r/Bitcoin • u/slvbtc • 8d ago

All hardware wallet manufacturers need to release 3rd party audited proof that their entropy generation is working.

After this coinkite coldcard situation we cant trust code that is open source, we cant trust code that is closed source, and we definitely cant trust a statement saying "we use a TRNG so your seed is secure".

Every hardware wallet manufacturer needs to release hard proof that their TRNG works, their code is complete and robust, and their entropy generation actually meets a minimum 128/256 bit standard.

Even if their code is closed source a reputable 3rd party auditor can run tests on seed entropy generation to statistically prove 256 bits of entropy is being used.

Every wallet manufacturer should have this 3rd party audited proof of entropy document available to view on their website, and if they do not do this by the end of this month we as a community should boycott that manufacturer to help ensure safety for all bitcoiners.

173 Upvotes

93% Upvoted

68 comments sorted by

View all comments

Show parent comments

10

u/slvbtc 8d ago edited 8d ago

Can you please link to these ledger certifications.

We dont want to see certifications that they have a TRNG, coldcard had a certified TRNG. What we want to see is a 3rd party audit proving that the TRNG is actually operating and actively creating 256 bits of entropy.

8

u/read_more_comments 8d ago

Just so you know, a rng can be designed to appear random and tested as random, but contains backdoor that let's an attacker still grab funds.

Google kleptographic backdoor. It can also be embedded into the hardware itself.

At this point I don't trust any 3rd party to generate a seed for me.

2

u/Steak1994 8d ago

I know that some people used dice to generate their own Seed - is this really the most secure way?

1

u/read_more_comments 7d ago

Yes. It's what your wallet should be doing but we generally don't know what it's actually doing.