Audio-based entropy wallet

[barrysty1e]

After the recent entropy flaws with a number of hardware wallets, this is a new idea as to how to gather entropy.

Once the wallet detects audio, it chooses 32 separate frames (based on amplitude), uses the raw audio data captured, performs sha256 on each frame, appends the result to a big buffer (approx 1024 bytes) and then finally performs sha256 on this buffer to obtain the entropy.

Simply put, even the same audio, with the same timing, volume, hardware - is going to yield a different result each time. Approximately 85kb of C++ (including derivation, mnemonic and crypto code) linked against SDL2 and libsecp256k1.

So far it works with 128 bit (12 words), 192 bit (18 words) and 256 bit (24 words).
Derives P2PKH, P2SH and P2WPKH for Satoshi-based currencies; would be very easy to extend to Web3 currencies etc.

Relying on hardware RNG/CSPRNG doesn't always bode well (the hardware itself could be flawed/backdoored, not to mention the firmware being buggy), so this is an innovative new take on the solution.

Shrinking this down to work on something like an STM32 microcontroller wouldn't be difficult.

Thoughts?

https://www.youtube.com/watch?v=BmQPF9dN55Q

[free-bit.co.in]

I find this idea quite interesting.
Actually, just saying that we have TRNG is not enough today.
We also need to see if that entropy is finally reaching to key generation correctly.
Even a small mistake in firmware can ruin our entire security.

Well, you said that 32 audio frame are being selected based on amplitude. Is this frame selection deterministic?
If the rule for selecting frames from same audio is predictable then how do you actually verify how much min-entropy is available?

You may know that SHA-256 in Cryptography does not create entropy. Rather it compresses & conditions the existing entropy. If the entropy in input is low, it will not automatically increase even if hashed.

[Findingnemo]

Audio for the encryption? Looks like we are progressing in backwards because it is proven that even biometrics can be mimicked and once we thought it is impossible thing can be breached in matter of minutes, so imagine an AI just steals your wallet because it can imitate your voice or something.

I am not an expert so eager to read how this entropy works.

[free-bit.co.in]

Audio for the encryption? Looks like we are progressing in backwards because it is proven that even biometrics can be mimicked and once we thought it is impossible thing can be breached in matter of minutes, so imagine an AI just steals your wallet because it can imitate your voice or something.

I am not an expert so eager to read how this entropy works.

But there is one good thing about this idea, though.

In here you don't have to blindly trust any hardware RNG. Instead, an independent physical entropy source is used.

In my opinion it would be even better if audio entropy could be mixed with dice roll or other independent entropy sources. Then even if one source is compromised, the other source would help you to keep the whole system unpredictable.

really interesting idea, tbh.