pull down to refresh
I get that. I don't really get why low entropy without a hint about generation is bad, but people talk about it like it is.
Don't forget that everything after the seed phrase is deterministic and standardized. And even if you just roll 256 bits of random, key derivation is even more standardized.
So the only thing that sits between poor entropy and keys is everything obfuscated that you do to the bitstreams between that and the standardized process, and that no one guesses now or in the future.
For example, maybe doing 2 dice rolls SHAKE256(nil, 512).update(6).update(5).digest(256) is not something anyone is monitoring because why would anyone use about the slowest modern hash there is because NIST required a dumdum?
But the moment someone does it, they have your keys. And it would have taken them at worst a whole 36 guesses.
This gets at part of what I'm wondering about.
Is the mechanism of the vulnerability that people are watching some of these easily derived addresses just in case someone is dumb enough to use them?
In the case of me choosing 12 words, I suppose someone could look at my writing and see what words (or kinds of words) I like and that would reduce the search space. Maybe there are also useful patterns in which kinds of words people generally pick, which would make my habits a refinement of a refinement.
Is the mechanism of the vulnerability that people are watching some of these easily derived addresses just in case someone is dumb enough to use them?
In part. I.e. try any password that is in anyone's password dictionary with billions of entries, through a classic brainwallet, and your funds will even be fought over by multiple people watching these. Same for standard derivation of low amounts of dice rolls with all the known algos. It takes longer for you to read what is on 3, maybe even 4 dice you just rolled than for a modern gpu to calculate the entire range of possible outcomes.
The other part - what is going on now - is that you can just explore a novel search space and find keys as you explore and sweep as you find coin. Like digital mining for gold.
I suppose someone could look at my writing
This would be mostly damaging if this is an expired or low value seed and you have the same bias sitting in other, more high value seeds. Patterns, even ones that you're not aware of can be found. Some weakening is acceptable though, true random means it's also possible you hit exactly the outcome of the sha256('secret') brainwallet - just extremely unlikely.
Addendum: I hear people worried about 70+ bits, but even though that is not acceptable long-term, that search space is already huge. It just means you should fix it now.
Possible but extremely unlikely is the entire security framework, right?
I think even without a hint, if the process itself is easily guessable, you could still be vulnerable.
Like, if you rolled 6 dice to generate your seed, someone could think to themselves one day: hey what if I just roll six dice and scan through the seed space generated by those 6 dice rolls...
I think if your generation process is truly hard to guess (or even stumble upon), then even if the process is deterministic, your seeds could still be safe. But in that case the "entropy" probably comes from the idiosyncratic nature of the process.
Entropy is about the number of arrangements in each state, so while my state has fewer arrangements, the state-space might be sufficiently unknown that no one can plausibly identify that my state exists.
In that sense, it would be lumped together with some collection of other also unknown states that would collectively have a very large number of arrangements.
Exactly. I think.
It's a combination of low entropy with some hint of how the entropy was generated that causes vulnerability, not just low entropy itself.
Since the attacker knew how ColdCard was generating its seeds, they can reproduce the process and scan through the low entropy seed space looking for wallets with coins in them