This guide aims to educate the reader in a learning-by-doing fashion. However, it does not make any guarantees or promises, and does not take any responsibility for what anyone does with this material.
Note: There was a reddit post that pointed out
The lookup table says "roll again, need 1 or 2" for the T342 ticket. That results in the words "zone" and "zoo" being 3 times more likely to appear in the seed phrase than any other word.
The correct instruction would be to replace the ticket in the bag and draw again rather than just re-rolling the die.
But another commenter remarks that this issue has since been fixed.
Also, beware some die have up to 10% face bias. Casinos quality dice can mitigate this.
The only problem I have with this apparently increasing popular hack - because you're literally the second stacker to mention it in like 2 hours - is that a mnemonic was meant to be derived as an intermediate step, from a normalized / harmonized bitstring that smoothed out any bias (as long as you pass enough entropy to it) rather than a recording of raw entropy.
Now, luckily, there is a second step of static-salted hashing happening after the words, so it should not matter a lot for your final keys, but it does matter in the exposure of your seeds. If there is any bias in your dice, this will be reflected in the words. If the words leak, especially more than one set, you may have an issue.
Is this a bigger problem than an RNG with 40 bits of entropy? No.
Is it wise to refabricate a protocol and skip a step? Also no.
Do you mean physically rolling dice?
I might have been reading the other stacker you are referring to when I recalled and then shared this. I thought it would shed some light on the subject.
No, rolling "words" directly instead of rolling "bytes" into a hash function and then calculating the words from the digest.
The thing about the hash function is that it what they call "whitens" the entropy - i.e. it masks patterns that otherwise remain visible while not reducing entropy[1]
Now it makes sense. I was worried! We've seen it in the past that everyone panicks into another bad solution and this time it's a rather huge panic.
at least, according to my buddy who is a cryptographer and I still think he is full of shit - I'm stubborn like that. I asked him about this in respect to some odd sentence in one of the NiST recommendations about quantum entropy requirements where they said that even if Grovers' halves the security of a hash - say sha512, if you feed it 512 bits entropy then technically the key after a hash that is only offering 256 bits of security is still 512 bits strong from an entropy perspective. Mind blown, but this is what the big brains say so I should just shutttt uppppp. ↩
It's mostly over my head.
My understanding is 128 bits is enough, 256 is better. At least until quantum.
As long as your wallet is not 'broken' and you've taken precautions not to leak your seed, you don't need to be panicking. The upshot of this attack will be more heavily audited code. And yet, we are entering into a war of attrition, where the side with more compute seems to take the win.
Well that's why I said it is not as bad as entropy problems, but it is really not smart to reinvent a mechanism and then leaving out a step, but sure. Just be aware of what you're doing. And if your spouse runs off with your seed phrases with the intent of being a rich ex-spouse, or you get that soft knock and then a bang and then a whole bunch of assholes in riot gear break through your wall and take it all, then lets hope you remember to use a different method of generating entropy when you recover and need a place to stack newly sweat blood and tear'd for sats.
Not realy. If rob1ham can cover 100 projects with 10k dirty fiat coins then we're not talking cost at all - it means it's negligible (which I too think it is from personal experience). It's just that there are more blackhats than whitehats because every thief wants to steal your bitcoin, which is significantly more people than there are willing to defend your bitcoin.
PS: 128 is the minimum. don't listen to spooks telling you to do less than what you're comfortable with. I did 99 rolls and according to my footnote above, smart people with actual degrees in cryptography think I'm right to do so (even tho I think they're full of shit)
What? People with degrees full of shit? I wouldn't know ;P
I meant attrition on the sense that the 'prize' goes to those willing to expend the resources first. Which, I guess, Hamilton is promoting himself as being?
If there is one thing I feel confident in saying it is that I am out of depth talking cryptography, wallets etc. Grateful to have dodged the CC bullet and to live another day to level up my knowledge. Grateful also for folks who are generous in sharing what they know, sharing their time, resources, etc., because this is an important project to them. I count you and Rob among them.
Is there a relationship to badly generated seed phrases, or were you just being extra loquacious to make a point?
The other day I discovered this "pyrrhic defeat" which apparently in criminology means that you must always let some criminals win so that you can control the public with exactly the fear you need them to have to grant you more power than they should be giving you.
Like: see? We told you. Open models bad. Closed models safe. Use closed, nerf'd models, pay more than they're worth. We keep you safe (and enslaved)
Me? I literally failed to see this damn thing for years. I don't think highly of me and you shouldn't either. Also I was selfish because when I emptied the cc I didn't care about it anymore. Could have ran it through the improved ongoing review I have for things I do use... Lame opti. Just I do know a thing or 2 about cryptosystems and how they are implemented and that in these things, weaknesses get exploited.
Well... Its not unprecedented that some of the guys that are put above the law use any information they can get their fingers on to enrich themselves.
The knock and bang may have been added to make a point tho, lol.
Just thought of a photo-based method. I know it’s a thing, but I’m not sure if the entropy is legit enough for this kind of use.
Would you want to use a secret photo as a source of entropy?
I was thinking about taking a few (30+?) pics just for this exact thing.
I think you need 1 high res one raw bytes not jpeg, with the cap on. Then you get all the random cosmic shit. And hash it.
Edit: oh and apparenly only take LSB because that's where all the random is sitting.
??
Can't use JPEG because it's compressed and the algo is known? How many 6 dice rolls does a full HD photo equal anyway?
Yeah JPEG compresses off the raw stuff you want. And landscape patterns or faces or any other scene aren't random; AI generates half of the images on the internet rn.
So what you want is to take out all the non-random stuff of an actual photo and just use photon timing, sensor errors, etcetera.
Seems it would be a lot better for hardware wallet vendors to have this 24th word picker on the hardware wallets as a feature. If you were going to end up putting the words into a hardware wallet anyway, might as well have it calculate the 24th word for you.