In a quick search, I found that a standard piped die can roll a "6" approximately 0.5% to 1% more often than a perfectly balanced die. In this case, despite the bias, I believe the entropy is still sufficient to consider it safe, but we could do some calculations to verify.
That's not a big advantage compared to a non-biased die. Using that data that you provided, you might roll a "6" one extra time for every 100 rolls. You can always compensate for that bias by making more rolls and using dice of different types and manufacturers. Those other dices could be slightly biased to other numbers, so it evens itself out. 
Topic: Generating a seed phrase with biased dice (Read 704 times)
I've thought about this. Toy dice often have biases. The issue is that if the biases are random due to bubbles forming inside, we wouldn't know anything without inspecting the dice first.
However, there is a type of bias that would be predictable, caused by drilling the pips or filling them with a different material. This bias would make the heavier parts more likely to settle at the base, increasing the probability for the opposite faces. In a quick search, I found that a standard piped die can roll a "6" approximately 0.5% to 1% more often than a perfectly balanced die. In this case, despite the bias, I believe the entropy is still sufficient to consider it safe, but we could do some calculations to verify.
However, there is a type of bias that would be predictable, caused by drilling the pips or filling them with a different material. This bias would make the heavier parts more likely to settle at the base, increasing the probability for the opposite faces. In a quick search, I found that a standard piped die can roll a "6" approximately 0.5% to 1% more often than a perfectly balanced die. In this case, despite the bias, I believe the entropy is still sufficient to consider it safe, but we could do some calculations to verify.
It would be interesting if someone funded an address which was generated using a very biased dice, just to check if people could claim the bounty, sort of like these collision puzzles.
If you think your dice is biased, then just roll it for a hundred times. As I have demonstrated in here, even if '1' would come with a probability of 0.75 and 0.05 for each other side, the dice would still produce sufficient entropy if rolled for 100 times.
If you think your dice is biased, then just roll it for a hundred times. As I have demonstrated in here, even if '1' would come with a probability of 0.75 and 0.05 for each other side, the dice would still produce sufficient entropy if rolled for 100 times.
I'm not an expert but it seems to me that a biased RNG is only vulnerable if the attacker has information about the RNG or can easily guess the RNG's bias.
For example, suppose that for some reason, your die rolls a 5 less often than expected. How could an attacker take advantage of that bias without knowing that it exists?
Now that I think about it, I think I can answer my own question...
The main idea is that an attacker is not trying to find a specific key, but is trying to find any key. An attacker deciding to attack any keys that came from rolling dice would start out assuming the worst bias and progress by incrementally assuming less bias. Thus, the entire space does not have to be searched to find any entropy generated by biased dice.
An attack against a specific key would be similar, but would start with the RNGs that are most likely to be used. It seems to me that this would add another dimension to the effort, making it infeasible to attack a specific key generated by any RNG with even a low bias.
So, it seems to me that you can safely generate entropy with biased dice if you do it correctly and the bias is not significant. Either way, generating extra entropy seems to be an easy way to overcome any bias.
For example, suppose that for some reason, your die rolls a 5 less often than expected. How could an attacker take advantage of that bias without knowing that it exists?
Now that I think about it, I think I can answer my own question...
The main idea is that an attacker is not trying to find a specific key, but is trying to find any key. An attacker deciding to attack any keys that came from rolling dice would start out assuming the worst bias and progress by incrementally assuming less bias. Thus, the entire space does not have to be searched to find any entropy generated by biased dice.
An attack against a specific key would be similar, but would start with the RNGs that are most likely to be used. It seems to me that this would add another dimension to the effort, making it infeasible to attack a specific key generated by any RNG with even a low bias.
So, it seems to me that you can safely generate entropy with biased dice if you do it correctly and the bias is not significant. Either way, generating extra entropy seems to be an easy way to overcome any bias.
Forgot about this till it got bumped. I had bought the loaded dice to play with. And they really did roll more 6's then normal. Enough to be obvious over a few rolls if you are paying any sort of attention.
So by themselves you would not want to use them to generate a seed. To add some more randomness to a good RNG would probably be fine if the RNG was good. Its just more data to be used.
As a human experiment would be interesting to see if you just put one of the loaded dice in a group of good ones if how many rolls would it take for someone to figure out which one it was.
-Dave
So by themselves you would not want to use them to generate a seed. To add some more randomness to a good RNG would probably be fine if the RNG was good. Its just more data to be used.
As a human experiment would be interesting to see if you just put one of the loaded dice in a group of good ones if how many rolls would it take for someone to figure out which one it was.
-Dave
~~~
Besides necro-bumping the thread and likely not adding really new content, except maybe for your favorite online dice site, how is a Pseudo Random Number Generator truly random as you claim for that site? That's a contradiction in terms.A PRNG generates deterministic random numbers which only appear random but have a finite sequence period. The determinism is initialized with some start values that ideally aren't predictable. From the same start values a PRNG will generate always the same sequence of pseudo random numbers.
@SemiSharma made a non-sense posts, because it's generated with AI. And if you look at his post history, he actually perform hidden SEO spam by adding spam link few days later to avoid moderation. Anyway, i've reported this user and should be nuked soon.
~~~
Besides necro-bumping the thread and likely not adding really new content, except maybe for your favorite online dice site, how is a Pseudo Random Number Generator truly random as you claim for that site? That's a contradiction in terms.A PRNG generates deterministic random numbers which only appear random but have a finite sequence period. The determinism is initialized with some start values that ideally aren't predictable. From the same start values a PRNG will generate always the same sequence of pseudo random numbers.
I see them as available here, are you US based?
No, I am not from the US, and currently not logged in to my Amazon account either. I am still getting a "Product Unavailable" description, though.The biggest issue is HOW loaded they are. Are you going to roll 20% more sixes or 50% more 90% more?
According to the calculations by BlackHatCoiner, even a visibly biased die is good enough to create enough entropy. And based on what Coldcard's documentation says, the entropy from dice is just an extra that goes on top of the hardware-generated entropy from the device.Did some poking around, they are showing not available from a bunch of different IPs when going to Amazon.
Guess since it's 'sold by' someone else but shipped from Amazon they are only in the US warehouses.
If you want a set PM me and I'll ship them to you. Going to be interesting as what to put on the customs form....
Dice for seeds has been done for a while, and as discussed they just add to the entropy from the device.
BUT if the entropy is bad / wrong on the device and the dice are loaded not just biased? Over a large enough set of wallet creation with rolls you can run into other people generating the same info. The question is how many. But, you also then have to answer how bad is the entropy and how loaded are the dice.
-Dave
That's interesting. I didn't know that. I thought that if you select the dice rolls seed generation method, that the entropy comes only from that source. But according to the documentation you linked to, 256 bits of entropy is already generated from Coldcard's hardware and the dice rolls are an addition on too of that.
Coldcard provides all three options - PRNG only, PRNG + dice, or dice only.https://coldcard.com/docs/middle-ground/#generating-seed-words
https://coldcard.com/docs/paranoid/#generating-seed-words-with-256-bits-of-entropy-by-dice-rolls
In the thread I linked, the OP chose dice only and then proceeded with a single dice roll of 5. You can verify this yourself by going to Ian Coleman, showing entropy, putting in "5", choosing dice rolls, choosing 24 words, choosing BIP 84, and generating the same addresses as OP:
https://mempool.space/address/bc1qln3mjur5h67xenn04vepunx27fhpvfgvqgwelx
https://mempool.space/address/bc1qmq80v8cxlsuwkxc8yt7hzjf05jyga3q5uea9uk
I see them as available here, are you US based?
No, I am not from the US, and currently not logged in to my Amazon account either. I am still getting a "Product Unavailable" description, though.The biggest issue is HOW loaded they are. Are you going to roll 20% more sixes or 50% more 90% more?
According to the calculations by BlackHatCoiner, even a visibly biased die is good enough to create enough entropy. And based on what Coldcard's documentation says, the entropy from dice is just an extra that goes on top of the hardware-generated entropy from the device. Now, loaded dice: https://www.amazon.com/Character-Builder-Loaded-Koplow-Games/dp/B001N1JIU8 that is a different thing.
-Dave
There is an interesting experiment that someone like BlackHatCoiner and possibly o_e_l_e_o could partake in. The dice that you linked to aren't available anymore, but if they could get an equal set, it would be fun to see how much entropy you could generate despite their bias towards rolling sixes. -Dave
I see them as available here, are you US based?
The biggest issue is HOW loaded they are. Are you going to roll 20% more sixes or 50% more 90% more?
I would think that if you didn't know they were loaded after a few rolls it would be obvious. But the question would be how many till you go hmmmmm something is wrong here.
-Dave
I don't say you shouldn't use any software other than Electrum. I simply suggest to use what has been used and tested for years in bitcoin industry, what has been proven to be safe and reliable. You can use Sparrow, no problem but it doesn't have android or ios app if that matters for you.
Btw if seed phrase randomness is a problem for you, then I would use vanity address generator on airgapped personal computer and generate bitcoin address with short random prefix. You'll receive private keys that there is absolutely no way they'll be biased or untrustworthy.
Now, loaded dice: https://www.amazon.com/Character-Builder-Loaded-Koplow-Games/dp/B001N1JIU8 that is a different thing.
-Dave
There is an interesting experiment that someone like BlackHatCoiner and possibly o_e_l_e_o could partake in. The dice that you linked to aren't available anymore, but if they could get an equal set, it would be fun to see how much entropy you could generate despite their bias towards rolling sixes. -Dave
Slightly OT, but something that was said to me years ago that stuck.
All 6 sided casino dice are biased over hundreds of thousands of rolls. They are man made and will show it given time. But in the short term of hours that they are actually on the table it does not matter.
If the dice here that @Pmalek are not used for anything else and came from an unknown source then it will never matter because there is still enough randomness in them.
Now, loaded dice: https://www.amazon.com/Character-Builder-Loaded-Koplow-Games/dp/B001N1JIU8 that is a different thing.
-Dave
All 6 sided casino dice are biased over hundreds of thousands of rolls. They are man made and will show it given time. But in the short term of hours that they are actually on the table it does not matter.
If the dice here that @Pmalek are not used for anything else and came from an unknown source then it will never matter because there is still enough randomness in them.
Now, loaded dice: https://www.amazon.com/Character-Builder-Loaded-Koplow-Games/dp/B001N1JIU8 that is a different thing.
-Dave
It's already happening in the background on Coldcard - https://coldcard.com/docs/faq/#entropy
That's interesting. I didn't know that. I thought that if you select the dice rolls seed generation method, that the entropy comes only from that source. But according to the documentation you linked to, 256 bits of entropy is already generated from Coldcard's hardware and the dice rolls are an addition on too of that.But if that is true, I don't know how to explain this situation that o_e_l_e_o shared a few posts above. The user claims to have rolled a dice and got a '5' which he used to generate his seed. I seriously doubt he used advanced methods to bypass Coldcard's automatic entropy generation (the automated one you talked about), but still got his coins stolen (allegedly) within minutes. The whole story could, of course, be a a smear campaign and complete bullshit, but it's still different from what you said and what the Coldcard docs claim.
Are you saying that we should be combining two sources of randomness or that it's already happening in the background? Is that what the Coldcard and Seedsigner are doing when you input dice rolls into the devices to generate your seed?
It's already happening in the background on Coldcard - https://coldcard.com/docs/faq/#entropy
Can you provide a few examples?
Every time you roll the dice, also flip a coin. If the coin lands heads, keep the dice result. If the coin lands tails, invert the dice and record that result instead.
Is there any reason to generate seed phrase with dice when you can generate it in Electrum?
How can you verify that your seed is generated randomly, on a hardware level? Short answer: you can't. You can rely on cryptographic libraries, which rock and the like, but when it comes to generating random numbers, while CSRNG are pretty good sources, there is no manner to verify they aren't tampered whatsoever. Tossing coin can provide complete and provable randomness. It doesn't go more transparent user interface than that.
Is there any reason to generate seed phrase with dice when you can generate it in Electrum? There is no reason and when problem is easy to solve, you shouldn't start looking for more complex solutions.
If we want to get number 2 by adding some numbers to each other, easy solution is: 1 + 1 = 2
Hard solution is: 49+60-5+17+43-150+12-24 = 2
I hope I explained well what I wante to say. If OP's discussion is just a theory, then my answer will be that you are safe to generate a see phrase with biased dice if no one knows that you are generating a seed when you roll dice. There are millions of rolls every day on many casinos, if no one knows that during 10:18 - 10:20 Pmalek logged in in his account and played dice and saved their results on paper, then there is absolutely no way someone will be able to hack your wallet.
If we want to get number 2 by adding some numbers to each other, easy solution is: 1 + 1 = 2
Hard solution is: 49+60-5+17+43-150+12-24 = 2
I hope I explained well what I wante to say. If OP's discussion is just a theory, then my answer will be that you are safe to generate a see phrase with biased dice if no one knows that you are generating a seed when you roll dice. There are millions of rolls every day on many casinos, if no one knows that during 10:18 - 10:20 Pmalek logged in in his account and played dice and saved their results on paper, then there is absolutely no way someone will be able to hack your wallet.
It would have been better if the victim imported seeds from his previous wallet.
That would have defeated the purpose of him buying a new hardware wallet. He bought his Coldcard to get away from Ledger that he lost his trust in. Obviously, you have to move away from the old seed phrase also. It'll be a better security development if they restricts users that use a single dice roll to generate seed phrase.
They can at least add a warning message informing users if the provided number of dice rolls isn't sufficient enough for a safe wallet. After that, it's up to the user to make a greater effort. It's easy to blame the user after something like this, but honestly, I don't know what he was thinking. Jump to: