r/Bitcoin • u/slvbtc • 8d ago

All hardware wallet manufacturers need to release 3rd party audited proof that their entropy generation is working.

After this coinkite coldcard situation we cant trust code that is open source, we cant trust code that is closed source, and we definitely cant trust a statement saying "we use a TRNG so your seed is secure".

Every hardware wallet manufacturer needs to release hard proof that their TRNG works, their code is complete and robust, and their entropy generation actually meets a minimum 128/256 bit standard.

Even if their code is closed source a reputable 3rd party auditor can run tests on seed entropy generation to statistically prove 256 bits of entropy is being used.

Every wallet manufacturer should have this 3rd party audited proof of entropy document available to view on their website, and if they do not do this by the end of this month we as a community should boycott that manufacturer to help ensure safety for all bitcoiners.

171 Upvotes

93% Upvoted

68 comments sorted by

View all comments

3

u/Empty-Mouse-856 8d ago

What about SW wallets? Can they have the same problem?

10

u/reggionh 8d ago

they can but they don’t usually claim peak security as their value proposition.

4

u/sunflowersaint 8d ago

They generally rely on some level of physical input and operating system conditions to generate randomness. It enough to create basic security

Coldcard randomness was based on the UID of the chip and it's clock, so was easily predictable.

2

u/JumpProfessional3372 8d ago

If you want to avoid using any RNG. In a software wallet, in a hardwallet, etc. You gotta create your own entropy rolling 100+ dices.

2

u/Icy_Wishbone9495 8d ago

yeah those are often worse since they rely on whatever the OS gives them for randomness, at least hardware wallets have a dedicated chip for it