Rassah: benkay: a lot of tings said on the topic of that Entropy device have been very retarded

Rassah: asciilifeform: I use "hash" interchangeably with "compute with one of the inputs for the formula being your source of entropy, and the output being your private key

Rassah: Nikita: Total size 32 kBytes, we use about 21 kB as entropy source.

Rassah: Me: You're basically saying that, even if they stole the device and examined it, or stole one that was made right after it with similar chip characteristics, they'd still have 8000 bits of entropy to dea with, making their brutefocing impossible?

Rassah: So it's a good thing we're not relying on just SRAM fo the entropy then

Rassah: asciilifeform: So, if I use an entropy device to generate paper walets, you can bruteforce it by recording the temperature in my room???

Rassah: put it in the freezer in the kitchen and collected data while it was cooling down. There was still plenty at 0ºC, but it smoothly went down to zero entropy around -20º. The cells with high skew are those which effectively constitute device signature.

Rassah: asciilifeform: From Nikita again: Most cells have too much skew to be useful. We suck entropy out of those whose skew is low. That's why there is ~21:1 cell-to-entropy ratio at room temperature on most devices. They had one device from Microchip IIRC, whose entropy was much lower, but the others were very close to the 20–21 ballpark. We analysed data from MRD SoC, which is in the bitcoincard, and got the same 21:1 ratio. Then I

Rassah: Will Atmel know what your seed and other entropy sources are? If not, why does it matter?

Rassah: We don't use hashing as a source of entropy, no. Only to combine ours with a salt

Rassah: It may reduce entropy, but it inreases he number of attack vectors, doesn't it? Attacker would need both the hardware based RNG and the salt to compromise it

Rassah: Initially the idea was: Write a salt onto the stick. Then generate key = H(H(entropy_1) + salt) + H(H(entropy_2) + salt), and print all of [key, salt, H(e1), H(H(e1) + salt), H(e2), H(H(e2) + salt)]. (+ could be arithmetic addition or XOR; either should be fine.) The user can then verify exactly one of the outer hashes on an insecure computer, and can verify the additions by hand (literally, pen and paper, no computer)

Rassah: key = H(salt||H(entropy)) with H(entropy) on a second sheet of paper so the user can verify it... or something

Rassah: Yes. If you plug tis device into your PC while holding down the button, it shows up in "flash mode", where instead of just a USB stick with a JPG on it, you get to see all the system and settings files. One of those files is a user provded sald (like diceware) that will be combined with the rest of the entropy sources to produce the final key

Rassah: I mean the chip and the hardware has a lot of stuff in there. The entropy is altready there, but initially we figured the SRAM chip was overkill. The "software adding entropy" meaning we just add more code to grab entropy from more hardware and user sources

Rassah: mircea_popescu: No, the hardware design is finished. Changes are only in software. Initial method of creating keys is done, we are just adding software patches to add more and more entropy sources to this thing.

Rassah: Ah, got a eply. Seems we'll be using he Atmel provided SRAM after all. And "We will be doing our own analysis of data from several chips, and provide a raw entropy file for those who want to do their own for their specific device." combined with "option to enter a user-supllied salt"

Rassah: compare it on the next run. Since we have about 30 times more entropy

Rassah: We can store part of the raw entropy into non-volatile memory and

Rassah: In our tests, it still had plenty of entropy at 0ºC, but it smoothly went down to zero entropy around -20º. Maybe we should put warning stickers on these things saying "Caution - Chaotic System. Do not use in low entropy environments above the Arctic or below the Antarctic circle, unless exposed to external sources of energy" :) ☟︎

Rassah: Basically an extremely high level entropy generator that uses that entropy to make secure paper walets

Rassah: Basically, we have people with reservations about the randomness and security of our entropy devices, despite not actually knowing how it works, and we are hoping to get some of tose people to back up their claims

Rassah: Huh. He's actually the reason I'm in here in the first place. I followed his blog here, after he tweeted that Mycelium Entropy < dice, and agreed once I asked him if he would be interested in auditing out device.

Rassah: We are raising money for Entropy through Indiegogo because this was an idea that our devs came up with, and wanted to get it done regardless of our owner's financial input.

Rassah: For now the main product is the Android Wallet though. And that Entropy thing we're finishing up

Rassah: !s Entropy

Rassah: specifically kickstarter projects, Entropy, etc.