Dice to Seed - comprehensive guide

[dkbit98]

I found a very nice guide how to use dice to correctly generate strong entropy for your seed words.
This was written by developer Keith Mukai who is one of the meain developers for Seedigner projects.
He is trying to standardize dice seed generation for all wallets, as alternative for using mess combination used by many wallets.

This should be a good reading material even for people who think they know how to use dice for see generation:
https://kdmukai-bot.github.io/seedsigner-ai-analysis/dice/standard.html

[LoyceV]

That was a good read. But still, I'd feel more confident (and less paranoid) if I combine the randomness of this dice seed with a Trezor seed:

This way, even if one of the random inputs is compromised, adding them together ensures it's still completely random.
Real random + flawed random = real random.
Real random + real random = real random.

[BlackHatCoiner]

The dice paranoia is really unjustified. Any dice is fine if you roll it enough times; in SeedSigner, that is 99 times, and even with a completely flawed dice that returns '5' 75% of the times, you're still getting above 128 bits.

Just to understand how flawed this is, you'd be getting roughly 75 times a '5' and roughly five times '1', '2', '3', '4' and '6', each. You'd notice it, and you could just change dice. But even with that flawed dice, you're getting enough entropy.

[LoyceV]

99 times, and even with a completely flawed dice that returns '5' 75% of the times, you're still getting above 128 bits.

Can you show the math on this? My gut feeling tells me this should produce much less than 128 bits entropy, but my statistics is rusty.

[bitmover]

99 times, and even with a completely flawed dice that returns '5' 75% of the times, you're still getting above 128 bits.

Can you show the math on this? My gut feeling tells me this should produce much less than 128 bits entropy, but my statistics is rusty.

Here in the post . He mentions a 50% flawed dice , but looks solid still

https://kdmukai-bot.github.io/seedsigner-ai-analysis/dice/standard.html#quality

I think the point is that the attacker doesn't know that your seed used a flawed dice, and which number is repeating.

The problem is when you created a wallet with a flawed method used by thousands of people and the flaws are known (like coldcard)

[notocactus]

Here in the post . He mentions a 50% flawed dice , but looks solid still

It only looks and is solid till it is compromised, and I only want to try with dice method without flaws. So if it is 50% flawed dice, and I know that from reports, I will never hesitate to abandon that wallet and instantly move my bitcoins to another wallet without flawed dice.

I think the point is that the attacker doesn't know that your seed used a flawed dice, and which number is repeating.

The problem is when you created a wallet with a flawed method used by thousands of people and the flaws are known (like coldcard)

That's true but it also says about a fact that is not comfortable at all because non technical people only can trust technical guys, companies, manufacturers about security and quality of a wallet.

Like I trust Bitcoin Core, trust Electrum because they are very old wallet brands and people technically reviewed those wallets as top notch. I don't know how to do technical things, code reviews and I have no other choice than trusting them while they all can make mistakes from developments, QA/QC to community reviews.

It's stressful during this AI era.

[BlackHatCoiner]

Can you show the math on this? My gut feeling tells me this should produce much less than 128 bits entropy, but my statistics is rusty.

I can show you the math, but you need the gut feeling to be confident, so just think of this: in 99 rolls, you are still going to get about 25 rolls that are not a 5. To crack your sequence, an attacker doesn't just have to guess that 74 of the rolls are 5s; they have to guess which 25 rolls are the non-5s (there are massive combinations of just placing 25 items in 99 slots), and then they have to guess what specific number (1, 2, 3, 4, or 6) each of those 25 rolls landed on. The sheer combination of where the rare rolls happen, and what they are, easily eclipses the 2^128 possibilities.

C(99, 25) = 6.44 x 10^23, or 644 sextillion different ways just to arrange the positions of the non-5 rolls.

Once the attacker guesses the correct 25 slots, they have to guess what specific number landed in each of those slots. Since the dice has six sides and we know these aren't 5s, there are 5 remaining possibilities (1, 2, 3, 4, or 6) for each of the 25 slots.

That's 5^25 = 2.98 x 10^17. That is another 298 quadrillion possibilities just for the values of those rare rolls.

In total, that's 1.92 x 10^41 unique ways to roll exactly 25 non-fives and 74 fives on 99 dice. For the record, 2^128 is 3.4 x 10^38.