Rassah: Oh, one other answer (one of the techs is awake): We know we're getting sram because we are physically reading it.

Rassah: Initially the idea was: Write a salt onto the stick. Then generate key = H(H(entropy_1) + salt) + H(H(entropy_2) + salt), and print all of [key, salt, H(e1), H(H(e1) + salt), H(e2), H(H(e2) + salt)]. (+ could be arithmetic addition or XOR; either should be fine.) The user can then verify exactly one of the outer hashes on an insecure computer, and can verify the additions by hand (literally, pen and paper, no computer)

Rassah: key = H(salt||H(entropy)) with H(entropy) on a second sheet of paper so the user can verify it... or something

Rassah: Yes. If you plug tis device into your PC while holding down the button, it shows up in "flash mode", where instead of just a USB stick with a JPG on it, you get to see all the system and settings files. One of those files is a user provded sald (like diceware) that will be combined with the rest of the entropy sources to produce the final key

Rassah: I mean the chip and the hardware has a lot of stuff in there. The entropy is altready there, but initially we figured the SRAM chip was overkill. The "software adding entropy" meaning we just add more code to grab entropy from more hardware and user sources

Rassah: mircea_popescu: No, the hardware design is finished. Changes are only in software. Initial method of creating keys is done, we are just adding software patches to add more and more entropy sources to this thing.

Rassah: Is Atmel really that untrustworthy? Is there a better option?

Rassah: So, we won't be relying on Atmel's RNG, and will be reading their SRAM directly

Rassah: Ah, got a eply. Seems we'll be using he Atmel provided SRAM after all. And "We will be doing our own analysis of data from several chips, and provide a raw entropy file for those who want to do their own for their specific device." combined with "option to enter a user-supllied salt"

Rassah: asciilifeform: this device was designed and assembled by the people workin on the bitcoincard. They all know hardware extremely wel

Rassah: Sorry for the line spam

Rassah: the processor, but it's there and is probably perfectly fine and

Rassah: - the built-in TRNG; nobody trusts these things anymore as primary

Rassah: We can also add secondary sources to the mix:

Rassah: is taken from a different SRAM area every time.

Rassah: other 19/20th are stuck is much lower. Especially if the stored part

Rassah: unlikely; the probability that 1/20th of the SRAM behaves fine and the

Rassah: than we need, we can afford it. This memory effect is already very

Rassah: compare it on the next run. Since we have about 30 times more entropy

Rassah: We can store part of the raw entropy into non-volatile memory and

Rassah: In our tests, it still had plenty of entropy at 0ºC, but it smoothly went down to zero entropy around -20º. Maybe we should put warning stickers on these things saying "Caution - Chaotic System. Do not use in low entropy environments above the Arctic or below the Antarctic circle, unless exposed to external sources of energy" :) ☟︎

Rassah: I asked and can relay the Atmel/sram question. I think they are al asleep right now, since they're in Austria

Rassah: asciilifeform: No, that would be a few of the Mycelium devs. They described a lot of it to me, since I'm working with them (I'm the one doing the public interraction thing, and running Indiegogo and such)

Rassah: I think standalone sram

Rassah: You can check what the software calls for

Rassah: asciilifeform: Atmel SAM4L series running the software, with random number being generated only from SRAM, in combinaton with other things we're considering, like a salt you can add in a TXT file ☟︎

Rassah: Basically an extremely high level entropy generator that uses that entropy to make secure paper walets

Rassah: It's a USB stick that you stick into your priner's USB port, it detects a photo, and you hit print, making your printer print a bicoin paper wallet that's never been exposed to the web. Soon as you pull the stick out, the keys are gone for ever

Rassah: Though if he just bloggs, I'm not sure if that will be worth our time or money

Rassah: The only ones on Reddit who brought up issues were the ones I know to have technical backgrounds (sluch, peter todd, a few others who backed up their concerns with actual technical questions). Most everyone else just went gaga over it. I kinda assumed BitcoinPete knew something about cryptography and security, considering his statement, followed by me asking if he'd be interested in doing an audit for us, and him agreeing.

Rassah: mircea_popescu: Typicall they are one and the same. It's rare that people who dn't know whit about a topic shit all over it. Unless they're politicians

Rassah: so tech knowledge enough to be able to check how the software works, and maybe hardware knowledge to know what chips are being used in the schematic

Rassah: Basically, we have people with reservations about the randomness and security of our entropy devices, despite not actually knowing how it works, and we are hoping to get some of tose people to back up their claims

Rassah: Peter Todd will be doing an audit too, ad I was hping Bitcoin Pete was someone with some technical knowledge or something

Rassah: Huh. He's actually the reason I'm in here in the first place. I followed his blog here, after he tweeted that Mycelium Entropy < dice, and agreed once I asked him if he would be interested in auditing out device.

Rassah: Hey, can you guys tell me who BitcoinPete is?

Rassah: Basically, pools with 50% mining power are better than individuals with 50% mining power, and some ideas seem to make us trend to 50% owned by individuals

Rassah: then we have individuals that actually do control that mining power. Badly alligned incentives...

Rassah: I am especially concerned about the one where mining in a pool is made difficult to impossible by making sharing a secret key that lets the miner steal all coins a requirement. The way I see it is, we either have pools that concentrate mining power, but don't actually own or control that power, or we create incentives for individuals to amass tons of mining power, since being a smal miner or as part of a pool is impossible, and

Rassah: A lot of the whole "How can we fix 51% attacks" suggestions are really horrible...

Rassah: It was not 5 minutes, it was more like a long slog into the dumps

Rassah: ThickAsThieves: but how to apply this logic to Ploshay? Ploshay was well liked, and was like the "popular girl" or whatever, elected during a very public election when the BF was still something the general public was interested in, and when BF was still interested in a public image

Rassah: It's supported by bitcoind, blockchain.info, Armory, Mycelium, and probably many others. I figured bitcoin message signing is a step in the right direction, because not many are working on making PGP keys secure as hell, but tons of people are woking on making Bitcoin keys secure as hell, and easy to use from wallets. Otherwise I don't know what the difference in implementation is between PGP and BTC signing

Rassah: For instance, at the conference

Rassah: Is that in any way something you accomodate?

Rassah: mircea_popescu: I noticed you rely a lot on PHP... I've been treating my PHP keys like disposable tissues, and relyig on bitcoin message signing instead...