Damus
Open in Damus

Recent Notes

HODL · 3d
The idea that we were plugging this stupid fucking piece of shit into a 9 volt battery to mitigate extremely esoteric and sophisticated NSA level electromagnetic attacks meanwhile it had worse entropy...
 waxwing profile picture
waxwing @waxwing
Yeah wrong threat model. His argument against commodity hardware (laptops) was that 'you have to drill out the wifi card' or something along those lines.

Risk assessment is a funny thing. I honestly think there are a lot of technically brilliant people out there who are genuinely bad at it, without realizing.
fiatjaf · 15h
May I ask what do you think about GreenAddress-style multisig solutions? Or something like https://xcancel.com/PeterRizun/status/2084063800962253228?
 waxwing profile picture
waxwing @waxwing
w.r.t. GreenAddress: I was a user back in the day. I think Lawrence did amazing work, great engineer. I think it's a very valid choice for small to medium sized wallets, that you actually want to use. Isn't this new Bitkey thing somewhat similar in design? well not in the details but in the 'the company exists as both a security (in spending) measure and also a recovery measure'. i think it's great, but for cold storage? it's the same old same old: 'central point of failure'. you can do it, i'm not saying you're somehow "wrong", just I don't like it.
FeynStructure · 15h
Mmm, yes. Multi-build? Unless you're fabbing your own chips though, there's always a vendor somewhere in the mix.
fiatjaf · 15h
May I ask what do you think about GreenAddress-style multisig solutions? Or something like https://xcancel.com/PeterRizun/status/2084063800962253228?
Matt Corallo · 1d
> Test before hashed/ whitened: yes. That was my original thought. But as others pointed out, that's not the same thing as what the whole process outputs. Sure, but screwing up XORing three validated...
 waxwing profile picture
waxwing @waxwing
I think I'm misunderstanding the mechanics. I said 'inputs' to mean exactly 'pre-whitening'. But i have no idea exactly how it would work on Linux. Claude told me yesterday that it's deliberately made almost impossible to do, which makes a lot of sense, if true.

Re: 'at least one validated', yep, that seems to be the right general idea.
1
Matt Corallo · 18h
> I think I'm misunderstanding the mechanics. I said 'inputs' to mean exactly 'pre-whitening'. But i have no idea exactly how it would work on Linux. Claude told me yesterday that it's deliberately made almost impossible to do, which makes a lot of sense, if true. Right, the suggestion doesn’t w...
Matt Corallo · 1d
That’s definitely not true. If you can run a test on the bits (and can extract a few orders of magnitude more bits than you need) before you use them and before they’re hashed/whitened/etc, you ca...
 waxwing profile picture
waxwing @waxwing
Test before hashed/ whitened: yes. That was my original thought. But as others pointed out, that's not the same thing as what the whole process outputs.

Also as per your comment with HWW, isn't it super-hard/impossible to check the *input* to dev/urandom's CSPRNG, in practice?

If I'm wrong, I'm very glad, but I think if I am wrong, it's at least *extremely* messy, right?
1
Matt Corallo · 1d
> Test before hashed/ whitened: yes. That was my original thought. But as others pointed out, that's not the same thing as what the whole process outputs. Sure, but screwing up XORing three validated chunks together is harder than screwing up one. It wouldn’t have saved this case (which was ultim...
mike · 1d
The interesting thing about entropy is even the seed phrase: twelve twelve twelve twelve twelve twelve twelve twelve twelve twelve twelve twelve Which doesn't seem random, was random enough to not have been tested as a seed phrase until 5 months ago. nostr:nevent1qvzqqqqqqypzp6pmv65w6tfhcp73404...
waxwing profile picture
Fwiw i thought more about it last night, chatted with Claude about it, and saw a serendipitous tweet from Matthew Green making similar points in the negative:

I don't think what I'm alluding to here is even really possible at all; you can't really 'verify that you're actually getting random output', and not only because of intermediate hashing steps.

Wish I were wrong but it really seems that way.

There are other interesting ideas around testing, but I want a 'one click' version for a user, and I can't find one unless they generate the entropy themselves and do not mix it with from-device entropy. So dice rolls and similar.

waxwing @waxwing · 2d
We all (who have tech skills) are at least a little bit at fault. We never developed some kind of norm of: how can you assure your users that their private keys are 'proper'? Were they supposed to look at them? No. If you grab your randomness from the OS, you can't know, via t Show more
14❤️2👌1
Cypherpunk AI · 1d
Entropy verification is indeed a challenge, consider using statistical tests like Diehard or NIST to evaluate randomness, albeit not foolproof.
Matt Corallo · 1d
That’s definitely not true. If you can run a test on the bits (and can extract a few orders of magnitude more bits than you need) before you use them and before they’re hashed/whitened/etc, you can absolutely test for quality. You then take a few sources that you’ve tested and xor/hash it all ...
Sjors · 1d
For us non-xers, link to tweet?
Computronium · 1d
A random picture, at a random location, at a random time, at a random angle, is more trustworthy than a TRNG no matter how it’s implemented. I simply don’t care what mathematicians say. Most of them are poor. The real world has many pitfalls preventing perfection or trueness. The NSA obviously h...
nout · 2d
How many random numbers do you need to generate to be able to reasonably verify the distribution is uniform? There could be a well tested lib that does that and that's included by the wallets? I guess...
 waxwing profile picture
waxwing @waxwing
Yeah it's very tricky. I'm not sure how to make it practical; it has to be the *souce* value that you're testing for uniformity. It doesn't have to be *perfectly* uniform, or even that close. But it has to be like 100 bits of genuine entropy... note for nonces that would not cut it, but for private keys it does. Not easy!
1
nout · 2d
This explains running Health test as part of the generation. So maybe something of that nature. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/nist.sp.800-90b.pdf
note1cm4ws...
waxwing profile picture
waxwing @waxwing
Exactly. And where it goes wrong is where the randomness sources are fine (only needs one to be good!) but somehow the logic of combining them gets badly screwed up. 'After the event ' could catch that. But, tricky.