I find these physical coins very interesting, but I just want to make sure I understand some of the technical aspects. I have some understanding of the basics of crypto, but not enough to really evaluate this.
The private key you generate is an SHA-256 hash of these letters that you generate and put on the back of the hologram. So, I assume that you are generating these random letters with a good random data source, and there's at least 256 bits of randomness in there, so in theory using the hash of it as a private key is "as random" as an address generated by the standard client in the usual way? Do i have that right?
And so, in addition to trusting you specifically that you don't keep any records of the private keys that you've loaded onto your coins (intentionally or not), we also need to trust that you've used a good random data source. Could you describe and explain your process to ensure that your generation of private keys is random and secure? (Or please point me in the right direction if you've already done so and I've missed it.)
Thank you.
The private key you generate is an SHA-256 hash of these letters that you generate and put on the back of the hologram. So, I assume that you are generating these random letters with a good random data source, and there's at least 256 bits of randomness in there, so in theory using the hash of it as a private key is "as random" as an address generated by the standard client in the usual way? Do i have that right?
And so, in addition to trusting you specifically that you don't keep any records of the private keys that you've loaded onto your coins (intentionally or not), we also need to trust that you've used a good random data source. Could you describe and explain your process to ensure that your generation of private keys is random and secure? (Or please point me in the right direction if you've already done so and I've missed it.)
Thank you.
There's no more than 123 bits of entropy due to the abbreviated length. Bitcoin addresses themselves have no more than 160 bits of entropy because they are based on ripemd160. I chose this as a tradeoff for space versus time. It's still quite expensive to brute force 123 bits, especially when the payoff is that you might bump into a 1 BTC coin sometime before the end of the world, and especially considering that each iteration of any attack requires a relatively slow elliptic curve multiplication operation. Mining is far more lucrative by several orders of magnitude to say the least.
My source of entropy is the cryptographic secure random number generator in the .NET Framework, in the System.Security.Cryptography namespace, XORed with the SHA256 hash of (mash + incrementing number). Mash is a constant string produced by me mashing gibberish (was probably 60-70 chars) on the keyboard and is meant as extra entropy against Microsoft's implementation. (I'm familiar with Debian SSL flaw and thought that this would mitigate the possibility if there were something similar).
This was done on an airgapped machine, the OS installation dedicated just for this purpose, private keys have never touched any machine on the internet. The hard drive was strictly controlled, and after the private keys were printed on 33 sheets of paper (each individually checked for accuracy), has since been zeroed over in its entirety (with linux) and a new OS installed over top of it.
I recognize and appreciate the importance of generating these keys securely. It would be an epic fail for me to say "Whoops! Hacker found your private keys in my temp directory... SORRY" and fortunately I know how not to do that.
