How Do I Know My Wallet Seed Generator Has High Enough Entropy?

[Basels]

I've read about hacks as a result of low entropy seed generator. What practical ways can I ensure that my wallet's seed randomness is high enough to avoid being predictable by a hacker?

Can entropy of my Electrum wallet be improved or is it just high enough the way it is?

[OmegaStarScream]

You don't really need to do anything, but if you want to add another layer of security, I would add a custom word(s) to the seedphrase. Just make sure you to store that separately from the original seed otherwise it would defeat its whole purpose.

[Ruttoshi]

Electrum seed phrase by default has a good entropy and no need for you to worry about it because it's 132 bit of entropy. Other wallets using BIP 39 seed has 128 bit of entropy which is also strong but that of Electrum is stronger than it. Don't generate your seed phrase yourself if you don't know what to do to avoid generating that with a weak entropy because there must be a high level of randomness in those words you're selecting for your seed phrase. Just add passphrase to your seed phrase.

[Charles-Tim]

Electrum uses your operating system's cryptographic random-number generator (CSPRNG) to generate entropy which is said to be secure. Electrum Seed Version System is used to convert the entropy to seed phrase. This is a very secure means of generating seed phrase.

Electrum is one of the wallet that you can trust for generating your seed phrase.

Electrum seed phrase by default has a good entropy and no need for you to worry about it because it's 132 bit of entropy. Other wallets using BIP 39 seed has 128 bit of entropy which is also strong but that of Electrum is stronger than it.

You are correct about the bits, but nothing is stronger than 128 bits when discussing about bitcoin.

[Zaguru12]

Electrum seed phrase by default has a good entropy and no need for you to worry about it because it's 132 bit of entropy. Other wallets using BIP 39 seed has 128 bit of entropy which is also strong but that of Electrum is stronger than it.

The electrum bits is higher than the bip39 12 words seed phrase due to its checksum bits but that doesn’t make it any much stronger than the bip39 technically because with the bitcoin private key having the 128 bits entropy regardless of the number of words in seed phrase any other higher bits is just not technically better.

The 128bits is just enough if not many people will just generate wallet with higher seed phrases like 24 words which has 264 bits of entropy.

[Livingleged]

Can entropy of my Electrum wallet be improved or is it just high enough the way it is?

There would be no need to try to improve your seed by improving or  increasing the entropy if those seed was generated by electrum it self. Because electrum’s standard seed generation is already designed to provide sufficient randomness for bitcoin security. The 12 word electrum seed already gives you 132 bit of entropy. This it represent an enormous number  of possible seed.

I would also want to add this;
If the electrum generated your seed, then you shouldn’t be worried just keep using it, it’s secured enough. But if you created your seed manually I think it’s better you create a new wallet using trust software that provides enough randomness. And if you’re suspecting that your seed generator was compromised, then it will be better to just create a new wallet in a trusted environment and move your bitcoin there.

[DireWolfM14]

To be sure your wallet has sufficient entropy, you need to validate the code.  Trust, but verify.  Do your own research.  Don't take the word of a bunch of keyboard warriors paid to post on Bitcointalk.org.  

Sure, that's easier said than done for most of us who are not programmers, but this is one of the use cases where AI comes in handy.

Electrum has been around for a long time, and it's been vetted by many unbiased individuals who have nothing to gain (and in some cases, everything to lose) by hiding errors or maliciousness in the code.  But, that doesn't mean you should not do your own due diligence.  I did a quick google search and came up with the file that defines the entropy used for seed generation:

https://github.com/spesmilo/electrum/blob/master/electrum/mnemonic.py#L207

Code:

    def make_seed(self, *, seed_type: str | None = None, num_bits: int | None = None) -> str:
        from .keystore import bip39_is_checksum_valid
        if seed_type is None:
            seed_type = 'segwit'
        if num_bits is None:
            num_bits = 132
        prefix = version.seed_prefix(seed_type)
        # increase num_bits in order to obtain a uniform distribution for the last word
        bpw = math.log(len(self.wordlist), 2)
        num_bits = int(math.ceil(num_bits/bpw) * bpw)
        self.logger.info(f"make_seed. prefix: '{prefix}', entropy: {num_bits} bits")
        # generate random
        entropy = 1
        while entropy < pow(2, num_bits - bpw):  # try again if seed would not contain enough words
            entropy = crandom.get_rand_below(pow(2, num_bits))
        # brute-force seed that has correct "version number"
        nonce = 0
        while True:
            nonce += 1
            i = entropy + nonce
            seed = self.mnemonic_encode(i)
            if i != self.mnemonic_decode(seed):
                raise Exception('Cannot extract same entropy from mnemonic!')
            if is_old_seed(seed):
                continue
            # Make sure the mnemonic we generate is not also a valid bip39 seed
            # by accident. Note that this test has not always been done historically,
            # so it cannot be relied upon.
            if bip39_is_checksum_valid(seed, wordlist=self.wordlist) == (True, True):
                continue
            if is_new_seed(seed, prefix):
                break
        num_words = len(seed.split())
        self.logger.info(f'{num_words} words')
        if (final_seed_type := calc_seed_type(seed)) != seed_type:
            # note: I guess this can probabilistically happen for old "2fa" seeds that depend on the word count
            raise Exception(f"{final_seed_type=!r} does not match requested {seed_type=!r}. have {num_words=!r}")
        return seed

[nc50lc]

Can entropy of my Electrum wallet be improved or is it just high enough the way it is?

It's high enough as it is and it's been that way since the early versions as old as v2.0.
Hacks happened in other wallets and Electrum's seed stays strong.

As for this question... your seed phrase is the mnemonic-encoded entropy, if you want to improve that;
Either change the code to incorporate more random sources to the entropy since it's hard coded to not accept any other inputs from the user.
Or add a game-changing solution to this feature request issue (additional user-input entropy): github.com/spesmilo/electrum/issues/523
Or just follow the first suggested solution: make use "seed phrase extension", a.k.a passphrase, that'll be used as salt when hashing the mnemonic so that the entire wallet's private keys wont be based from the entropy alone.

[Basels]

To be sure your wallet has sufficient entropy, you need to validate the code.  Trust, but verify.  Do your own research.  Don't take the word of a bunch of keyboard warriors paid to post on Bitcointalk.org.  

Sure, that's easier said than done for most of us who are not programmers, but this is one of the use cases where AI comes in handy.

Electrum has been around for a long time, and it's been vetted by many unbiased individuals who have nothing to gain (and in some cases, everything to lose) by hiding errors or maliciousness in the code.  But, that doesn't mean you should not do your own due diligence.  I did a quick google search and came up with the file that defines the entropy used for seed generation:

 

Yeah I know people have high regard for Electrum. though I doubt that should be a criteria for trusting it. I noticed on Reddit that Coldcard was one of the most highly regarded hardware wallets before the exploit.

You don't really need to do anything, but if you want to add another layer of security, I would add a custom word(s) to the seedphrase. Just make sure you to store that separately from the original seed otherwise it would defeat its whole purpose.

The added seed shouldn't be random word(s) I suppose, but from the list of seed words?

[EL MOHA]

Yeah I know people have high regard for Electrum. though I doubt that should be a criteria for trusting it. I noticed on Reddit that Coldcard was one of the most highly regarded hardware wallets before the exploit.

Yes coldcard was popular but there were information about those earlier versions of cold card not having entropy but right now we all know that electrum meets the minimum entropy requirement for security which is 128 bits. Plus cold card moving to source verifiable was questionable too.

The added seed shouldn't be random word(s) I suppose, but from the list of seed words?

Do not use words from the list of those 2048 Bip 39 seed words if that’s what you are asking. Your passphrase should be random with different characters in it and should be longer like 15 plus characters for a word with even uppercase and lowercase missed. This will make it more unpredictable.

Using the words from the list of those seed words wouldn’t create enough randomness. In fact it’s even better not to use any word accustomed to you like, family name, pet name, your addresses and many things like that so it is not easily predictable.

[DireWolfM14]

The added seed shouldn't be random word(s) I suppose, but from the list of seed words?

The additional extension is referred to as a passphrase, not an added seed.  Although there's nothing stopping you from using a separate seed phrase as a passphrase, the passphrase function is more versatile than that.  It's is case sensitive, can have upper and lower case characters, numerals, and special characters.  Utilizing the entire keyboard's set of characters can give you 256 bits of entropy in about 39 to 40 characters.

Entropy of wallet doesn't compound, but it does make the wallet more difficult to hack.  For example, no matter how much entropy your seed phrase contains (i.e. 128 bit 12-word seed phrase, or a 256 bit 24-word seed phrase), or your how much entropy your passphrase (extension) provides, the private and public key pair of any single bitcoin address only has 128 bits of entropy.

[hosemary]

Although there's nothing stopping you from using a separate seed phrase as a passphrase, the passphrase function is more versatile than that.  It's is case sensitive, can have upper and lower case characters, numerals, and special characters.  

A passphrase added to an Electrum seed phrase isn't case sensitive.
Since the discussion in this thread is about Electrum, I assumed you were talking about Electrum seed phrases. If your seed phrase is BIP39, your passphrase would be case sensitive.

[DireWolfM14]

A passphrase added to an Electrum seed phrase isn't case sensitive.

Interesting.  I don't use Electrum seeds, so I was't aware of that.  Thanks for the correction.

[nc50lc]

A passphrase added to an Electrum seed phrase isn't case sensitive.

Interesting.  I don't use Electrum seeds, so I was't aware of that.  Thanks for the correction.

For reference, the normalization code is just above the quoted parts of "mnemonic.py" that you've shared above.
Look for the function "normalize_text" (L81) which is used to normalize the passphrase in "mnemonic_to_seed" (L171)