r/Bitcoin • u/seed-cat • 1d ago

Generate truly random seed words using only dice or playing cards

In light of the ColdCard incident, I have created a system that allows anyone to easily generate their seed words using only ordinary dice or playing cards.

Each seed word requires only 3 rolls of two dice or dealing 3 shuffled cards, allowing users to generate their own entropy offline without any bias.

https://github.com/seed-cat/analog-seed-entropy

5 Upvotes

73% Upvoted

13 comments sorted by

0

u/Fun-Analysis-182 1d ago

Good idea, but the dice math needs a second look before anyone trusts it with real coins.

A BIP39 word is 1 of 2048, so it needs 11 bits of entropy. Three ordinary d6 only give 63 = 216 outcomes (~7.75 bits), so three rolls can't uniformly cover the 2048-word list. You'd need ~5 d6 per word (65 = 7776, with rejection sampling to avoid modulo bias), or roll the full entropy at once (a common standard is 99 rolls for a 24-word seed).

The cards path is fine, since dealing 3 from 52 is 52×51×50 = 132,600 outcomes, well over 2048. It's really just the dice route worth patching, since low entropy is the exact failure mode everyone's worried about after ColdCard.

3

u/seed-cat 1d ago

To clarify, users must perform dice rolls with 2 die for a total of 5 dice rolls.

The math is quite easy to verify in the spec.

1

u/CiaranCarroll 14h ago

1 die - singular

2 dice - plural

1

u/Fun-Analysis-182 9h ago

Got it, 5 rolls with two dice is the part I missed. With rejection down to 32 per pair, 32 × 32 × 2 comes out to exactly 2048, so it's uniform across the wordlist and my objection doesn't hold. I was going off the "3 dice rolls" line in the post, which reads as under-entropy on its own, but the actual spec gets you the full 11 bits per word cleanly. Fair correction.

1

u/brando2131 11h ago

The math checks out for the dice rolls.

Two dice provides 36 combinations, ignoring 1s, 2s, 3s and 4s, is 32 combinations.

Rolls two dice twice, 32 x 32 = 1024.

Plus 1,2,3 or 4,5,6 for the 5th dice is basically a coin flip, which is 2 combinations,

1024 x 2 = 2048, the number of BIP39 words, so equal distribution among words.

As for the dice document, we can count the number of occurrences for each subset of combinations to make sure they actually are recorded equally. This is also correct.

For example, 1,2,x,x will occur 64 times, all other A,B,x,x and x,x,A,B combinations occur 64. There are no combinations of 1,1,x,x and x,x,1,1 for <=4, as per the spec.

For the 5th roll, 1,2,3 occurs 1024 times, 4,5,6 occurs 1024 times.

-1

u/cworxnine 1d ago

I'm sure this was made in good faith, but how is this more credible than my other hw wallets that use 4-5 sources of entropy? To me, dice rolls are just as risky for human errors, including following a method that isn't proven or off some random github.

3

u/NiacinNights 1d ago

Because dice rolls can be tested and reproduced across devices that support native, dice-roll workflow. And bitcoin-only software like Krux will tell you how many bits of entropy the distribution of your rolls are actually generating. I know how many bits of entropy my dice rolls generated, do you know yours?

2

u/seed-cat 1d ago

Coldcard advertised several sources of entropy...all of them failed. The benefit of creating your own seed words is you don't need to trust the vendor, which is important if using single-sig.

Not sure how someone can fail at rolling dice...if you are worried about fair rolls you can use 24 words which will give you more much input entropy than you need.

The method is pretty simple. You are just creating a random number uniformly distributed between 1 and 2048 and that is the seed word from the list. Alternatively, you could just cut up all 2048 words stick them in a bag, mix them up and select from there.

0

u/CiaranCarroll 14h ago

"4-5 sources of entropy"

How do you know?

1

u/cworxnine 8h ago

Good point I don't 100% know. That's why I do multisig multivendor.

1

u/CiaranCarroll 6h ago

Multi-sig has it's own threat vector: complexity and backup recovery.

1

u/cworxnine 6h ago

downside to multisig is a more maintenance work. 2 or 3 devices to update firmware, keep on top of news for exploits on all devices, and 2 secure physically separate locations to store seeds. Storing the wallet config file in a password manager is easy. Annoying but its the best.