- 💡 Why dice? (Creating Entropy with Our Own Hands)
- 🔍 Technical Fact: Even if we can randomly generate 11/23 words, the last word cannot be self-generated.
- 🛠️ In-depth: 3 Groups of Methods for Generating Seed Phrases with Real Dice
- 1️⃣ Direct Hardware Dice Input (Method for Directly Entering Dice Rolls into the Device)
- 2️⃣ Lookup Table Group (Randomly Generating Words with Paper Tables)
- 3️⃣ Manual Binary Conversion Group (Converting to Binary Bits Manually)
- 💡 Observation (Shortcut for those who don't want to do calculations)
- ❓ Why do some tables require +1? (Difference between 0-indexed and 1-indexed tables)
- 🚨 Precautions
- 📊 Comparison Table of Seed Phrase Generation Methods
- 💡 Summary
In late July, the Bitcoin and Self-Custody communities were shaken by major news regarding a vulnerability in the Entropy generation for Seed Phrases of the popular hardware wallet, Coldcard. This was due to a code error in the firmware that caused the system to generate security keys incorrectly, affecting a large number of users worldwide.
However, amidst this bad news, one important fact was confirmed: "Users who generated their Seed Phrase by rolling dice 50 times or more are safe and unaffected by this vulnerability."
This incident became a crucial turning point, making the Self-Custody community realize that even though modern hardware wallets have high-security random number generation chips, we should not solely rely on electronic systems or firmware from any single vendor, adhering to the principle of "Don't Trust, Verify."
Today, I will guide you through understanding Seed Phrase generation using Dice Roll Entropy in detail and correctly.
Why dice? (Creating Entropy with Our Own Hands)
Generally, each hardware wallet uses a Hardware TRNG (True Random Number Generator) chip or a combination of hardware random sources to generate our Seed Phrase.
However, the reason advanced users (or those with high paranoia) often choose to generate Entropy themselves using dice rolls is not because the device's random number generation is poor, but because they want to eliminate the risk of relying on the vendor (Vendor Trust Model) and instead use truly external Entropy that is not influenced by any software or firmware code.
(Note: In reality, we can also use other physical objects to generate Entropy, such as coin tosses (heads/tails), playing cards, or RPG dice like d12, d16, d20. However, we primarily use 6-sided dice (D6) because they are easy to find, inexpensive, commonly available, and the most convenient to use.)
Technical Fact: Even if we can randomly generate 11/23 words, the last word cannot be self-generated.
The last word of a Seed Phrase is not 100% random Entropy; it includes a checksum (the 12th word has a 4-bit checksum / the 24th word has an 8-bit checksum).
The checksum is calculated by passing all previous random bits through a SHA-256 Hash function. In practice, humans cannot calculate SHA-256 with paper and pen because it is too complex.
Therefore, in the step of finding the Checksum Word, we need to rely on offline processing tools, of which there are several convenient options:
- Hardware wallets with a feature to calculate the last word, such as Blockstream Jade, Foundation Passport, BitBox02, etc.
- Air-gapped computers / Live OS, such as disconnecting from the internet, removing Wi-Fi cards, or running Tails OS from a USB drive.
- Offline open-source software tools, such as the Ian Coleman BIP39 HTML script opened offline on a non-networked machine, or open-source Python scripts.
- An old air-gapped mobile phone that has been factory reset, SIM card removed, permanent signal disable, and used to run an offline seed calculation app.
In-depth: 3 Groups of Methods for Generating Seed Phrases with Real Dice
In practice, there are several ways to convert dice rolls into a Seed Phrase. Today, I will present three commonly used methods.
1️⃣ Direct Hardware Dice Input (Method for Directly Entering Dice Rolls into the Device)
This method saves the most rolling time and is suitable for those with air-gapped hardware wallets that can receive dice roll inputs directly on the device.
- Devices supporting this method: Hardware wallets with this feature, such as Coldcard, SeedSigner, Krux, etc.
- Mathematics of this method (2.585 bits per roll): A standard 6-sided die (D6) has 6 possible outcomes (1–6). According to Information Theory, the amount of entropy per roll is calculated as log2(6) ≈ 2.585 bits.
- 12-word seed (128 bits): Requires at least 128 / 2.585 ≈ 50 rolls.
- 24-word seed (256 bits): Requires at least 256 / 2.585 ≈ 99 rolls.
- Steps:
- Open the hardware wallet and select the "Create with Dice Rolls" menu.
- Roll a D6 die and enter the result (1–6) onto the device one at a time, for at least 50 times (for a 12-word Seedphrase) or 100 times (for a 24-word Seedphrase).
- The device will take the sequence of numbers, pass them through a SHA-256 Hash process to generate random bits, and automatically convert them into all 12 or 24 BIP-39 words (including the final Checksum Word).
- Advantages: Fastest, requires the fewest rolls, and has a low chance of input errors.
- Disadvantages: Requires a compatible hardware wallet model and still relies on the device's SHA-256 function to convert to words.
2️⃣ Lookup Table Group (Randomly Generating Words with Paper Tables)
This method generates a Seed Phrase by using dice rolls to look up words directly from a "paper lookup table sheet." This allows us to obtain the first 11 BIP-39 words (for a 12-word seed) or the first 23 words (for a 24-word seed) without converting to binary or performing calculations ourselves. The obtained words are then entered into a hardware wallet for the device to calculate the final word (Checksum Word).
- You can download the translation table here: JadeDiceRollsGuide
- Steps:
- Print or open the BIP-39 word list table.
- Roll the dice and look up the words from the paper table one by one until you have all 11 (for a 12-word seed) or 23 (for a 24-word seed) initial words.
- Enter the 11 or 23 words you obtained into the hardware wallet via the "Restore / Import Seed" menu.
- After typing the 11/23 Seed Phrase words you calculated, when you reach the Final Word, the device will process the checksum calculation and display a list of possible final words for you to choose and save.
- Advantages: Highly flexible, works with various hardware wallet models, and you can see the words on the paper table yourself before entering them into the device.
- Disadvantages: Time-consuming to roll and look up words one by one, with a risk of human error from misreading table rows.
3️⃣ Manual Binary Conversion Group (Converting to Binary Bits Manually)
This method involves generating a Seed Phrase mathematically in bit form, using only dice, pen, paper, and the BIP-39 word list, without relying on any software for the initial words.
In this group, there are 2 rolling techniques for converting to a binary bit string (0 and 1):
- Technique A: 1 bit per 1 roll (Binary Style)
- Rolling rules: Roll 1, 2, 3 = 0 | Roll 4, 5, 6 = 1
- This is the easiest method to understand but requires a large number of rolls (128 rolls for a 12-word seed or 256 rolls for a 24-word seed).
- Technique B: 2 bits per 1 roll (Base-4 Mapping)
- Rolling rules:
- Face 1 = 00 | Face 2 = 01 | Face 3 = 10 | Face 4 = 11 |
- Face 5, 6 = Roll again; discarding faces 5 and 6 helps reduce bias, resulting in purer bits.
- This saves rolling time, reducing it to approximately 64 effective rolls (for 12 words) or 128 effective rolls (for 24 words).
Steps to convert to words manually:
- Roll the dice until you have the desired length of binary bits: 128 bits (for 12 words) or 256 bits (for 24 words).
- Divide the randomly generated bits into groups of 11 bits each (according to BIP-39 standard, 1 word = 11 bits).
- Convert the 11 binary bits of each group into a decimal number (this will result in a value between 0 and 2047).
- Take the resulting number, look it up in the BIP-39 Word List (2,048 words), and write down the word corresponding to what you have randomly generated for the first 11 or 23 words.
- Enter the 11 or 23 words obtained into the device to find the last word (Checksum Word).
- Advantages: Most transparent, allows you to learn the underlying mathematics, and generates the first 11/23 words on paper 100% without using any electronic devices in the initial step.
- Disadvantages: Most time-consuming and requires high concentration, with a risk of bit calculation errors if not careful.
Observation (Shortcut for those who don't want to do calculations)
In reality, we don't always need to convert binary numbers (0s and 1s) to decimal! If we use a BIP-39 Wordlist table that already has the Bit Code next to each word, we can directly match the 11-bit sequence we rolled to the corresponding code in the table, just like looking up words in a dictionary.
For example: If you roll 00000000001, you can directly find the code 00000000001 in the table and use the word "Ability" without the headache of calculations.
Why do some tables require +1? (Difference between 0-indexed and 1-indexed tables)
The reason some websites tell you to add +1 to the number before looking it up in the table stems from the difference in "indexing methods" between computer systems and humans.
- 0-based Indexing (computer count): Computers start counting the first word as index 0 (ranging from 0 to 2047).
- How to use: Whatever number you calculate, directly find that row. For example, if you get 0 = abandon, if you get 1 = ability.
- 1-based Indexing (human count): Humans are usually accustomed to counting the first word as index 1 (ranging from 1 to 2048).
- Usage: Since the computer counts the first word as 0, but on paper the first line is 1, we must always add 1 to the calculated number. For example, if the calculated number is 0, add 0 + 1 = 1, then look up line 1, which will perfectly match the word "abandon".
📌 Admin's advice: To prevent confusion and reduce the risk of calculation errors, it is best to download and use the 0-based Index (0–2047) BIP-39 table. This way, whatever number you get, you can find the word directly in the table 100% of the time, without needing any additional calculations!
You can view the BIP-39 wordlist at BIP39-wordlist (0-based Index), and BIP39-wordlist (1-based Index)
Cautions
Warning: Generating a Seed Phrase by rolling dice is a manual process that adds complexity. If not done correctly, it can lead to asset loss.
- Dice Quality (Biased Dice): Common plastic dice often have uneven weight distribution. It is recommended to use Casino Dice / Precision Dice or roll multiple standard dice together.
- Do not make up numbers: Humans are not truly random. Mental calculations follow predictable patterns. Only real dice rolls should be used.
- Do not roll less than the specified minimum: Rolling dice fewer than 50 times (for 12 words) or fewer than 100 times (for 24 words) when using the Direct Hardware Dice Input method will result in dangerously low entropy, making it vulnerable to brute-force attacks by hackers.
- Security of the location: When rolling dice and recording, ensure you are in a closed, secure room with no CCTV, mobile phone cameras, or anyone secretly observing.
Comparison Table of Seed Phrase Generation Methods
| Comparison Aspect | 1. Auto-Gen on Normal Machine | 2. Direct Raw Entry on HW Wallet | 3. Lookup Table | 4. Manual Binary (11 bits per word) |
|---|---|---|---|---|
| Convenience | ⚡⚡⚡⚡⚡ (Fastest) | ⚡⚡⚡ (Medium) | ⚡⚡ (Time to look up table) | ⚡ (Time-consuming and requires high concentration) |
| Required Equipment | Hardware Wallet | D6 Dice + Coldcard / SeedSigner / Krux | Dice + Wordlist Table + Jade | D6 Dice + Notepad + Offline Tool |
| Trust Model | Trust in random chip and Firmware | 100% self-generated entropy + Hash assistant | 100% self-generated entropy + Checksum finder | |
| Chance of Human Error | Very low | Low (typing only numbers 1–6) | Medium (may misread the table) | Medium-high (requires careful bit calculation) |
| Suitable for | Beginners / General users | Intermediate-advanced users prioritizing certainty | Users of devices like Jade or Passport | Those who like to verify mathematics themselves |
Summary
The recent Coldcard news reminds us that self-custody is not just about buying a Hardware Wallet but about understanding the underlying process of how our assets are protected.
Generating a Seed Phrase with dice may not be necessary for everyone just starting out, but it is an excellent tool and skill for those who require high security. It allows us to be confident that the key to our safe is 100% generated by our own hands, without any guesswork from any software.
However, the recent events do not mean that Hardware Wallets are unsafe or untrustworthy. The most important thing is to assess your own readiness. If you decide to use the dice method, you must do so with understanding, patience, concentration, and always verify accuracy. This is because more complex methods come with greater responsibility. "With great power comes great responsibility."
แชร์:
Understanding Entropy: Lessons from Coldcard and Secure Hardware Wallet Selection