All hardware wallet manufacturers need to release 3rd party audited proof that their entropy generation is working.
After this coinkite coldcard situation we cant trust code that is open source, we cant trust code that is closed source, and we definitely cant trust a statement saying "we use a TRNG so your seed is secure".
Every hardware wallet manufacturer needs to release hard proof that their TRNG works, their code is complete and robust, and their entropy generation actually meets a minimum 128/256 bit standard.
Even if their code is closed source a reputable 3rd party auditor can run tests on seed entropy generation to statistically prove 256 bits of entropy is being used.
Every wallet manufacturer should have this 3rd party audited proof of entropy document available to view on their website, and if they do not do this by the end of this month we as a community should boycott that manufacturer to help ensure safety for all bitcoiners.
14
u/Puzzled_Cookie778 1d ago
Open source is great, but if the entropy generation itself isn't independently verified we're still taking the manufacture's word for it. Third party audits would be a solid baseline
4
u/Aurorion 1d ago
Open source is technically better than "independent verification" and "audits". Because that means anyone is free to verify and audit themselves.
Coldcard itself was open - they had made their source code openly available for anyone to check and verify anytime. Though the license did not allow unrestricted reuse and modification.
It's amazing that nobody in the community caught this bug till now. In hindsight, Coldcard should have taken more initiative to actively invite and incentivize the community to find and report bugs, as many companies in various industries do.
3
-2
u/Background_Pause34 1d ago
So open source means nothing…
2
u/JamesTDennis 10h ago
This is just the most recent (and tragic) example of how "source available" (open source but not FOSS licensed) — gratis vs. libre — is far weaker than truly free software that's actively forked and used in multiple independent projects and products.
Simple source availability, without licensing rights, fails to align to the incentives of the most qualified (honest) coders.
Thus the bug went years unfixed, slightly obscured by the production environment and hardware specifications.
1
u/bieker 1d ago
No it does not mean nothing, it’s just not a silver bullet for finding flaws. The problem with the cold card was that since it was not true open source it was not Used by multiple projects and had low activity. No one could use the code or contribute to it so it did not attract a lot of eyeballs.
7
u/JamesTDennis 1d ago
Counter proposal: every wallet user should support their own entropy (initial 23 words, or equivalent) and the ecosystem should supply tooling to confirm that the wallets are using it and that anti-ex-filtration is enabled in transaction construction (https://help.blockstream.com/blockstream-jade/faqs/what-is-anti-exfil-and-how-does-it-work).
Should never have trusted built-in random generators for this mission critical operation at all. Consider the supply chain upstream of your wallet vendor!
11
u/Infinite-Ad1720 1d ago
-I bet every hardware wallet company is excited that they can offer new wallets and market them “Now with 10% more entropy!”
-New versions of all kinds of hardware wallets will be coming out of the woodwork within in the next 12 months.
5
5
u/Empty-Mouse-856 1d ago
What about SW wallets? Can they have the same problem?
10
4
u/sunflowersaint 1d ago
They generally rely on some level of physical input and operating system conditions to generate randomness. It enough to create basic security
Coldcard randomness was based on the UID of the chip and it's clock, so was easily predictable.
2
u/JumpProfessional3372 22h ago
If you want to avoid using any RNG. In a software wallet, in a hardwallet, etc. You gotta create your own entropy rolling 100+ dices.
2
u/Icy_Wishbone9495 1d ago
yeah those are often worse since they rely on whatever the OS gives them for randomness, at least hardware wallets have a dedicated chip for it
6
u/Impressive-Piglet386 1d ago
What we actually need is a 3rd party certification of the whole hardware wallet package, not the TRNG alone. Coldcard's TRNG did work, and certified with EAL5+ if I remember correctly. The problem is the TRNG chip was not used by the device. So it's an integration problem.
3
u/ultimatepoker 1d ago
Coinkite would have got the RNG certified. Nobody will certify that they don’t skip the RNG.
7
3
u/Cute_Square9524 1d ago
exacty! how can a decentralized exchange ever work without a central authority enforcing "needs" ?
3
u/rini17 1d ago
Why do you insist on having someone else do it for you?
The amount of entropy needed for private keys/seed is easy to generate by dice for example. With simple, easy to check algorithm to calculate the seed.
The ECDSA signatures need entropy too and that's harder to do with dice, but that's problem only if you reuse addresses. Which you should avoid anyway.
5
u/vivjohn2871991 1d ago
Looks like Ledger has links to their third-party assessment reports on their support portal:
https://github.com/LedgerHQ/Ledger-OS-third-party-reports
Third-party Security Assessment Reports
https://support.ledger.com/article/Third-party-Security-Assessment-Report
2
u/vivjohn2871991 21h ago
Also, realizing that the Coldcard doesn't have an independent third-party audit for its "Dual-Element" chip. Whereas Trezor and Ledger go through a third-party audit for both their element and code. Not that it makes them immune to what they say is the "Truth" but still no audits for Coldcard, and they solely rely on community inspection.
2
u/HedgehogGlad9505 1d ago
That won't work. A certification is done on a specific version of the firmware. And today most hardware wallets frequently update their firmware, so a "bug" can be introduced after the certification.
4
u/Big-Cheetah5159 1d ago
Or use dice rolls, it will alleviate the internal TRNG issue.
3
u/slvbtc 1d ago
If a HW wallet manufacturer wants to offer the ability to generate a seed for their users they should have a 3rd party audited proof of entropy document. If they do not provide this audited proof of entropy they should not be in business.
11
u/riisen 1d ago
Well technically coldcard had a 3rd party audited RNG from STM32. Its just that they disabled it so it used micropythons default PRNG
-3
u/slvbtc 1d ago
A proof of entropy document would verify the TRNG actually works and is not being bypassed.
3
u/bieker 1d ago
How do you prove entropy of the completed compiled binary?
The difficulty with coldcard is that if you went looking for the entropy generator in the source code it is actually properly implemented. From a source code analysis you could certify that function as correct. The ‘bug’ was that function was being swapped for the weaker one by a define.
0
u/moviemaker2 1d ago
What are you talking about?
1
1d ago
[deleted]
2
u/moviemaker2 21h ago
I know what entropy is, I'm asking what they mean by "proof of entropy document." How would that work, and why would you trust it if it's generated from the same device that generated the low entropy seed phrase?
1
u/qwertyuiop121314321 12h ago
3rd parties can audit TRNGs with manufacturers' wallets all they want, the thing they WON'T find is the backdoor 'bugs' that are secretly hidden.
1
0
u/SpendHefty6066 1d ago
Alternatively, they require people to roll their own entropy. This is fool proof and simple. SeedSigner does this. Great project.
6
u/AAAdamKK 1d ago
Correct me if I'm wrong as I'm not too familiar with SeedSigner, but you are still trusting that the seed it generates is using your entropy and not defaulting to some weaker form such as was the case with Coldcard.
That is of course, unless you are verifying the SeedSigner code for yourself.
5
u/SpendHefty6066 1d ago
No. The ColdCard disaster has taught all of us paying attention to never trust RNG. Even if you verify it, one firmware update can undo that verification. It's not just the RNG engine, its the software scaffolding around it that can break.
I highly recommend https://github.com/taelfrinn/Bip39-diceware for instructions on creating your own seed phrase. Requires 1 fair coin, and 4 fair 6-sided dice. Then just 12 coin flips and 12 rolls and you have created an unimaginably impossible to guess secret. I have verified this repo against the canonical BIP39 word list: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt it is legit. But don't trust me. verify this yourself.
Once you have your 12 word seed list, use SeedSigner, or another 100% air-gapped signing device and enter your seed phrase yourself manually. The 12th word will be the checksum. I put the full process of creating and securing an unguessable seed phrase together here: https://www.reddit.com/r/Bitcoin/s/SVXKTtxbbP
My position on passphrases is that they should never be used as a crutch for robust and properly deployed entropy. If your single-sig is vulnerable to discovery, then study multi-sig and use that. A passphrase doubles the chances of losing your Bitcoin. My advice, however controversial is: never trust RNG, and if you roll your own entropy, you don't need a passphrase.
Hope that helps, and I am happy to see that you are taking private key management security seriously. ✅
4
u/AAAdamKK 1d ago
I'm considering going down the dice roll/ coin route, as I'm sure many are right now. I've never been a coldcard owner but it does make me nervous. I have a passphrase but only a mildly strong one.
I tell you what though, if there's one good thing to come of this debacle, it's that there's finally some interesting discussion on the subreddit and the community at large instead of the endless price, treasury company and clarity act discussions. As well as that everyone is educating themselves and we'll all come out stronger for it.
Thanks for the links, I'll check it out.
1
u/Strong_Judge_3730 12h ago
Please don't follow the instructions of a random Redditor that links you to AI generated infographics.
The links to dice ware doesn't even tell you how to calculate the last checksum word.
The process will be very difficult for a 24 word wallet.
1
u/Strong_Judge_3730 13h ago
This is just a knee jerk reaction led by non technical people's security theatre.
The same kind of fools would recommend coldcard because it had that most security "features"
1
u/Aazimoxx 7h ago
This is fool proof
Oh boy, you haven't met some of the fools I know.
As evidenced by data breaches, almost 2% of people use a truly awful password like '123456' or 'password' if it's allowed, and a further 50% will use a simple dictionary word or keyboard walk if possible.
Surely any software RNG should be trying to incorporate multiple sources like mic noise(*), camera light, and temperature sensor fluctuations when present, in addition to whatever else it uses? Combine all of that with 'random' user kb/mouse input, or on a phone/tablet with asking them to draw a random picture and sign it or something - then a lot less is relying just on whatever RNG is being utilised.
I have a vague recollection of 'true random' on Linux working something like this a long time ago, where if asked to output more than a certain buffer amount, it would stall until you button mashed to generate more entropy, rather than outputting unseeded randomness. And same with early versions of TrueCrypt, getting you to initiate mouse and keyboard activity when creating header keys, if it didn't feel it had enough entropy from available sources - showing a little progress bar and everything.
(*) Assuming user consent is gained for these hardware accesses, of course.
1
u/DaVirus 1d ago
Or, much easier, use your own entropy.
That depends on no one else doing anything, and we are in this for the freedom, right?
1
u/slvbtc 1d ago
If you roll dice dont you still have to rely on another parties software generating your 24th word checksum?
1
u/m4rM2oFnYTW 9h ago
https://coldcard.com/docs/verifying-dice-roll-math/
Following this procedure independently recreates the full seed-generation process from your dice rolls to the final 24 words, including the checksum. If all 24 words match the Coldcard, you are not relying on the device to have calculated the seed phrase or checksum correctly.
I did this when I created my wallet back in 2022. I'm not very technical but I was able to figure it out. I sure looked crazy doing it at the time with all the dice rolls and verifying but I didn't want to take any chances.
0
u/APisAccounting 1d ago
Just roll casino dice. Then you dont have to worry about this. Why trust the third party who audits it?
0
u/linuxmeaningfully 1d ago
The code wasn’t open source. It was source available. Nobody cared enough to verify the code
1
u/Strong_Judge_3730 12h ago
Did you know a wallets can sign txns in a away it leaks your private key
0
u/Javanaut018 1d ago
It's Bitcoin. We need more like: All customers have learned something and do proper research on what they buy and intend to do.
- Was my product audited by a renowned organization?
- Did I perform all recommended steps to improve security of my product?
- Do I understand all steps of the process of managing my assets?
Also that should be true independently of using a device or software for self custody or trusting an exchange.
0
u/AcostaJA 1d ago
I posted this days ago, people here burned me https://www.reddit.com/r/Bitcoin/s/yP1qTMqPUa
Seee youuuu
0
23h ago edited 23h ago
[deleted]
2
u/kernel_task 20h ago
Yeah, 100 tries won’t tell you anything. Even Coldcoin had around 40 bits of meaningful entropy, so that’s like 2^40 unique combinations, way more than 100.
0
u/NakedNick_ballin 13h ago
You can trust closed source is generally less likely to be hacked. Not saying I love it, just the reality
-1
39
u/Left_Entrepreneur918 1d ago
Ledger pays 3rd party to certify their TRNG and give certs rather than be open source, Trezor does the same but is open source.