Evaluation of Entropy and Randomness

[Jaffasoft]

Evaluation of Entropy and Randomness
Current Implementation
Entropy Source:
The script uses random.randint(1, 6) in generate_bit_from_dice() to simulate dice rolls, seeded with random.seed(os.urandom(32)).

os.urandom(32) provides 32 bytes (256 bits) of cryptographically secure randomness from the operating system’s secure RNG (e.g., /dev/urandom on Unix or CryptGenRandom on Windows).

However, random.randint() relies on Python’s random module, which uses the Mersenne Twister PRNG—not cryptographically secure by itself. While seeding it with os.urandom() improves randomness initially, subsequent calls to random.randint() follow a deterministic sequence.

Dice Simulation:
Each "roll" generates 1 bit (odd = 1, even = 0), discarding ~1.585 bits of potential entropy per roll (since a d6 provides log₂(6) ≈ 2.585 bits).

For 128 bits (12-word seed), it simulates 128 rolls; for 256 bits (24-word seed), 256 rolls. This matches BIP-39’s entropy requirements (128 or 256 bits).

BIP-39 Compliance:
The script correctly implements BIP-39:
Generates 128 or 256 bits of entropy.

Adds a 4-bit (12-word) or 8-bit (24-word) checksum from SHA-256.

Splits into 11-bit chunks to map to the 2048-word list.

The process is sound, but the entropy quality depends on the source.

Security:
Strength: os.urandom(32) as a seed is cryptographically secure, making the initial state unpredictable.

Weakness: Using random instead of a cryptographically secure RNG (e.g., secrets) means the entropy isn’t continuously secure. An attacker who knows the Mersenne Twister state (e.g., via side-channel timing or seed reconstruction) could predict subsequent bits after observing enough output.

Is It Good Entropy?
Quantity: Yes, it provides the exact 128 or 256 bits required by BIP-39.

Quality: No, it’s not optimal. The random module, even seeded with os.urandom(), isn’t designed for cryptographic use. A truly secure BIP-39 implementation should use a continuous cryptographically secure RNG (e.g., os.urandom() directly or secrets) for all entropy.

Best BIP-39 Standards
Bitcoin wallets (e.g., Sparrow, hardware wallets like Trezor) use continuous cryptographically secure randomness (hardware RNGs or OS-provided secure RNGs) to ensure every bit is unpredictable.

The gold standard avoids PRNGs like Mersenne Twister entirely, relying on os.urandom() or equivalent for all entropy generation.

Adjustments for Best BIP-39 Standards
To make SeedMaker meet the highest standards:
Replace random with secrets:
Use secrets.randbelow(6) + 1 instead of random.randint(1, 6) for dice simulation. secrets taps directly into the OS’s secure RNG, ensuring every roll is cryptographically random.

Remove random.seed(os.urandom(32))—it’s unnecessary with secrets.

Optimize Entropy Generation:
Optionally, generate entropy directly with os.urandom(16) (128 bits) or os.urandom(32) (256 bits) for efficiency, bypassing dice simulation. However, since your UI emphasizes dice rolls, we’ll keep the simulation with secrets.

Maintain Current Features:
Keep the odd/even bit mapping (1 bit per roll) for user-friendliness, despite its inefficiency, as it aligns with your dice-based theme.

Entropy Methods in Original Script
The original SeedMaker script generates entropy in several ways:
Dice Rolls (128_dice_rolls, 256_dice_rolls):
Uses random.randint(1, 6) seeded with os.urandom(32) in generate_bit_from_dice().

Maps odd (1, 3, 5) to 1, even (2, 4, 6) to 0.

Random Hex (32_hex, 64_hex):
Uses random.choice('0123456789abcdef') in random_hex_char() for auto-filling hex input.

Also accepts user-provided hex input.

Random Binary (input_128_bits, input_256_bits):
Accepts user-provided binary input (0s and 1s), no auto-generation in script.

Seed Phrase Generation (make_a_12_word_seed_phrase, make_a_24_word_seed_phrase):
Uses generate_entropy_from_dice() (dice simulation) internally.

Issues with Original Entropy
Dice Rolls: Relies on random (Mersenne Twister), not cryptographically secure despite os.urandom(32) seed.

Random Hex: Also uses random.choice(), inheriting the same PRNG weakness.

Random Binary: User-provided, so quality depends on the user—no auto-generation to evaluate.

Seed Phrase: Inherits dice roll flaws via generate_entropy_from_dice().

Goal for Highest BIP-39 Standards
Use cryptographically secure randomness (e.g., secrets or os.urandom()) for all methods.

Ensure 128 bits (12-word) or 256 bits (24-word) of entropy are uniformly random and unpredictable.

Align with Bitcoin wallet standards (e.g., hardware wallets like Trezor, software like Sparrow).