Bitcoin Community Embraces Traditional Dice Methods After Hardware Wallet Security Breach
Following a critical vulnerability in Coldcard's entropy generation that enabled hackers to compromise private keys and siphon more than $100M in Bitcoin (BTC), the community is returning to dice-rolling techniques for seed generation.
Following the devastating discovery of a low-entropy vulnerability in Coldcard hardware wallets, which has been connected to publicly documented cryptocurrency thefts that commenced on July 30, Bitcoin users are now reassessing the trust models underlying their hardware wallet configurations.
The mechanics of Coldcard's entropy vulnerability
The Coldcard hardware wallets came equipped with what appeared to be properly functioning STM32 "true random number generators" (TRNGs) designed to leverage physical phenomena to create an unpredictable seed phrase.
Nevertheless, following NVK's decision to undertake a complete firmware overhaul, transitioning from a GPL-licensed open-source framework to a read-only architecture, it appears a critical security weakness was inadvertently created.
Beginning with firmware iteration 4.0.1, which was deployed in March 2021, the hardware relied on MicroPython's Yasmarang PRNG rather than correctly utilizing the STM32 hardware RNG.
The generation of random numbers represents a fundamentally unsolvable challenge within computer science, explaining why the creation of secure, impossible-to-predict private keys must invariably depend on external physical phenomena to some extent.
Industry analysts widely interpreted the deployment of the Yasmarang PRNG as a pre-configured fallback mechanism. Nonetheless, Coinkite has recently challenged this interpretation through a statement on X:
The theory suggesting that Coldcards were configured to automatically revert to a demonstrably insecure seed generation methodology has additionally fueled discussions on X regarding whether this represented an intentionally inserted backdoor.
Bitcoin investigative journalist Hodlnaut theorized that the vulnerability originated from negligent development methodologies and attempts to hide errors through arbitrary modifications.
According to Coinkite's assessment, Mk2 and Mk3 hardware produced seeds containing 40 bits of entropy, whereas the Mk4, Mk5 and Q models managed approximately 70 bits. Both fall dramatically short of the 128 bits necessary for a properly secured 12-word seed phrase.
Since that time, malicious actors have been systematically brute-forcing private keys, successfully stealing in excess of $100 million worth of BTC. The probability of any particular wallet being compromised depends on factors including whether supplementary dice entropy was incorporated, or whether a BIP-39 passphrase and non-standard derivation path were employed.
In response, James O'Beirne has established a monitoring website featuring honeypot addresses, called cktripwire, designed to assess which wallet configurations attackers are successfully compromising.
The protective role of physical entropy generation
The Coldcard vulnerability has once more painfully reinforced one of the cryptocurrency community's fundamental tenets: Don't trust, verify.
Users who chose not to depend on an impenetrable piece of technology to create entropy for the most security-critical component of the procedure, but instead employed a sufficient quantity of dice throws, successfully protected their assets from the vulnerability.
The act of rolling dice represents a straightforward, transparently visible procedure that an average user can personally audit and comprehend instinctively. Validating the TRNG, conversely, would necessitate comprehensive physical examination of the electronics and thorough analysis of the firmware.
Although some individuals have exploited recent developments as justification to proclaim the demise of self-custody, adhering to this optimal practice provides minimal opportunities for a remote adversary.
When the seedphrase is created through physical entropy without depending on the hardware wallet's security mechanisms, the singular true point of failure in wallet creation is eliminated.
The xpub and receiving addresses generated from the seed can be independently verified by importing it into alternative devices.
Nonce exfiltration via an airgap can similarly be detected by confirming whether two devices produce identical RFC 6979-compliant signatures when processing the same unsigned transaction.
Reliable entropy generation therefore constitutes the fundamental requirement for a secure wallet. Numerous methodologies and recommendations for generating it have been circulating on X since the Coldcard vulnerability was publicly disclosed.
Straightforward paper-based approaches, including the chart released by Bitbox, divide the universe of BIP-39 seed words such that a sequence of six dice rolls and a single coinflip can be directly mapped to a seed word without employing electronics.
More advanced templates including the codex32 dice de-biasing worksheet utilize a van Neumann extractor that can be manually calculated to produce a secure seed phrase even when using biased dice.
An alternative approach to dice rolling involves printing the complete BIP-39 seed word list, cutting them into uniformly sized small paper pieces, mixing them comprehensively and subsequently drawing random 24 words. Solutions like Seedsticks or Entropia enhance the convenience and reliability of this method.
Specialized hardware including Frostsnap endeavors to verifiably distribute entropy generation across multiple devices.
Certain users have begun creating their own physical entropy generation devices capable of producing a seedphrase almost as rapidly as electronic hardware.