Pages:
Author

Topic: Idea: Ledger as seed generator? (Read 328 times)

hero member
Activity: 714
Merit: 1298
December 01, 2023, 09:29:57 AM
#26
Very well. According to NIST, urandom    falls into a bucket of "Non-Approved RBGs", thus it can not even be classified for RNG.
That's not what that means. It means it's not fully compliant with FIPS requirements .

Yeah, I know this but if it is not fully compliant with FIPS why should we trust it at such app as crypto wallet. The question is rhetoric.


I wouldn't put too much faith in their rankings.

Anyway, we need to trust some entity of this kind. At this moment I would prefer to put faith to NIST rather than on anything else.
legendary
Activity: 3668
Merit: 6382
Looking for campaign manager? Contact icopress!
December 01, 2023, 08:42:39 AM
#25
I've also watched Andreas Antonopoulos on YouTube (https://www.youtube.com/watch?v=9scIevuymZM) telling that probably the old Ledger Nano S has too small memory to hold any threat Cheesy
Somehow he tries to minimize the potential evil Ledger can do. On the other hand he said or implied that such functionality (API) can be done (or already exist) in theory in any hardware wallet, so we are pretty much going nowhere. Of course, some HW are fully open source and that helps.



Since there are some holidays around here, I had time to make a test. I wanted to setup a cold storage with an encrypted Linux on an USB stick. After spending almost a full day with Ubuntu, Debian and Mint all failing on me in various ways (i.e. I was unable to install without errors and start), I was left with the good ol' Tails, where, as I suck at Linux (nothing new here), I was unable to install Sparrow, but I was able to follow ETFbitcoin tutorial with /dev/urandom and IanColeman page (thanks!!) and make myself a new seed.

Generating new seed with Ledger would have been more convenient, but... I am still unconvinced (well, the seed made with /dev/urandom is still a test, no funds sent yet).
legendary
Activity: 2268
Merit: 18711
December 01, 2023, 05:07:01 AM
#24
Very well. According to NIST, urandom    falls into a bucket of "Non-Approved RBGs", thus it can not even be classified for RNG.
That's not what that means. It means it's not fully compliant with FIPS requirements (which are controversial to begin with), but they still say it can be used.

Don't forget that NIST previously promoted functions containing backdoors, so I wouldn't put too much faith in their rankings.
hero member
Activity: 714
Merit: 1298
December 01, 2023, 03:27:42 AM
#23
I would think that people looking up Sparrow's code would see if the library used by Sparrow for generating random numbers is flawed (but I didn't look into it myself and would not know what to look for anyway).
Sparrow uses Java's SecureRandom function to generate its entropy, which sources entropy from /dev/urandom. This is similar to Electrum, which uses Python's randrange which also sources from /dev/urandom.

Very well. According to NIST, urandom    falls into a bucket of "Non-Approved RBGs", thus it can not even be classified for RNG.

Thus, randomness coming from Ledger's TRNG (embedded into  ST33J2M0 and classified as PTG.2)  looks like more reliable  in my eyes.

It is to be regretted that OP didn't come with their idea before I have smashed my Ledger device.
legendary
Activity: 2268
Merit: 18711
November 30, 2023, 03:25:16 PM
#22
I would think that people looking up Sparrow's code would see if the library used by Sparrow for generating random numbers is flawed (but I didn't look into it myself and would not know what to look for anyway).
Sparrow uses Java's SecureRandom function to generate its entropy, which sources entropy from /dev/urandom. This is similar to Electrum, which uses Python's randrange which also sources from /dev/urandom.
legendary
Activity: 3668
Merit: 6382
Looking for campaign manager? Contact icopress!
November 30, 2023, 10:52:27 AM
#21
However, I wouldn't probably  prefer  the randomness generated by Sparrow itself over, let's say, that one generated by Ledger. At least with Ledger, I am aware that RNG is certified as PTG.2 class, as stated in  ANSSI-cible-CSPN-2023_17en.pdf  document. On the other hand, there is no certification for RNG used by Sparrow (I couldn't find any relevant information on this).

Therefore, it appears that your initial idea to use Ledger as the SEED generator (while taking all the necessary precautions) makes sense.

While certified RNG certainly sounds great, I am not smart enough to understand why Sparrow's RNG may not be good enough. (Maybe somebody can help?)
I would think that people looking up Sparrow's code would see if the library used by Sparrow for generating random numbers is flawed (but I didn't look into it myself and would not know what to look for anyway).

On the other hand, no matter how good is the random number generator if it's used with malicious intent. For example no matter how random is the number it gets; if that number is for example afterwards adjusted (!) to be multiple of a big prime number, everything will look great, but the result is a small set the seeds will be part of, hence easy to look them up and steal the money.
Of course, since nothing like this has happened yet, maybe Ledger was not that evil after all (at least this was how I was thinking when I started this), but there can be other surprises they can come with and I didn't think of.

Although I thought at first "how could I have just missed Sparrow as solution", I am glad I've made this topic. Interesting (at least for me!) ideas still come up.

If  OP uses Ledger nano s, then, they won't need to worry about Bluetooth since this wallet doesn't have that capability.

That's exactly what I have: Nano S (without plus, obviously).
hero member
Activity: 714
Merit: 1298
November 30, 2023, 01:49:22 AM
#20
~snip~
Many years have passed since the launch of Ledger and we didn't come across any stash dissolution due to the weakness of its SEED, so far.

The only thing we found out in the meantime is that they are not telling us the truth all the time, and that it is technically possible (remotely) to extract the seed from their HW,

Even if such possibility exists they could not be able to utilize it in the case described by OP.

As I got it, OP's frame of thought is  to  generate SEED on   Ledger being offline and reseted state,  write that SEED down and after that reset wallet again.

Thus, SEED generated by this way will be out of Ledger's team  reach.

Not if the device has bluetooth or if the device is plugged in via USB.

Using a Ledger for anything other than a decoy or a doorstop is such a poor idea.  Ledger lies to their customers.  Ledger uses key extraction code.  Ledger admitted they can't prove their code doesn't have any backdoors (they can't prove it because their code isn't open).

Don't set yourself up for disaster.

Don't trust Ledger.  Not even a little.

Don't make waves.

The range of Bluetooth action  is very limited, only a few meters. Therefore, if the OP intends to generate a SEED with the Ledger nano X (which is indeed a Bluetooth-capable device), then, I don't think he will come to Ledger's office to proceed there.

If  OP uses Ledger nano s, then, they won't need to worry about Bluetooth since this wallet doesn't have that capability.

Regarding USB, OP can connect their wallet to a cold computer.


 
Sparrow wallet being the most user friendly option imho - why bother taking risks with Ledger?


I rely on the combined capabilities of Passport 2 + Sparrow + Bitcoin Core tandem in my BTC-routine  (using Passport 2 SEED) . However, I wouldn't probably  prefer  the randomness generated by Sparrow itself over, let's say, that one generated by Ledger. At least with Ledger, I am aware that RNG is certified as PTG.2 class, as stated in  ANSSI-cible-CSPN-2023_17en.pdf  document. On the other hand, there is no certification for RNG used by Sparrow (I couldn't find any relevant information on this).

Therefore, it appears that your initial idea to use Ledger as the SEED generator (while taking all the necessary precautions) makes sense.

But, sure, you are free to use any SEED.
full member
Activity: 128
Merit: 190
November 28, 2023, 04:23:01 PM
#19
if Ledger cannot be trusted with keeping coins on, we cannot know what other surprises it can have under the hood.

THIS.  Case closed.

The only safe use for a Ledger is one of the following:

1: Doorstop.
2: Target Practice.
3: Decoy Wallet.
legendary
Activity: 3668
Merit: 6382
Looking for campaign manager? Contact icopress!
November 28, 2023, 12:04:28 PM
#18
As I got it, OP's frame of thought is  to  generate SEED on   Ledger being offline and reseted state,  write that SEED down and after that reset wallet again.

Thus, SEED generated by this way will be out of Ledger's team  reach.

Yes, but I've properly understood the others' point: if Ledger cannot be trusted with keeping coins on, we cannot know what other surprises it can have under the hood.
And since there are easy open source solutions - Sparrow wallet being the most user friendly option imho - why bother taking risks with Ledger?

Quite a shame, I never thought I'll be using it for so small period of time...



It shouldn't be as hard as you expected, although i understand if you find this method not convenient.

Well, with this tutorial (thank you for it) it's way less inconvenient than I thought.
I will surely keep a bookmark to it, just in case.
full member
Activity: 128
Merit: 190
November 27, 2023, 03:02:44 PM
#17
~snip~
Many years have passed since the launch of Ledger and we didn't come across any stash dissolution due to the weakness of its SEED, so far.

The only thing we found out in the meantime is that they are not telling us the truth all the time, and that it is technically possible (remotely) to extract the seed from their HW,

Even if such possibility exists they could not be able to utilize it in the case described by OP.

As I got it, OP's frame of thought is  to  generate SEED on   Ledger being offline and reseted state,  write that SEED down and after that reset wallet again.

Thus, SEED generated by this way will be out of Ledger's team  reach.

Not if the device has bluetooth or if the device is plugged in via USB.

Using a Ledger for anything other than a decoy or a doorstop is such a poor idea.  Ledger lies to their customers.  Ledger uses key extraction code.  Ledger admitted they can't prove their code doesn't have any backdoors (they can't prove it because their code isn't open).

Don't set yourself up for disaster.

Don't trust Ledger.  Not even a little.
hero member
Activity: 714
Merit: 1298
November 27, 2023, 11:15:29 AM
#16
~snip~
Many years have passed since the launch of Ledger and we didn't come across any stash dissolution due to the weakness of its SEED, so far.

The only thing we found out in the meantime is that they are not telling us the truth all the time, and that it is technically possible (remotely) to extract the seed from their HW,

Even if such possibility exists they could not be able to utilize it in the case described by OP.

As I got it, OP's frame of thought is  to  generate SEED on   Ledger being offline and reseted state,  write that SEED down and after that reset wallet again.

Thus, SEED generated by this way will be out of Ledger's team  reach.
legendary
Activity: 3234
Merit: 5637
Blackjack.fun-Free Raffle-Join&Win $50🎲
November 27, 2023, 05:52:01 AM
#15
~snip~
Many years have passed since the launch of Ledger and we didn't come across any stash dissolution due to the weakness of its SEED, so far.

The only thing we found out in the meantime is that they are not telling us the truth all the time, and that it is technically possible (remotely) to extract the seed from their HW, with which they can then do whatever they want. This fact alone, which they themselves admitted, speaks for itself - but luckily for that company, I would dare to say that at least 80% of their users still do not understand what kind of risk they are exposed to.
hero member
Activity: 714
Merit: 1298
November 27, 2023, 05:25:53 AM
#14

And now the idea: why don't just use Ledger (only!) as seed generator?


All depends.

If you intend to use that seed generator for new generation wallets, let'us say like Passport which relies on  Avalanche diode for randomness generation, then it would be unwise.

But, if Ledger's SEED will replace those ones, generated by "old" software wallets, then why not.

After all. many years have passed since the launch of Ledger and we didn't come across any stash dissolution due to the weakness of its SEED, so far.
legendary
Activity: 2870
Merit: 7490
Crypto Swap Exchange
November 27, 2023, 04:24:40 AM
#13
I'm not that much into Linux, so playing with /dev/urandom and so on is not for me.

You could just copy-paste the tutorial. Here's an short example from me,

1. Get 32 HEX character from /dev/urandom using this command. I only copy-paste command from https://stackoverflow.com/a/34329057.

Code:
$ hexdump -vn16 -e'4/4 "%08X" 1 "\n"' /dev/urandom
44393B19866635398D4656494441C7BD

2. Download bip39-standalone.html from https://github.com/iancoleman/bip39/releases and open it with your browser.

3. Select "Show entropy details".



4. Copy 32 HEX character from hexdump command to Entropy text field.



You can replace -vn16 with -vn32 if you want to generate 24 BIP39 words. It shouldn't be as hard as you expected, although i understand if you find this method not convenient.
legendary
Activity: 3668
Merit: 6382
Looking for campaign manager? Contact icopress!
November 26, 2023, 12:09:02 PM
#12
Thanks a lot for the great answers.

I'm not that much into Linux, so playing with /dev/urandom and so on is not for me. But Sparrow is a handy option I've missed.
And yes, Ledger will probably remain useful only for funds/altcoins/decoy and maybe as some sort of collectible.
legendary
Activity: 3234
Merit: 5637
Blackjack.fun-Free Raffle-Join&Win $50🎲
November 26, 2023, 10:36:22 AM
#11
~snip~
And now the idea: why don't just use Ledger (only!) as seed generator?
I mean: reset Ledger as a new device, write down the new seed, reset it again (because it's unsafe), and I'm done.
Is it anything I've missed? Is this also unsafe for a reason I've missed?

(Was this already discussed and I've missed that?)


I will agree with what some others have already concluded, which is that if you don't trust that you keep your confidential information on that device, then it doesn't make much sense to use it to generate that same information.

Of course, we can ask the question whether the device was connected to the internet after generating the seed and in that way communicated with the Ledger servers and possibly leaked that information - or was the entire process done completely offline and the same seed is used in another wallet.  

In the case of the latter, I don't see that there is a security threat - although after everything we've experienced from Ledger so far, I'd rather find another way to generate seeds or anything related to Bitcoin storage.
legendary
Activity: 4256
Merit: 8551
'The right to privacy matters'
November 26, 2023, 10:32:12 AM
#10
And now the idea: why don't just use Ledger (only!) as seed generator?

I'd rather just use /dev/urandom and convert the format as needed. Your Ledger probably is more useful if you use it either as decoy or store altcoin if you can't find better software wallet for that altcoin.

Is it anything I've missed?

Ledger isn't open source. And with various controversy, don't trust them or their product too much.

decoy is a great idea. put a few dollars worth of coins in it and you are good to go.
legendary
Activity: 1792
Merit: 1296
Crypto Casino and Sportsbook
November 26, 2023, 09:58:16 AM
#9
Ledger devices are closed source, so you cannot verify how they are generating entropy and producing a seed phrase for you.
Is it possible to check this somehow? I mean generating entropy and the degree of reliability of the generated seed phrases.

With that in mind, it all comes down to how much you trust Ledger.
If @NeuroticFish no longer trusts the storage bitcoins on Ledger, then I, if I were in his place, would not trust the generation of seed pharse.

No one can say for sure that what you are proposing will be entirely safe.
Ledger's representatives may say that, but we know that even what they say should not be believed.


Your process is definitely better than using a hot wallet, but I would argue inferior to using an airgapped machine with Tails as you have mentioned, verifiably drawing entropy from /dev/urandom. If you don't want to generate an Electrum seed phrase, then I see no reason you can't use the same set up with Sparrow wallet to generate a BIP39 seed phrase (although I haven't tried this myself).
Are there any other safe and reliable BIP39 seed phrase generation options?


The only way you can use Ledger HW's is by using the fido u2f function with services such as Gmail or Facebook. Although, no. Still, it is better to throw this device away and never touch it. Smiley
legendary
Activity: 2870
Merit: 7490
Crypto Swap Exchange
November 26, 2023, 05:46:08 AM
#8
And now the idea: why don't just use Ledger (only!) as seed generator?

I'd rather just use /dev/urandom and convert the format as needed. Your Ledger probably is more useful if you use it either as decoy or store altcoin if you can't find better software wallet for that altcoin.

Is it anything I've missed?

Ledger isn't open source. And with various controversy, don't trust them or their product too much.
full member
Activity: 128
Merit: 190
November 25, 2023, 02:39:38 PM
#7
why don't just use Ledger (only!) as seed generator?

...because they might have access to your seed?  Their code isn't open, so there's no way to prove what the code (and thus the device) does or doesn't do.

If you wouldn't trust Ledger to store your seed, why would you trust them to create it?

Pick up a Blockstream Jade for around $60.

Don't risk your Bitcoin by trusting a company you already know you can't trust.
Pages:
Jump to: