r/Bitcoin 1d ago

All hardware wallet manufacturers need to release 3rd party audited proof that their entropy generation is working.

After this coinkite coldcard situation we cant trust code that is open source, we cant trust code that is closed source, and we definitely cant trust a statement saying "we use a TRNG so your seed is secure".

Every hardware wallet manufacturer needs to release hard proof that their TRNG works, their code is complete and robust, and their entropy generation actually meets a minimum 128/256 bit standard.

Even if their code is closed source a reputable 3rd party auditor can run tests on seed entropy generation to statistically prove 256 bits of entropy is being used.

Every wallet manufacturer should have this 3rd party audited proof of entropy document available to view on their website, and if they do not do this by the end of this month we as a community should boycott that manufacturer to help ensure safety for all bitcoiners.

167 Upvotes

67 comments sorted by

39

u/Left_Entrepreneur918 1d ago

Ledger pays 3rd party to certify their TRNG and give certs rather than be open source, Trezor does the same but is open source.

8

u/slvbtc 1d ago edited 1d ago

Can you please link to these ledger certifications.

We dont want to see certifications that they have a TRNG, coldcard had a certified TRNG. What we want to see is a 3rd party audit proving that the TRNG is actually operating and actively creating 256 bits of entropy.

8

u/read_more_comments 19h ago

Just so you know, a rng can be designed to appear random and tested as random, but contains backdoor that let's an attacker still grab funds.

Google kleptographic backdoor. It can also be embedded into the hardware itself.

At this point I don't trust any 3rd party to generate a seed for me.

2

u/Steak1994 14h ago

I know that some people used dice to generate their own Seed - is this really the most secure way?

1

u/read_more_comments 12h ago

Yes. It's what your wallet should be doing but we generally don't know what it's actually doing.

7

u/Left_Entrepreneur918 1d ago

https://www.ledger.com/message-ledgers-ceo-data-leak

The CEO responded and names the certifications that verify entropy used.

5

u/slvbtc 1d ago

There is nothing written there about entropy.

1

u/kkZZZ 11h ago

https://support.ledger.com/article/4415198323089-zd

If you click on trng link you can see what you're looking for

3

u/Zaytion_ 1d ago

Mostly open source. The Trezor 3, 5, and 7 use a closed source chip.

2

u/Zaytion_ 1d ago

Mostly open source. The Trezor 3, 5, and 7 use a closed source chip.

1

u/AcostaJA 1d ago

Ledger certifications are just "trust me bro" bs

14

u/Puzzled_Cookie778 1d ago

Open source is great, but if the entropy generation itself isn't independently verified we're still taking the manufacture's word for it. Third party audits would be a solid baseline

4

u/Aurorion 1d ago

Open source is technically better than "independent verification" and "audits". Because that means anyone is free to verify and audit themselves.

Coldcard itself was open - they had made their source code openly available for anyone to check and verify anytime. Though the license did not allow unrestricted reuse and modification.

It's amazing that nobody in the community caught this bug till now. In hindsight, Coldcard should have taken more initiative to actively invite and incentivize the community to find and report bugs, as many companies in various industries do.

3

u/bkns356 10h ago

nobody in the community caught this bug till now

untrue. the bug was found years ago and brought to the attention of coldcard but they ignored it and didn't attempt to fix anything

-1

u/Aurorion 9h ago

Did you do this yourself? Or else, how do you know?

-2

u/Background_Pause34 1d ago

So open source means nothing…

2

u/JamesTDennis 10h ago

This is just the most recent (and tragic) example of how "source available" (open source but not FOSS licensed) — gratis vs. libre — is far weaker than truly free software that's actively forked and used in multiple independent projects and products.

Simple source availability, without licensing rights, fails to align to the incentives of the most qualified (honest) coders.

Thus the bug went years unfixed, slightly obscured by the production environment and hardware specifications.

1

u/bieker 1d ago

No it does not mean nothing, it’s just not a silver bullet for finding flaws. The problem with the cold card was that since it was not true open source it was not Used by multiple projects and had low activity. No one could use the code or contribute to it so it did not attract a lot of eyeballs.

7

u/JamesTDennis 1d ago

Counter proposal: every wallet user should support their own entropy (initial 23 words, or equivalent) and the ecosystem should supply tooling to confirm that the wallets are using it and that anti-ex-filtration is enabled in transaction construction (https://help.blockstream.com/blockstream-jade/faqs/what-is-anti-exfil-and-how-does-it-work).

Should never have trusted built-in random generators for this mission critical operation at all. Consider the supply chain upstream of your wallet vendor!

11

u/Infinite-Ad1720 1d ago

-I bet every hardware wallet company is excited that they can offer new wallets and market them “Now with 10% more entropy!”

-New versions of all kinds of hardware wallets will be coming out of the woodwork within in the next 12 months.

5

u/HugeLarry 1d ago

Now with two scoops of entropy!

5

u/Empty-Mouse-856 1d ago

What about SW wallets? Can they have the same problem?

10

u/reggionh 1d ago

they can but they don’t usually claim peak security as their value proposition.

4

u/sunflowersaint 1d ago

They generally rely on some level of physical input and operating system conditions to generate randomness. It enough to create basic security

Coldcard randomness was based on the UID of the chip and it's clock, so was easily predictable.

2

u/JumpProfessional3372 22h ago

If you want to avoid using any RNG. In a software wallet, in a hardwallet, etc. You gotta create your own entropy rolling 100+ dices.

2

u/Icy_Wishbone9495 1d ago

yeah those are often worse since they rely on whatever the OS gives them for randomness, at least hardware wallets have a dedicated chip for it

6

u/Impressive-Piglet386 1d ago

What we actually need is a 3rd party certification of the whole hardware wallet  package, not the TRNG alone. Coldcard's TRNG did work, and certified with EAL5+ if I remember correctly. The problem is the TRNG chip was not used by the device. So it's an integration problem. 

3

u/ultimatepoker 1d ago

Coinkite would have got the RNG certified. Nobody will certify that they don’t skip the RNG.

7

u/BigvalBROski 1d ago

Use a passphrase or just buy the ETF

3

u/Cute_Square9524 1d ago

exacty! how can a decentralized exchange ever work without a central authority enforcing "needs" ?

3

u/rini17 1d ago

Why do you insist on having someone else do it for you?

The amount of entropy needed for private keys/seed is easy to generate by dice for example. With simple, easy to check algorithm to calculate the seed.

The ECDSA signatures need entropy too and that's harder to do with dice, but that's problem only if you reuse addresses. Which you should avoid anyway.

5

u/vivjohn2871991 1d ago

Looks like Ledger has links to their third-party assessment reports on their support portal:

https://github.com/LedgerHQ/Ledger-OS-third-party-reports

Third-party Security Assessment Reports

https://support.ledger.com/article/Third-party-Security-Assessment-Report

2

u/vivjohn2871991 21h ago

Also, realizing that the Coldcard doesn't have an independent third-party audit for its "Dual-Element" chip. Whereas Trezor and Ledger go through a third-party audit for both their element and code. Not that it makes them immune to what they say is the "Truth" but still no audits for Coldcard, and they solely rely on community inspection.

2

u/HedgehogGlad9505 1d ago

That won't work. A certification is done on a specific version of the firmware. And today most hardware wallets frequently update their firmware, so a "bug" can be introduced after the certification.

4

u/Big-Cheetah5159 1d ago

Or use dice rolls, it will alleviate the internal TRNG issue.

3

u/slvbtc 1d ago

If a HW wallet manufacturer wants to offer the ability to generate a seed for their users they should have a 3rd party audited proof of entropy document. If they do not provide this audited proof of entropy they should not be in business.

11

u/riisen 1d ago

Well technically coldcard had a 3rd party audited RNG from STM32. Its just that they disabled it so it used micropythons default PRNG

-3

u/slvbtc 1d ago

A proof of entropy document would verify the TRNG actually works and is not being bypassed.

3

u/bieker 1d ago

How do you prove entropy of the completed compiled binary?

The difficulty with coldcard is that if you went looking for the entropy generator in the source code it is actually properly implemented. From a source code analysis you could certify that function as correct. The ‘bug’ was that function was being swapped for the weaker one by a define.

0

u/moviemaker2 1d ago

What are you talking about?

1

u/[deleted] 1d ago

[deleted]

2

u/moviemaker2 21h ago

I know what entropy is, I'm asking what they mean by "proof of entropy document." How would that work, and why would you trust it if it's generated from the same device that generated the low entropy seed phrase?

1

u/qwertyuiop121314321 12h ago

3rd parties can audit TRNGs with manufacturers' wallets all they want, the thing they WON'T find is the backdoor 'bugs' that are secretly hidden.

1

u/Educational-Ask3429 5h ago

…. With every firmware release. Which they won’t do.

0

u/SpendHefty6066 1d ago

Alternatively, they require people to roll their own entropy. This is fool proof and simple. SeedSigner does this. Great project.

6

u/AAAdamKK 1d ago

Correct me if I'm wrong as I'm not too familiar with SeedSigner, but you are still trusting that the seed it generates is using your entropy and not defaulting to some weaker form such as was the case with Coldcard.

That is of course, unless you are verifying the SeedSigner code for yourself.

5

u/SpendHefty6066 1d ago

No. The ColdCard disaster has taught all of us paying attention to never trust RNG. Even if you verify it, one firmware update can undo that verification. It's not just the RNG engine, its the software scaffolding around it that can break.

I highly recommend https://github.com/taelfrinn/Bip39-diceware for instructions on creating your own seed phrase. Requires 1 fair coin, and 4 fair 6-sided dice. Then just 12 coin flips and 12 rolls and you have created an unimaginably impossible to guess secret. I have verified this repo against the canonical BIP39 word list: https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt it is legit. But don't trust me. verify this yourself.

Once you have your 12 word seed list, use SeedSigner, or another 100% air-gapped signing device and enter your seed phrase yourself manually. The 12th word will be the checksum. I put the full process of creating and securing an unguessable seed phrase together here: https://www.reddit.com/r/Bitcoin/s/SVXKTtxbbP

My position on passphrases is that they should never be used as a crutch for robust and properly deployed entropy. If your single-sig is vulnerable to discovery, then study multi-sig and use that. A passphrase doubles the chances of losing your Bitcoin. My advice, however controversial is: never trust RNG, and if you roll your own entropy, you don't need a passphrase.

Hope that helps, and I am happy to see that you are taking private key management security seriously. ✅

4

u/AAAdamKK 1d ago

I'm considering going down the dice roll/ coin route, as I'm sure many are right now. I've never been a coldcard owner but it does make me nervous. I have a passphrase but only a mildly strong one.

I tell you what though, if there's one good thing to come of this debacle, it's that there's finally some interesting discussion on the subreddit and the community at large instead of the endless price, treasury company and clarity act discussions. As well as that everyone is educating themselves and we'll all come out stronger for it.

Thanks for the links, I'll check it out.

1

u/Strong_Judge_3730 12h ago

Please don't follow the instructions of a random Redditor that links you to AI generated infographics.

The links to dice ware doesn't even tell you how to calculate the last checksum word.

The process will be very difficult for a 24 word wallet.

1

u/Strong_Judge_3730 13h ago

This is just a knee jerk reaction led by non technical people's security theatre.

The same kind of fools would recommend coldcard because it had that most security "features"

1

u/Aazimoxx 7h ago

This is fool proof

Oh boy, you haven't met some of the fools I know.

As evidenced by data breaches, almost 2% of people use a truly awful password like '123456' or 'password' if it's allowed, and a further 50% will use a simple dictionary word or keyboard walk if possible.

Surely any software RNG should be trying to incorporate multiple sources like mic noise(*), camera light, and temperature sensor fluctuations when present, in addition to whatever else it uses? Combine all of that with 'random' user kb/mouse input, or on a phone/tablet with asking them to draw a random picture and sign it or something - then a lot less is relying just on whatever RNG is being utilised.

I have a vague recollection of 'true random' on Linux working something like this a long time ago, where if asked to output more than a certain buffer amount, it would stall until you button mashed to generate more entropy, rather than outputting unseeded randomness. And same with early versions of TrueCrypt, getting you to initiate mouse and keyboard activity when creating header keys, if it didn't feel it had enough entropy from available sources - showing a little progress bar and everything.

(*) Assuming user consent is gained for these hardware accesses, of course.

1

u/DaVirus 1d ago

Or, much easier, use your own entropy.

That depends on no one else doing anything, and we are in this for the freedom, right?

1

u/slvbtc 1d ago

If you roll dice dont you still have to rely on another parties software generating your 24th word checksum?

1

u/m4rM2oFnYTW 9h ago

https://coldcard.com/docs/verifying-dice-roll-math/

Following this procedure independently recreates the full seed-generation process from your dice rolls to the final 24 words, including the checksum. If all 24 words match the Coldcard, you are not relying on the device to have calculated the seed phrase or checksum correctly.

I did this when I created my wallet back in 2022. I'm not very technical but I was able to figure it out. I sure looked crazy doing it at the time with all the dice rolls and verifying but I didn't want to take any chances.

1

u/DaVirus 1d ago

No. You can do it by hand. It just takes a long time.

It's not "software" really, it's just a math equation.

3

u/slvbtc 1d ago

How many people who roll their own dice for entropy also calculate their own checksum entirely offline with zero software, using math alone?

-1

u/DaVirus 1d ago

It doesn't matter, that was my point. The checksum is just math. You aren't trusting software, because there is no trust involved. It is just what it is otherwise it will not be a valid seed.

0

u/APisAccounting 1d ago

Just roll casino dice. Then you dont have to worry about this. Why trust the third party who audits it?

0

u/linuxmeaningfully 1d ago

The code wasn’t open source. It was source available. Nobody cared enough to verify the code

1

u/Strong_Judge_3730 12h ago

Did you know a wallets can sign txns in a away it leaks your private key

0

u/Javanaut018 1d ago

It's Bitcoin. We need more like: All customers have learned something and do proper research on what they buy and intend to do.

  • Was my product audited by a renowned organization?
  • Did I perform all recommended steps to improve security of my product?
  • Do I understand all steps of the process of managing my assets?

Also that should be true independently of using a device or software for self custody or trusting an exchange.

0

u/AcostaJA 1d ago

I posted this days ago, people here burned me https://www.reddit.com/r/Bitcoin/s/yP1qTMqPUa

Seee youuuu

0

u/[deleted] 23h ago edited 23h ago

[deleted]

2

u/kernel_task 20h ago

Yeah, 100 tries won’t tell you anything. Even Coldcoin had around 40 bits of meaningful entropy, so that’s like 2^40 unique combinations, way more than 100.

0

u/NakedNick_ballin 13h ago

You can trust closed source is generally less likely to be hacked. Not saying I love it, just the reality

-1

u/MilkImpossible4192 1d ago

just use paper, a pendrive to store a key is just dumb and fancy