Help generating true 256-bits entropy wallet

[Hispo]

Hello, and good evening to all our Bitcoin community. 

I will keep it short.
After the Coldcard fiasco and the indiscriminate theft of millions of dollars from cold wallets which were supposed to be state-of-the-art in this industry, I don't longer have any trust on random number generators running on hardware wallets. I have decided to use my own entropy.

The problem is the fact I have never done such a thing before, so I would like your guidance.

I am planning to print, cut and have all possible seed words in a bag or something similar, so I violently shake it and get each word of my seed, eventually import that seed onto a Trezor without typing on the computer.

Is there some tutorial to do this? Because someone mentioned here on the forum about getting only 23 words and something about a checksum.

Thanks in advance. 

[OcTradism]

After the Coldcard fiasco and the indiscriminate theft of millions of dollars from cold wallets which were supposed to be state-of-the-art in this industry, I don't longer have any trust on random number generators running on hardware wallets. I have decided to use my own entropy.

The problem is the fact I have never done such a thing before, so I would like your guidance.

It's an important thing to do for your bitcoin safety and if you have never done that before, I see it is very risky to do that by yourself.
Even wallet manufacturers can make mistakes, how do you strongly believe that you as an amateur can do that by yourself rightly?

BIP-39: Entropy, checksum and word length

|

Entropy (bits)

|

Checksum (bits)

|

Entropy + checksum (bits)

|

Recovery code words

|

|

128

|

4

|

132

|

12

|

|

160

|

5

|

165

|

15

|

|

192

|

6

|

198

|

18

|

|

224

|

7

|

231

|

21

|

|

256

|

8

|

264

|

24

|

https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch05_wallets.adoc#generating_entropy_and_encoding

[CucakRowo]

someone mentioned here on the forum about getting only 23 words and something about a checksum.

You can not pick 12th or 24th word randomly. Final word contains the checksum, 4 bits for 12-word phrase and 8 bits for 24-word phrase.

So if you randomly pick all 24 words from a bag, there is only a 1 in 256 chance that the resulting phrase will have a valid checksum. Roughly 99% of the time you will end up with an invalid mnemonic.

[Antidote47k]

If you’re really interested in generating entropy yourself rather than relying on wallet RNG, I don’t think randomly picking words from a bag is the right way to do it, from my understanding bip39 usually starts with random entropy then proceeds to add a checksum before converting it to the mnemonic phrase, if you’re set on doing it manually then you should probably look into the dice method.

The concept isn’t to use the dice to directly choose the 24 word, but to use the repeated dice rolls as the source of random entropy, so basically it a physical source of randomness which doesn’t necessarily entail manual choosing of words and the resulting randomness can be converted into a valid seed phrase.
Came across this guide from coldcard which explains how many rolls are needed for 128-bit or 256-bit entropy and how the result can be verified. Although I haven’t personally used this method, if it’s done right way I don’t see any reason why it shouldn’t work with Trezor but I’m also interested to hear from anyone that has actually generated a seed phrase using this method.

[Zaguru12]

Is there some tutorial to do this? Because someone mentioned here on the forum about getting only 23 words and something about a checksum.

Yes it’s simply writing out all the 2048 words from the bpip-39 word lists, they should be in column and then cut out each word put it in a big bow and then you simply shake up the bow pick a word write it down and put the paper back into the bow again and repeat the process for 23 times to get 23 word. For the last word (24th) word which will contain the checksum then you allow seedsigner (Krux hardware wallet) to do this for you and then you have a 24 word valid seed phrase

Follow this step by Meuserna

My addition will simply be that I will combine mine with one dice, I will roll the dice and the number that appears is the number of time I will shake the bowl with each shake around 10 seconds before picking my word. And also I will prefer using 7 plus passphrase with words outside the Bip-39 word lists.

If you also want to actually use dice roll method and then this tutorial by NotATether on How to use dice and a Seedsigner to make a seed phrase (with pictures) will help

If you’re really interested in generating entropy yourself rather than relying on wallet RNG, I don’t think randomly picking words from a bag is the right way to do it, from my understanding bip39 usually starts with random entropy then proceeds to add a checksum before converting it to the mnemonic phrase, if you’re set on doing it manually then you should probably look into the dice method.

Picking the word can still do it if you allow a seedsigner to help you pick the last word as this generate a valid checksum for you

[Ayers]

Your approach of manually printing, cutting, and shaking, then picking random words isn't particularly secure.

I'd recommend using D6 dice roll to generate your entropy instead.

For 128-bit entropy, you need at least 50+ rolls. If you want 256-bit entropy then you need 99+ rolls. Record the result of each roll on paper in the exact order you rolled them.

Then download Mnemonic Code Converter by ancoleman, bip39-standalone.html file directly from the official GitHub repository and save it to a USB drive.

On an air-gapped device, (I would suggest Linux Live bootable usb OS) open your bip39-standalone.html in a browser, you will find an entropy input box,  enter the entropy generated from your dice roll. It will generate BIP39 mnemonic for you. For 256-bit entropy, that will give you 24-word seed phrase.

[Don Pedro Dinero]

<...>

Looking at your question, Hispo, and the replies you’ve received so far, what springs to mind is that if anyone was hoping for widespread P2P adoption, they can forget about it now. My aunt pays by mobile and manages her savings using her bank’s app. I wonder how I’m supposed to convince her that she has to go through an incredibly complicated process to convert her funds into bitcoin and custody them herself. Also, at least until recently, it was supposed to be the best asset for beating inflation, but the price isn’t looking too good either. Given this, the general public – the masses – will, if they buy bitcoin at all, do so through an ETF or similar products.

I've reported the thread to be moved to Bitcoin Technical Support, by the way.

[LoyceV]

For my next seed phrase, I'm going to add my own entropy to Trezor's entropy. I'm not planning to do this any time soon, as it's going to be time-consuming to do safe (offline, on an air-gapped system running from RAM without storage, closed curtains and no recording devices phones nearby).
My (current) plan: get a new seed phrase from Trezor, convert it to binary:
1011011010101 etcetera.
Flip a coin 256 times:
0101101101010 etcetera.
Add the digits together:
1. 1+0=1
2. 0+1=1
3. 1+0=1
4. 1+1=0
5. 0+1=1
6. 0+1=1
7. 1+1=0
....
255. 1+1=0
256. 0+0=0
I'll create my new seed phrase from this. I'll use and compare different pieces of software to make sure both create the same seed phrase from the binary input.
This way, even if one of the random inputs is compromised, adding them together ensures it's still completely random.
Real random + flawed random = real random.
Real random + real random = real random.

Being paranoid doesn't mean they're not trying to get your coins!

[bitmover]

For my next seed phrase, I'm going to add my own entropy to Trezor's entropy. I'm not planning to do this any time soon, as it's going to be time-consuming to do safe (offline, on an air-gapped system running from RAM without storage, closed curtains and no recording devices phones nearby).
My (current) plan: get a new seed phrase from Trezor, convert it to binary:
1011011010101 etcetera.
Flip a coin 256 times:
0101101101010 etcetera.
Add the digits together:
1. 1+0=1
2. 0+1=1
3. 1+0=1
4. 1+1=0
5. 0+1=1
6. 0+1=1
7. 1+1=1
....
255. 1+1=0
256. 0+0=0
I'll create my new seed phrase from this. I'll use and compare different pieces of software to make sure both create the same seed phrase from the binary input.
This way, even if one of the random inputs is compromised, adding them together ensures it's still completely random.
Real random + flawed random = real random.
Real random + real random = real random.

Being paranoid doesn't mean they're not trying to get your coins!

I think you can generate the seed from the binary using iancoleman.io/bip39 tool
Just click on show entropy details

 

[LoyceV]

I think you can generate the seed from the binary using iancoleman.io/bip39 tool

I'd kinda want to manually verify it, see if I get the same seed words. But like I said, no rush

[nc50lc]

I am planning to print, cut and have all possible seed words in a bag or something similar, so I violently shake it and get each word of my seed, eventually import that seed onto a Trezor without typing on the computer.

I don't know your exact meaning for saying "true" 256-bits.
But since its entropy is via "physical" object(s), then to get a true random result with that range, the number of rolls should be the same as your target bits.
Your original plan is essentially only 23 pulls even if it's from 2048 options, looks good enough on paper (2048^23) but the number of randomness that's physically performed is low.
In other words, you're generating 11-bits per pull (11-bits randomized in one physical attempt) rather than randomizing each bit.

So IMO, it must be 256-flips using a 2 sided coin for it to be truly 1:1 with 2^256, not just "mathematically" equal.

But this doesn't mean that a D6 or other famous air-gap method isn't secure.
It's just the physical generation of 256-bit, bit-by-bit as a response to your "true 256-bit" random entropy.

[Cricktor]

It very much looks like an XOR operation how you combine the entropies from your Trezor and your coin flips, but while you do

4. 1+1=0

you on the other hand do

7. 1+1=1

May I ask, why?

From what I've read so far and my personal recommendation is: combine different entropies strictly via XOR. I forgot and didn't save the sources but it was always XOR, either if you want to scramble some bit-stream with a random bit-stream or if you're not sure if an input bit-stream could be biased in some way, you can make it safe by XORing it with an as good-as-possible random bit-stream.

Regarding coin tosses, I'd recommend reading https://en.wikipedia.org/wiki/Fair_coin, especially the section "Fair results from a biased coin". I'm not an expert on statistics. It is my understanding that applying the described procedure should also mitigate potential bias by the way how a person tosses any coin, even a perfectly fair one.

[LoyceV]

7. 1+1=0

May I ask, why?

Sorry, that was a typo. I've corrected it (also inside your quote). It's going to need a lot of double checking to do this manually.