that's 1.29, with 1 bit it's even more clear that you shouldn't use that dice.

[testingelcrypto]

As I have showed in here, a dice that produces near 1 bit of entropy is understandably insecure from the human eye. You can check out how frequent '1's I have got with 75% frequency, it makes a splash. And that's 1.29, with 1 bit it's even more clear that you shouldn't use that dice.

a  perfect dice doesnt show 1 bit. what i mean is :

a word in the bitcoin seed is something like this : 00011111101

By using a dice i assume people have to say: if dice comes 1 to 3 i will choose number 0 if dice come to 4 to 6 choose number 1

So this is always a 50% 50% making that dice like a coinflip. Am i thinking right?

[BlackHatCoiner]

So this is always a 50% 50% making that dice like a coinflip. Am i thinking right?

Well.. no. That's the case only if the dice is completely unbiased (which is never the case). If, say, {1, 2, 3} have 20% each, then {4, 5, 6} have 13.3% each. This will produce the same result as a coin that is 60% heads and 40% tails.

It doesn't make sense to roll a dice as if you're tossing a coin; toss the coin in the first place using von Neumann's method. It will eliminate any bias and produce theoretically complete randomness.

[testingelcrypto]

The BIP 39 list of words are seemingly random words, in alphabetical order, numbered 0 to 2047. Each word represents an 11 bit number (eleven 0’s and 1’s).

how do you convert the 1 to 6 in a dice to 0 and 1 to get a seed word?
i assume you have to do 1 to 3 is a 0 and 3 to 6 is a 1. This makes like a coinflip.

[BlackHatCoiner]

how do you convert the 1 to 6 in a dice to 0 and 1 to get a seed word?

There are lots of ways. One simple way is to hash the dice result record, e.g. sha256("262351..."); this one might decrease the entropy by a little (here's why). Another simple way is to count bits according to this array:

Code:

1: 00
2: 01
3: 10
4: 11
5: 0
6: 1

That's faster than counting {1, 2, 3} as 0 and {4, 5, 6} as 1, because it adds 1.66 bits on every dice roll, on average.

[testingelcrypto]

Another simple way is to count bits according to this array:

Code:

1: 00
2: 01
3: 10
4: 11
5: 0
6: 1

I like this. Do you like the ideia of adding a coin flip when i am at 10 numbers in order to get the number 11  or this is bad for entropy?

[BlackHatCoiner]

Do you like the ideia of adding a coin flip when i am at 10 numbers in order to get the number 11  or this is bad for entropy?

I like the idea of using von Neumann's method and not some sketchy method you just invented. Use what is tested and reviewed.

[o_e_l_e_o]

Is this really necessary ?

I'll refer you to an answer I gave in another thread on this topic:

Maybe. Maybe not. The numbers given so far in this thread discuss the Shannon entropy, but have you calculated the min-entropy you would achieve from doing this? What randomness extractor algorithm are you planning to use to turn those dice rolls in to usable entropy? How are you converting those dice rolls to binary without introducing modulo bias? It's not as simple as just "roll the dice more" - it's a very complex topic which most people do not fully understand (and I do not profess to either), which is why whenever the topic of manually generating entropy comes up, I always suggest von Neumann's coin flips to simply, quickly, and most importantly verifiably generate 128 or 256 bits of provably unbiased entropy.

If the answer to generating true random numbers was as simple as "Take any old non-random and biased process and just repeat it a bunch of times", there would not be an entire field of research dedicated to it.

We have methods were are provable and verifiable. Why risk everything by coming up with your own ad hoc scheme?

[larry_vw_1955]

We have methods were are provable and verifiable. Why risk everything by coming up with your own ad hoc scheme?

would you consider using a trezor or ledger or some hardware device that you can't really visibly verify what is going on you have to trust that it is generating random numbers? i have a hard time with that. every time i ever thought about using some hardware wallet to do that, i thought maybe i should do one or two just to get it "warmed up" so that's how little i trust an electronic device.

[LoyceV]

would you consider using a trezor or ledger or some hardware device that you can't really visibly verify what is going on you have to trust that it is generating random numbers? i have a hard time with that.

This is one of the reasons I'd never trust a hardware wallet with a lot. But the solution, at least for this part, is simple: create your own seed from flipping coins.

[philipma1957]

does anybody really trust casino dices?

In major casinos they are likely close to 1/6 per spot.

As a very astute player may detect a large bias and bet to their advantage.

[o_e_l_e_o]

would you consider using a trezor or ledger or some hardware device that you can't really visibly verify what is going on you have to trust that it is generating random numbers?

Ledger no, because it is closed source and actively malicious. Trezor maybe since it is open source, but there are a variety of reasons I don't trust Trezor as a company so I'm never going to buy one of their products. I would use an entirely open source hardware wallet like Passport, though, where I can see exactly how it is generating its random numbers.

[larry_vw_1955]

Ledger no, because it is closed source and actively malicious.

and you have stuff like this:

https://www.coindesk.com/business/2023/12/14/defi-protocol-sushis-cto-warns-of-possible-exploit/

It confirmed that a former Ledger employee fell victim to a phishing attack, which allowed a hacker to insert malicious code into Ledger's Connect Kit.


Imagine that, you lose your money because some employee was dumb and let someone else put some wallet draining code into the Ledger. Software attack. I guess part of that wallet draining code had the hacker's Ethereum address so it could send everyone's tokens to him or her. that's really bad security on ledgers part that something like that could even be theoretically possible.

Trezor maybe since it is open source, but there are a variety of reasons I don't trust Trezor as a company so I'm never going to buy one of their products.

plus they're kind of pricey too. but all hardware wallets seem to be really pricey these days. what's the problem with Trezor as a company though, just curious.

I would use an entirely open source hardware wallet like Passport, though, where I can see exactly how it is generating its random numbers.

so if you were storing $1,000,000 (or whatever you consider to be a large amount of money  ) you wouldn't have any issue slapping in 2 AAA batteries into it and the first seed phrase it generates you go with that one?  what if there was some type of electronic glitch?

This is one of the reasons I'd never trust a hardware wallet with a lot.

Yeah I can see why. I don't think I could either. Imagine losing all your bitcoin and then saying "if only I would have just flipped a coin..."

But the solution, at least for this part, is simple: create your own seed from flipping coins.

so you can create your seed phrase by flipping a coin and then use that on the hardware wallet? they let you put in your own seed phrase, i'm assuming. would that be an acceptable thing for you?

[LoyceV]

so you can create your seed phrase by flipping a coin and then use that on the hardware wallet? they let you put in your own seed phrase, i'm assuming. would that be an acceptable thing for you?

Ledger hardware wallets can "phone home" to send your seed phrase, so no, connected to an online computer I still wouldn't trust them. It's basically a hot wallet nowadays.

[larry_vw_1955]

Ledger hardware wallets can "phone home" to send your seed phrase, so no, connected to an online computer I still wouldn't trust them. It's basically a hot wallet nowadays.

i see what you mean: https://cointelegraph.com/news/crypto-community-reacts-to-ledger-wallet-s-secret-recovery-phrase-service

[o_e_l_e_o]

what's the problem with Trezor as a company though, just curious.

They are anti-privacy and actively support blockchain analysis via their partnership with Wasabi.

so if you were storing $1,000,000 (or whatever you consider to be a large amount of money  ) you wouldn't have any issue slapping in 2 AAA batteries into it and the first seed phrase it generates you go with that one?

I'm probably never going to store that much money in a hardware wallet (or indeed, in a single wallet at all). Multiple separate cold storage wallets is the way to go.

Although I would also be using a separately generate and secure passphrase, so even if my seed phrase was compromised my funds would still be protected.

so you can create your seed phrase by flipping a coin and then use that on the hardware wallet? they let you put in your own seed phrase, i'm assuming. would that be an acceptable thing for you?

For an open source and airgapped hardware wallet, yes. For a Ledger device, no.