Feature-Anfrage: Model T sollte die Möglichkeit bieten, bei der Saatguterzeugung zu würfeln
- Dieses Thema hat 5 Antworten und 1 Teilnehmer, und wurde zuletzt aktualisiert vor 1 Jahr, 2 Monaten von
.
-
Beiträge
-
-
Ich war noch nie ein Fan davon, eine Bibliothek für zufällige Entropie zu verwenden. Computer sind nicht gut darin, wirklich zufällig zu sein. Es scheint, dass das Model T eine Code-Bibliothek verwendet, um Seeds zu erzeugen.
Warum sollte man nicht die gleiche Methode wie bei ColdCard für die Erzeugung von Zufallskeimen verwenden? Das heißt, man würfelt etwa 99 Mal und gibt 1-6 in das Gerät ein? Selbst wenn ein Mensch nicht würfelt, sondern mindestens 99 Mal 1-6 zufällig auswählt, ist das immer noch zufälliger als eine Bibliothek.
[https://coldcard.com/docs/verifying-dice-roll-math](https://coldcard.com/docs/verifying-dice-roll-math)
-
I’m sorry, you’ve got it completely backwards.
It’s humans who absolutely suck at being random. Check out some sources here: https://crypto.stackexchange.com/a/87982
In computers, on the other hand, this is a very well understood and solved problem. For instance, Trezor uses two sources of randomness:
* a **dedicated hardware peripheral** called a True Random Number Generator, which has [passed some standardized tests of random behavior](https://www.st.com/resource/en/application_note/dm00073853-stm32-microcontroller-random-number-generation-validation-using-the-nist-statistical-test-suite-stmicroelectronics.pdf)
* entropy generated by an operating system service on your PC, just in case you distrust the TRNG alone.Trezor is very good at what it does. Please, for your own security, don’t try fancy stuff and just use what Trezor generated for you.
—
As for “computers being not good”, what you’re thinking of is that a computer alone _cannot_ make randomness. A computer is a fully deterministic machine, meaning it always behaves the same way. All “random” algorithms are in fact pseudo-random.
But again, this is a well understood and solved problem. Computers do have external devices that provide noise: the user moving the mouse or touching the screen; network packets arriving at random times; noise heard from the microphone; dedicated hardware for generating noise.
Because this is so well researched, we understand very well how many random bits we’re “allowed” to take from the time of arrival of a key press, for example, and how many we need. (e.g., to get 128 bits of true entropy, way more than 128 key presses are needed)
With that, we apply cryptography: a CSPRNG is an algorithm that can stretch your 128 random bits into an effectively infinite random looking string. This is still _pseudo_ random, but unguessable: to get back the same randomness, you would need to steal, or brute-force, the original 128 bits. Plus any randomness that was collected and mixed in throughout the process.
-
-
-
-
Just generate your seed phrases – and additional passphrases before going to set up your Trezors.
There are LOTS of offline tools designed to do just this, search for HowTos.
Tails is a good platform just make storage temporary, take nothing away from your offline session other than papers,
Never digitise your Seed Recovery information, except to a hardware wallet or other dedicated airgapped device. Certainly never on anything capable of connecting to the internet.
Etched onto steel plates, stored in multiple secure locations far from home, secure passphrase separately from 24-word mnemonic.
-
- Du musst angemeldet sein, um auf dieses Thema antworten zu können.
