Topic: Generating a seed phrase with biased dice (Read 458 times)

Did some poking around, they are showing not available from a bunch of different IPs when going to Amazon.
Guess since it's 'sold by' someone else but shipped from Amazon they are only in the US warehouses.
If you want a set PM me and I'll ship them to you. Going to be interesting as what to put on the customs form....

---

Dice for seeds has been done for a while, and as discussed they just add to the entropy from the device.
BUT if the entropy is bad / wrong on the device and the dice are loaded not just biased? Over a large enough set of wallet creation with rolls you can run into other people generating the same info. The question is how many. But, you also then have to answer how bad is the entropy and how loaded are the dice.

-Dave

Coldcard provides all three options - PRNG only, PRNG + dice, or dice only.

https://coldcard.com/docs/middle-ground/#generating-seed-words
https://coldcard.com/docs/paranoid/#generating-seed-words-with-256-bits-of-entropy-by-dice-rolls

In the thread I linked, the OP chose dice only and then proceeded with a single dice roll of 5. You can verify this yourself by going to Ian Coleman, showing entropy, putting in "5", choosing dice rolls, choosing 24 words, choosing BIP 84, and generating the same addresses as OP:

https://mempool.space/address/bc1qln3mjur5h67xenn04vepunx27fhpvfgvqgwelx
https://mempool.space/address/bc1qmq80v8cxlsuwkxc8yt7hzjf05jyga3q5uea9uk

No, I am not from the US, and currently not logged in to my Amazon account either. I am still getting a "Product Unavailable" description, though.

According to the calculations by BlackHatCoiner, even a visibly biased die is good enough to create enough entropy. And based on what Coldcard's documentation says, the entropy from dice is just an extra that goes on top of the hardware-generated entropy from the device.

I see them as available here, are you US based?

The biggest issue is HOW loaded they are. Are you going to roll 20% more sixes or 50% more 90% more?
I would think that if you didn't know they were loaded after a few rolls it would be obvious. But the question would be how many till you go hmmmmm something is wrong here.

-Dave

Oh sure, this is not about dice games, my mistake, my brain always thinks about dice and when I read word biased, I quickly thought it was about the problem with provably fairness.

I don't say you shouldn't use any software other than Electrum. I simply suggest to use what has been used and tested for years in bitcoin industry, what has been proven to be safe and reliable. You can use Sparrow, no problem but it doesn't have android or ios app if that matters for you.

Btw if seed phrase randomness is a problem for you, then I would use vanity address generator on airgapped personal computer and generate bitcoin address with short random prefix. You'll receive private keys that there is absolutely no way they'll be biased or untrustworthy.

There is an interesting experiment that someone like BlackHatCoiner and possibly o_e_l_e_o could partake in. The dice that you linked to aren't available anymore, but if they could get an equal set, it would be fun to see how much entropy you could generate despite their bias towards rolling sixes.

Slightly OT, but something that was said to me years ago that stuck.

All 6 sided casino dice are biased over hundreds of thousands of rolls. They are man made and will show it given time. But in the short term of hours that they are actually on the table it does not matter.

If the dice here that @Pmalek are not used for anything else and came from an unknown source then it will never matter because there is still enough randomness in them.

Now, loaded dice: https://www.amazon.com/Character-Builder-Loaded-Koplow-Games/dp/B001N1JIU8 that is a different thing.

-Dave

That's interesting. I didn't know that. I thought that if you select the dice rolls seed generation method, that the entropy comes only from that source. But according to the documentation you linked to, 256 bits of entropy is already generated from Coldcard's hardware and the dice rolls are an addition on too of that.

But if that is true, I don't know how to explain this situation that o_e_l_e_o shared a few posts above. The user claims to have rolled a dice and got a '5' which he used to generate his seed. I seriously doubt he used advanced methods to bypass Coldcard's automatic entropy generation (the automated one you talked about), but still got his coins stolen (allegedly) within minutes. The whole story could, of course, be a a smear campaign and complete bullshit, but it's still different from what you said and what the Coldcard docs claim. 

It's already happening in the background on Coldcard - https://coldcard.com/docs/faq/#entropy


Every time you roll the dice, also flip a coin.  If the coin lands heads, keep the dice result.  If the coin lands tails, invert the dice and record that result instead.

With that logic, you could also ask why would anyone use any other wallet than Electrum. And still we have loads of software, better or worse than Electrum. Electrum doesn't generate BIP39 seeds, which is the standard for many other wallets. They have their own unique system that is older than BIP39 but far less represented in other wallets. So that's one reason. It also seems to me that you have confused dice and a die with the casino game Dice. This isn't about dice games.

How can you verify that your seed is generated randomly, on a hardware level? Short answer: you can't. You can rely on cryptographic libraries, which rock and the like, but when it comes to generating random numbers, while CSRNG are pretty good sources, there is no manner to verify they aren't tampered whatsoever.

Tossing coin can provide complete and provable randomness. It doesn't go more transparent user interface than that.

Is there any reason to generate seed phrase with dice when you can generate it in Electrum? There is no reason and when problem is easy to solve, you shouldn't start looking for more complex solutions.
If we want to get number 2 by adding some numbers to each other, easy solution is: 1 + 1 = 2
Hard solution is: 49+60-5+17+43-150+12-24 = 2

I hope I explained well what I wante to say. If OP's discussion is just a theory, then my answer will be that you are safe to generate a see phrase with biased dice if no one knows that you are generating a seed when you roll dice. There are millions of rolls every day on many casinos, if no one knows that during 10:18 - 10:20 Pmalek logged in in his account and played dice and saved their results on paper, then there is absolutely no way someone will be able to hack your wallet.

That would have defeated the purpose of him buying a new hardware wallet. He bought his Coldcard to get away from Ledger that he lost his trust in. Obviously, you have to move away from the old seed phrase also.

They can at least add a warning message informing users if the provided number of dice rolls isn't sufficient enough for a safe wallet. After that, it's up to the user to make a greater effort. It's easy to blame the user after something like this, but honestly, I don't know what he was thinking.

Handing over freedom to users; decentralization. Still has disadvantages like self-destructive mistakes. Most cold card guides I've read suggest for 100 rolls or more, but from his responses he never looked into it. He thought it'll be just like his ledger wallet experience. I'd support one of the responses on the thread; saying that inexperienced users should use the coldcard generated seed phrase. Instead of using the rolling dice feature of generating seed phrase. He shot himself on the leg trying to increase the security or entropy of his seed phrase; make it hard to guess or brute-force. Cold card is not to blame. It's not their responsibility. As they were not present with the user to guide them physically, on how to use the dice generated seed feature. With their true random number generator in the hardware chip. The hardware's seed picking methods are still secure against attackers.  Not every user can boost the entropy of their seeds using the dice. How then can CC help them? It's now a personal encounter or issue. It would have been better if the victim imported seeds from his previous wallet. The dice generated seed phrase is easy to guess if the user is not experienced at generating entropy. It'll be a better security development if they restricts users that use a single dice roll to generate seed phrase.

Very bad situation that would have been easily avoided if the user had simply calmed down, used common sense, and done some research. Coldcard has videos and documentation explaining the process of rolling dice and generating a seed from dice rolls. He didn't bother checking any of that, and was more concerned getting his money off his Ledger as soon as possible, even though there isn't an immediate threat. 

Coldcard is partially to blame for allowing it, but that's what you get if you want absolute control. I am not a Linux user, but I know the system gives you much more freedom than Windows. That also means a possibility of making serious self-destructive mistakes.

Let's say you have a biased coin, or you flip a coin in biased way, such that you have a 60% chance of heads and a 40% chance of tails.

The combinations HT or TH are exactly as equal as each other. HT has a probability of 0.6*0.4 = 0.24. TH has a probability of 0.4*0.6 = 0.24. They are exactly equal, and so if you treat one of these combinations as 0 and the other combination as 1, you will be guaranteed to have a random result. This holds true regardless of how biased your coin is, and crucially, it also holds true even if you don't know the bias. Flipping HT or TH will always have identical probabilities.

You exclude HH and TT exactly because the probabilities of these will not be equal, leaving you with only two possible results for each pair of flips with an identical probability and therefore a random result.

---

Talking of generating a seed phrase with dice, I just stumbled across this post on Reddit: https://www.reddit.com/r/coldcard/comments/17epqk8/040_bitcoin_taken_instantly_from_my_coldcard/

OP used a single dice roll to generate his seed phrase. He rolled a 5, used that as his entropy, and had his funds immediately stolen. Obviously it's a failure on OP's part to understand what is going on, but it's also a massive failure on Coldcard's part that it let him proceed to generate a seed phrase using a single dice roll.

Mathematics, formulas, and algorithms have never been my strong suit, but why is this considered random if you are specifically looking for only 2/4 combinations after a set of two coin flips, without considering the other two combinations? Heads-Tails and Tails-Heads are ok, while Heads-Heads and Tails-Tails aren't. Randomness should allow all possible combinations, it's just that humans can't generate it. 

To test for bias you would have to make thousands of impartial iterations, this becomes harder in real world conditions because entropy comes into play a lot with many things.

In that sense this is a very nuanced question. I don't think it would be practical  to go at such great lengths for a seed generation technique maybe no one else has used. But if you want to test randomness for security's sake on something like this, you might have to do it yourself. Get a dataset of dice rolls, plug it into your seed generation algorithm, and examine the randomness. Probably you'd need another algorithm for that. A biased dice could lead to some patterns where following certain paths becomes more likely through a certain algorithm for seed creation. But if the bias is too small then maybe it's not a risk.

That is why o_e_l_e_o suggests to use von Neumann's method.  It eliminates that bias: https://xlinux.nist.gov/dads/HTML/vonNeumannCoinFlip.html

I know you push the coin flip method. Makes the most sense.