Hey guys
For the new coins we are thinking of using a new key generaotr
We created a
BTCMiniKey generator.
BTCMiniKeyGenerator uses audio + system randomness + time based randomness.
It is one of the alternatives we are considering.
Please let us know if anyone technically well versed has any feedback.
~
RC
It's nice to see the RC team putting some effort towards improving here. The feedback may sound harsh, but I give it coming from a place of wanting the team to succeed, not to criticise.
DO NOT ROLL YOUR OWN KEYGENS.
There are enough existing, battle tested options. If nothing else, follow one of Krogoth's guides and use a Trezor.
The simple implementation above is a good project implementation, but I would never use it for production:
1. A keygen should avoid pulling in random third party dependencies - even if base58 is trustworthy not, it can be compromised later.
2. The general code quality isn't at a production level for this - there's no error handling in the audio randomness, no enforcement of a minimum number of frames, time-based randomness is known to be weak.
These things work until they don't - you might accidentally run it on a computer with no mic and still get an output that is considerably weaker, with no indication of the weakness until funds are stolen.
If the RC team is inclined to sell keyed items in the future, please buy a good quality hardware wallet and use that to generate keys, or something like samr7's vanitygen. Don't try to DIY this. I spent years building and managing custody systems, there are a lot of ways to get it wrong.
Thank you for the feedback. We appreciate the insights you've shared, especially regarding the risks associated with rolling our own key generators.
To clarify, the BTC mini key generator version we shared was intended to get feedback, and not ready for production. We understand the importance of using well-tested solutions for key generation. But we cannot trust anyone going forward, if someday someone comes and tells that those hardware wallets are also compromised we will be compromised as well.
We took your feedback and updated the audio_randomness.py to address some of the concerns you've raised, particularly around error handling and audio frame rate quality.
What else is concerning? How can we make it ready for production?
Edit: What are the other ways it can go wrong?
Edit2: Using secrets rather than os.urandom() for better randomness
Edit3: Added check for input volume
