pull down to refresh
How would you screw up dice rolls?
You should never roll for words! Ideally, you take a bunch of dice, roll, append to hash function aligned to the number of dice (and number of sides on your dice) and stream it in, until you have at least enough entropy (50 rolls with a D6 for 128 bits, 99 with a D6 for 256 bits) and then you generate the words per BIP-39 (or equivalent scheme.)
Never focus on the words... ever. They're a mnemonic taken in the middle of a cryptographic process, not source entropy.
You absolutely can roll directly for words.
e.g. https://github.com/sarpulhu/dicebip39
It's safer and easier to verify than imputing the rolls into some device.
So what you're really saying is that the issue is that there is no standard (within Bitcoin) for entropy whitening and therefore you shouldn't do it. That makes sense, though you should realize you're not doing it and protect your mnemonic (and dice) with more care because any bias is directly visible in recorded data - which is why we whiten. (Perhaps you can counter this by, after you generated the entropy, destroying the dice, so that you can't ever use the same set again. Static bias = vuln.)
There's a "standard" inside NIST SP 800-90B (section 3.1.5.1.1, pdf-page 23) - they call it "conditioning" there, but it's sparse, it basically just says "hash it, see our list of certified hashing mechanisms". There are a bunch of random papers, like 2208.11935 but these are all working from an input granularity larger than or equal to the hash function, so it wouldn't be enough for dice where the granularity is smaller (padding is not your friend.)
Maybe it would be good to build a standard, and at least document the tradeoffs.
Oh. Yes. It also means that if you want to be absolutely sure, you have to verify a bunch of cryptographic functions. Which I can't pull off without help from someone that actually does verification of cryptographic functions for a living, so I can never be 100% certain. What I can do is test the hash function against fixtures and be somewhat sure that it does what is advertised. But that is already less than 100%.
However, next time I text you on whitenoise we're likely to be using inferior base entropy there than we would have had when we'd do 100 dice rolls on a coldcard.
Very important point. That's my biggest struggle when deciding roll your own v RNG - Do I trust my own ability?