Disclosure: This account represents Cuvex, a hardware security device that uses user-generated dice-and-coin entropy as its standard Bitcoin wallet-creation process.
We are sharing this as a technical comparison of two different entropy models—not to attack Coinkite, claim that hardware random number generators are inherently unsafe, or suggest that any security implementation is infallible.
Coinkite recently published a security advisory concerning seed phrases automatically generated by certain versions of COLDCARD firmware.
The incident reinforces an important principle:
BIP39 structure vs. effective entropy
Under BIP39, a 24-word mnemonic encodes:
- 256 bits in its entropy field
- 8 checksum bits
- 264 bits in total
A correctly generated 24-word mnemonic should therefore originate from a space of:
2^256 possible entropy values
However, this is only true if the generation process actually produces 256 unpredictable bits.
A mnemonic can contain valid words, pass its checksum, derive valid keys and be accepted by standard wallets while still originating from a significantly smaller effective search space.
What Coinkite reported
According to Coinkite’s preliminary technical analysis, affected devices may have generated seeds from effective search spaces of approximately:
- 40 bits on affected Mk3 devices
- 72 bits on affected Mk4, Mk5 and Q devices
These figures are preliminary estimates and may change as Coinkite’s investigation continues. They should not be interpreted as exact measurements of every individual affected seed.
For comparison:
- 2^40 ≈ 1.1 × 10^12
- 2^72 ≈ 4.7 × 10^21
- 2^256 ≈ 1.16 × 10^77
The problem was not the visible BIP39 structure of the affected mnemonics.
The problem was the amount of unpredictable entropy behind them.
Updating the firmware does not repair a seed generated by affected firmware. Users covered by the advisory should follow Coinkite’s official instructions, create an entirely new wallet and migrate their funds.
This does not make all hardware RNGs unsafe
A correctly designed and implemented hardware random number generator can provide excellent cryptographic entropy.
Automatic seed generation does, however, require an entire implementation chain to operate correctly:
- the physical entropy source;
- RNG initialization and configuration;
- firmware implementation;
- combination or hashing of entropy sources;
- device and build configuration;
- the execution path actually used during seed creation.
A failure anywhere in that chain may reduce effective entropy without changing the appearance of the final mnemonic.
That is the broader lesson from this incident.
COLDCARD’s manual dice option
COLDCARD also supports user-supplied entropy through repeated rolls of a conventional six-sided die.
A fair D6 roll provides a maximum theoretical entropy of:
log₂(6) ≈ 2.585 bits
Its documented method uses approximately:
- 50 rolls for a 128-bit target;
- 99 rolls for a 256-bit target.
Using one die repeatedly is mathematically valid when the rolls are private, independent, correctly recorded and correctly processed.
The relevant difference is therefore not that one die is unsafe.
The difference is whether physical user-generated entropy is an optional mode or the standard wallet-creation process.
How Cuvex generates wallet entropy
Cuvex does not rely exclusively on an internal automatic seed generator.
Its standard wallet-creation process requires:
- four color-coded six-sided dice;
- one coin;
- 23 accepted physical rounds;
- complete offline operation.
Each attempt has:
6^4 × 2 = 2,592 possible combinations
The English BIP39 dictionary contains:
2,048 = 2^11 words
Cuvex maps accepted dice-and-coin combinations directly to those 2,048 words.
When a result falls outside the usable dictionary range, the device rejects it and requires the user to repeat the round.
This is rejection sampling.
It avoids the bias that would be introduced by simply reducing 2,592 possible outcomes modulo 2,048.
After rejection sampling, each accepted round selects one of exactly 2,048 BIP39 words:
log₂(2,048) = 11 bits
Across 23 accepted rounds:
23 × 11 = 253 bits
The process therefore provides up to:
How the final word is constructed
The first 23 selected BIP39 words encode 253 bits.
The Cuvex firmware then:
- Deterministically derives the remaining three bits from those 253 bits using SHA-256.
- Forms the 256-bit BIP39 entropy field.
- Calculates the standard eight-bit BIP39 checksum.
- Constructs the 24th word.
Conceptually:
user_entropy = 253 bits from 23 accepted physical rounds
remaining_3_bits = deterministic SHA-256-derived bits
bip39_entropy = user_entropy || remaining_3_bits
checksum = first 8 bits of SHA-256(bip39_entropy)
word_24 = remaining_3_bits || checksum
Because the additional three bits are deterministic, they do not add independent entropy.
The accurate claim is therefore:
We are not claiming 260.8 bits of effective entropy or 256 independent physical bits.
The raw input space before rejection is larger, but rejected results do not become part of the mnemonic. Deterministically derived bits also do not add new entropy.
Is 253 bits materially weaker than 256 bits?
From the perspective of exhaustive search, 253 bits represents:
2^253 ≈ 1.45 × 10^76 possible entropy values
The practical difference between 253-bit and 256-bit exhaustive-search resistance is irrelevant against any realistic brute-force attack.
The more meaningful distinction is architectural:
This reduces dependence on failure modes involving:
- incorrect RNG initialization;
- predictable internal state;
- firmware or build configuration errors;
- unintended execution paths;
- silent reductions in automatically generated entropy.
It does not make firmware irrelevant.
The device must still correctly capture the results, reject out-of-range combinations, map accepted values, derive the final bits and calculate the BIP39 checksum.
Physical entropy does not eliminate implementation risk.
It changes the trust model and the origin of the unpredictability.
Open implementation
The relevant Cuvex firmware is publicly available for inspection.
Reviewers can examine:
- how the dice and coin are converted into an index;
- how out-of-range combinations are rejected;
- how accepted results map to BIP39 words;
- how the remaining three bits are derived;
- how the checksum and final word are constructed.
We believe entropy claims should be connected to inspectable implementations rather than inferred solely from the number of words displayed by a device.
Optional BIP39 passphrase
Cuvex also supports an optional BIP39 passphrase.
The passphrase:
- is not literally a 25th seed word;
- does not repair weak seed generation;
- derives a completely different wallet;
- acts as an additional independent secret.
Its protection depends on its unpredictability. A short or common passphrase may add very little resistance, while a long, unique and random passphrase can add a substantial independent search space.
It also introduces operational risk:
Losing the passphrase means losing access to the wallet derived from it.
Conclusion
The COLDCARD incident demonstrates that the visible structure of a mnemonic is not proof of the entropy behind it.
The relevant technical questions are:
- Where did the original randomness come from?
- How much independent entropy was captured?
- Were the source events sufficiently independent?
- How was the source material converted into BIP39?
- Was mapping bias removed correctly?
- Could a hardware, firmware or build failure silently reduce the search space?
- Can the implementation be independently inspected?
Automatic hardware entropy can be secure when correctly implemented.
User-generated physical entropy can also be secure when correctly performed and processed.
The distinguishing property of Cuvex is not that it exceeds BIP39’s 256-bit maximum.
It is that physical, user-generated entropy is the standard wallet-creation process, avoiding exclusive dependence on an automatic internal seed generator.
We welcome technical review of the implementation and constructive discussion.
No comments:
Post a Comment