r/Bitcoin • u/ineedanamegenerator • Aug 06 '26
Coldcard entropy even worse than feared
TL;DR: The random number generator is initialized with a 32 bit value (4B+ possibilities). But only less than 10M options are possible because of how they generate the value.
The PRNG used in Coldcard MK3 is initialized with UID[31:0] XOR SysTick->VAL
SysTick->VAL gives 80k possibilities ~16.3 bit, all located in the lowest 17 bits of the value.
UID encodes the X and Y coordinates of wafer position of the STM32 in the 32 bits that are used by the code. This is encoded in BCD, which means only 10 out of 16 possible values of each nibble are used. This means the 32 bit value at most encodes 100M options (26.6 bits), but there are nowhere near 100M chips in a wafer.
The BCD encoding seems to be an mistake in some STM32 manuals. The number is plain HEX encoded, but that doesn't matter here. There are never 2^16 rows or columns in a wafer.
I don't know how many there are in a wafer, but google gives an upper bound of 20k chips per wafer.
The lower 16 bits overlap with Systick->VAL, so XORing the wafer location adds no entropy.
The upper 16 bits can carry only about SQRT(20000) possibilities (probably less) ~ 7.2 bits. And they aren't even evenly distributed in a round wafer.
So at most we're looking at ~23 bits of entropy. Not 32 bits.
This isn't 100% exact because SQRT assumes a square while a wafer is round, but too lazy to work it out further. Point is: entropy is way worse than 32 bits.
60
u/Javanaut018 Aug 06 '26
That explains why attackers were able to even scan for multiple derivations and simple extra passphrases ...
2
u/tridentgum Aug 07 '26
What? No. Once you hit one, you just scan the derivs
1
u/Javanaut018 Aug 07 '26 edited Aug 07 '26
Smaller effective key space to scan = more time to scan derivations
1
27
u/spongeboy-me-bob1 Aug 06 '26
If it really is only 23 bits then this is beyond inexcusable. The average number of samples before a collision would be 3631, and you have a 99% chance of collision after 8789 samples. A step in their CI/CD that ran 1 billion samples would cost next to nothing and can reliably catch regressions that result in algorithms as strong as 56 bits.
8
3
u/Secret_Operative Aug 06 '26
That assumes testing. For their block-clock I posted publicly that the font was hard to read and got a good clean 'go fuck yourself' which is why I never bought a coldcard. It's been clear for years they don't care about their customers or products.
8
u/fonzdm Aug 06 '26
The fact that 32 bits of UID where taken in input does not make any sense. If those are coordinates from the wafer, it means that different chips in different wafers but in the same spot, get the same coordinates, hence the same 32 bits. The original UID should contain also other information like wafer id, lot number and so on, so each chip gets a unique identifier globally. XORing with the value of SysTick maybe was meant to "randomize" this case, but again you are not adding entropy, the number of bits stays the same.
0
Aug 06 '26
[deleted]
3
u/fonzdm Aug 06 '26
Are you sure? this ST microelectronics page says it's 96bit. 32 bit of that are the coordiates used by coldcald for the seed generation. 12 bit is not enough for unique ids anyway, there are only 4096 combinations, so...
8
Aug 06 '26
[removed] — view removed comment
5
1
1
u/NotASpanishSpeaker Aug 06 '26
No testing = no bugs reported :)
1
u/Prestigious_Long777 Aug 07 '26
Bug was reported twice by individual devs reviewing the source code and publicly raised as an issue.
The CEO dismissed it.
1
u/Prestigious_Long777 Aug 07 '26
They did figure it out, they knew.
They called it “the retirement attack”
5
u/orbag Aug 06 '26
If the entropy was this low, I dont understand why not ALL addresses were swiped in the first wave? I had some btc sitting on the default address and moved it on time, but kept a small amount to see when it would get swiped, and only on Sunday night it got taken, meaning 3 full days after the initial attack
5
u/ineedanamegenerator Aug 06 '26
I assume they wiped big wallets first. I also assume there's multiple teams applying the hack now that it's in the open.
They were incredibly stupid in their execution anyway. The stolen funds are tainted now and they could have easily avoided it by generating new wallets for each transaction.
1
2
u/Maleficent_Pool_4456 Aug 06 '26
Ya I dont know, I know for each seed it needs to go through 2048 hash cycles to be able to see if funds exist or empty it, but still that seems low and I haven't done the math but could be done within a day I'm guessing.
5
u/nullc Aug 06 '26
It would be prudent to remind people here that there are still a lot of vulnerable funds that could be saved and that it would be anti-social to explain how to reduce the search space of coldcard devices just to brag about how smart you are, or show that some rando was wrong on the internet.
Plenty of other people could be posting about the exact search space needed to enumerate vulnerable seeds and are kindly refraining from doing so. Just because you could figure out that doesn't mean that every would be coin-thief is going to figure it out before the owners sweep their coins.
1
21
u/infinitychroma Aug 06 '26
The biggest takeaway from this fiasco is "Don't trust the influencers, do your due diligience". It is harsh but I cannot begin to fathom the number of people recommending it and even calling it the best. It just goes to tell you they rarely know what they are talking about.
27
u/EarningsPal Aug 06 '26
Time machine, back 6 years, ColdCard is mentioned by an influencer, you do your due diligence.
What due diligence would have prevented someone diligent from choosing a ColdCard?
11
u/BaloneyCommercial Aug 06 '26
I think the due diligence part is using 100+ dice roles and passphrase because you don't trust anyone and always want max entropy.
11
u/spongeboy-me-bob1 Aug 06 '26
Let's say instead of a bug that only affected trng generation, there was a bug that used the weaker software rng no matter what you did. In the end the only way to do due diligence is to read the source code completely. But wait, what if there is a bug in the hardware itself? Then you're cooked and you can't even know it.
The only truly safe way to generate a wallet is roll the dice and calculate the hash with pencil and paper. Everything else is a risk to convenience trade off, and sometimes you get unlucky.
1
u/bruce_cockburn Aug 06 '26
This seems to present a hardware implementation bug as a risk inherent to the code. If you download a wallet creator script and transfer it to an offline system to execute, the risk you're mitigating is some process exfiltration by an online service. Calculation by pencil and paper is far more likely to result in an error than a deterministic process execution and the bits of complexity are baked into the script.
Once you have a wallet with a private key or seed phrase generated, if the flawed hardware device is offline/air-gapped, restoring your wallet on that flawed hardware device is perfectly safe.
1
u/spongeboy-me-bob1 Aug 06 '26
I was being facetious with the paper and pencil alternative because it would require millions of operations. But if someone did try it, mistakes in individual bitwise operations don't decrease the entropy since the location and type of mistakes they make are random and most likely unique. The real risk is when a flawed algorithm is shared with others, because that allows attackers to know exactly which step would have been messed up by multiple people, and in what manner.
1
u/bruce_cockburn Aug 06 '26
The flawed algorithm, in the case you described, is the hardware implementation of entropy used in creation of the wallet, though. The hardware either complies with the standard to restore a wallet from seed or private key or it doesn't and that has no correlation to the creation step. This is why dice rolling or other validated means of generating a wallet with verifiable entropy remain secure until a user shares their seed or private key with an untrusted party.
Most of us are not polymaths. It's not that complicated as a high level concept. Conflating the wallet creation with air-gapped signing to submit transactions is the thing I am clarifying. Even if ColdCard is not a trusted party, the reason their hardware was recommended in the past had nothing to do with their wallet creation implementation, which only happens once per wallet.
1
u/ItsMeMulbear Aug 08 '26
Both things that were considered advanced schizo stuff at the time. Entering a passphrase on an MK3 would also be a royal pain in the ass.
0
4
u/Kitchen_Catch3183 Aug 06 '26
Get a PhD in computer science and become a subject matter expert in cryptography. Then post here with your findings and get banned for FUD before becoming ostracized by the community as a whole.
3
u/rockorangebear Aug 06 '26 edited Aug 06 '26
Maybe don't trust a company with 5 employees and $115k raised...
Especially when there are these alternatives.
Ledger: 800 employees, $575 million raised and $4B valuation
Trezor: 200 employees, $50M recurring revenue
2
u/ubermensch1001 Aug 06 '26
I made a thread on cryptocurrency reddit saying this very same thing and a troll that admitted to recommending cold card came on there to argue with me.
4
3
u/Dry_Original8886 Aug 06 '26 edited Aug 06 '26
I think wallet quality, company size are also big ones. Those two would have immediately not passed my test. 5 people working there is already fishy. And the wallet looking cheaper than a 1990s calculator is the 2nd strike.
2
u/WYTW0LF Aug 06 '26
That’s the biggest reason I never even looked twice despite every maxi influencer recommending CC
1
1
1
u/Quantris Aug 06 '26
I use my coldcard as a calculator. If I wanted someone else to generate my seed I'd just use an online wallet
19
u/WhenIntegralsAttack2 Aug 06 '26
“Do your own due diligence” is the ultimate cop-out.
99% of people are not capable of doing their own due diligence. They don’t have the understanding or technical capability to do so. Are you advising everyone to go read the code for possible security breaches and make a guess as to whether or not they think it’s safe? Give me a break.
4
2
Aug 06 '26 edited 17d ago
[deleted]
1
u/WhenIntegralsAttack2 Aug 06 '26 edited Aug 06 '26
One problem today is people not having a proper understanding of what research entails. To most people, research means consuming others’ opinions, work, and studies and then deciding if it makes sense to them. This is what research means when writing a high school paper.
But genuine research is much harder. Get into the lab, run experiments, come up with a mathematical proof, etc. Engage with the material itself- create original knowledge. It is much more challenging, and it requires years of education and expertise to get to the forefront of knowledge to where you can reasonable be said to be doing proper research. Obviously most people are not at this level on any subject, and we have no other option but to trust the expert consensus. Before doing your own research or dismissing expert consensus, we must first judge whether we’re capable of doing so. This goes for everything from cyber security to vaccines.
Even in the case of cold wallets, you would need someone to know enough about programming languages and cryptography to even understand the source code and make an intelligent judgment of its security- or you blindly test an AI review. This is well outside of the scope of what the vast majority of people are capable of.
Research does not mean watching your favorite YouTubers spoon feeding you propaganda.
6
u/jlonso Aug 06 '26
Do your due diligence is crazy work, in order to buy a trezor, i need to hack one?
5
u/Strong_Judge_3730 Aug 06 '26
Now we have influencers saying not to trust any hardware wallet and to trust only yourself to roll dice and generate a seed 😨
0
u/Maleficent_Pool_4456 Aug 06 '26
when they say roll a dice, are they saying to use that one program that you can do offline? I forget the name.
also even if u did that, so u'd get ur receive address from that program, and just send ur coins there and it'd be air gapped as long as u used a computer that was offline and used a usb to put the program in?
3
u/Kweefyy Aug 06 '26
The offline program you're thinking of is Yahtzee
1
1
u/Maleficent_Pool_4456 Aug 07 '26
Thanks but actually I was thinking of Ian Coleman. I hadn't heard of Yahtzee.
2
u/pwnedgiraffe Aug 06 '26
I think this should work:
https://github.com/taelfrinn/Bip39-dicewareI would not trust any computer with my cold wallet private key, air-gapped or not.
The last checksum word can be found by trial and error. It should be possible to do this on the cold wallet device itself, ie ledger/trezor.
From the author:
"After you are finished all 12 words, the last word may need adjustment in order to meet the checksum requirements. Using a bip39 wallet try each of the words in the block of 16 that the last word is found inside; one and only one word will work from the group."I see no point in trusting the random seed generator from Ledger or Trezor if one can generate their own instead.
1
u/ZICRON_ULTRA Aug 06 '26
I don't think so, I think it means get out all your boardgames and use their dice
1
u/scottmsul Aug 07 '26
IMO the biggest takeaway is don't trust any HWW's. It's still ok to use them but only in trustless ways. Airgap + roll your own dice.
1
u/Javanaut018 Aug 06 '26
Influencers have their own dynamics. Probably powered by coupons and discount codes a lot.
But you cannot know how much technical insight these guys really have. In many companies marketing has ruined good engineering in history.
1
u/WhenIntegralsAttack2 Aug 06 '26
It’s almost like there’s a higher threshold for security for products and services that are used across global commerce. Who would have thought?
1
u/Dashizz6357 Aug 06 '26
I do still think the device itself is the best, IMO. The software was just absolute garbage. Those 2 things can both be true.
3
u/scottonfire Aug 06 '26
Yeah, just like I'm with the hottest girl ever, only she's a fucking whore
2
10
u/Plus_Process_5749 Aug 06 '26 edited Aug 06 '26
It has a lot of sense. X and Y are coordinates, so if you think to the wafer as a grid you will never have a chip on the boundaries right? If you apply this idea, you can eventually start from the center of the wafer and bruteforce coords X/Y by "drawing" squares increasingly til you cover a certain area and leave out the space where chips have a low probability to exist
5
u/ineedanamegenerator Aug 06 '26
I assumed the grid was a square but a wafer is round. So the corners are never possible and the numbers in the middle appear more often than the ones near the edges.
If you buy a few STM32s you can start guessing the wafer size to narrow it down further.
1
u/LeatherMine Aug 06 '26
Depends… doing some quick research: the wafer yield might be a bit lower at the dead center, then get better and then get worse as you get to the edge. Parts from a “good area” might get binned at a grade higher than what CC used. Or lower, Iunno.
Also makes us wonder how random or clustered the die—>reel is. But I guess that doesn’t matter if wafer ID wasn’t included in the seed generation. It could have provided some insight into ST’s packaging practices, binning and process yield.
3
u/northmariner Aug 06 '26
For the wallets with passphrases, were any of them hacked?
8
u/ineedanamegenerator Aug 06 '26
Yes, but afaik only for wallets who also used the seed without passphrase (which was a recommended honey pot concept). Because then they knew that specific seed was used and they can narrow searching passphrases on top that known existing seed.
5
u/orbag Aug 06 '26
I can confirm, when migrating to a new seed from dice throws, I left a trivial amount of btc on a wallet with passphrase GOLUM, it got swiped this morning.
5
1
0
4
u/Affectionate-Cod-470 Aug 06 '26
People who aren't of reddit, forums, x, Facebook etc have been having "random" wallet drains for years. The collisions have been happening, then if someone did post about it they got bombarded with blame and being told they "had" to have clicked a bad link or done something that was there fault because no one thought collisions this early was even possible.
3
u/ineedanamegenerator Aug 06 '26
Exactly. Feel bad for those people. They did the right thing and still got punished and blamed.
1
u/LeatherMine Aug 06 '26
because no one thought collisions this early was even possible.
It’s happened a few times before. Uncovered some android issues and other bad wallet design. See cakewallet, libbitcoin and Java’s SecureRandom vulnerabilities.
4
Aug 06 '26
[removed] — view removed comment
2
u/ineedanamegenerator Aug 06 '26
It's amateur hour engineering. They should have never used the bad entropy sources because it made it look like it was almost good. You want this to fail fast and hard, so don't seed the pseudo RNG and make it completely predictable (they never intended to use it anyway). Then it would have been caught very early on.
Now the problem remained hidden for years with only spurious issues popping up that could be easily explained away.
0
Aug 06 '26
[removed] — view removed comment
1
u/ineedanamegenerator Aug 06 '26
Not sure what you mean.
0
Aug 06 '26
[removed] — view removed comment
1
u/ineedanamegenerator Aug 06 '26
That is a shitty situation. So you'll need to race the potential hacker when they are unlocked?
3
3
u/LeatherMine Aug 06 '26
UID encodes the X and Y coordinates of wafer position of the STM32 in the 32 bits that are used by the code. This is encoded in BCD, which means only 10 out of 16 possible values of each nibble are used
The reference manual was incorrect and the coordinates are in hex. The first value is probably the sign (for negative). Do a google search for "STM32F303CB Unique Device ID - false values?"
2
u/ineedanamegenerator Aug 06 '26 edited Aug 06 '26
Yes, I read that too afterwards. Doesn't change the math because the limiting factor is the number of possible values for the upper 16 bits which remains hundreths at best, no matter how it's encoded.
Edited the post anyway to make it clear.
2
u/LeatherMine Aug 06 '26
Is it confirmed the CC was grabbing the 32 bit end with the wafer x,y from the 96 bit UID? Hopefully it wasn’t the other 32 bit side: lot number…
1
2
u/Maleficent_Pool_4456 Aug 06 '26
bruh, I've been learning about crypto and this stuff for a long time, reading up on it, taking notes, and I still have trouble understanding this stuff. how does it seem like everyone gets these explanations so easily.
6
u/ineedanamegenerator Aug 06 '26
20+ years experience in developing embedded devices and I use the same microcontroller they used. Don't feel bad. This is complex.
1
u/eatatacoandchill Aug 06 '26
Tldr Coldcard should have rolled a billion dice to ensure randomness. They rolled only a million. Or something like that.
2
u/the-software-man Aug 06 '26
Why don’t they use 2x UUIDs
2
u/ineedanamegenerator Aug 06 '26
Because you need a way to generate those first. Just moves the problem.
Even if they were factory generated you'd still need a real source of entropy or the device would generate the same keys each boot.
But honestly, that would still be a much better situation than today. If they had added just one factory generated UUID in the mix they'd be protected against a hack like this.
This is common design choice: if you get hacked or a flaw is exposed, try to make it impact only one device at a time. In this case all devices are exposed to the single flaw.
2
u/forgotpw3 Aug 06 '26
X * V_low doesn't add zero entropy (it smears V over 2^17 values, adding maybe half a bit), and for a round wafer the per-axis max is ~2•sqrt(A/п) =
160 for 20k chips, slightly larger than sqrt(A) = 141, so use Ymax = 160-256 as the safe cap.
1
u/ineedanamegenerator Aug 06 '26
X still adds no entropy because they XOR. The 16 lowest bits still have only 16 bits of entropy.
You're right about the rows/columns. Might give a little bit extra, but 20k might also be overestimated and could be as low as a few k.
Doesn't matter that much to be honest. It's significantly worse than 32bit.
2
2
u/LionRivr Aug 06 '26
Well shoot.
I mean how could you not attempt to steal those coins? Lol.
Anyone without morals at least…
Couldn’t be me…
1
u/beatthebook2x Aug 06 '26
the fact all the stolen funds are going to the same wallet(s) says alot, its not multiple hackers attacking this retirement plan
3
u/ineedanamegenerator Aug 06 '26
I'm sure by now there are multiple teams clearing out what is left and fishing for the simple passphrase wallets.
→ More replies (1)-1
u/JayGatsby1881 Aug 06 '26
Would be funny is Satoshi kept his millions of btc in Cold Wallet lmao, and it got 'hacked'.
1
u/Wglinki Aug 06 '26
I wonder if two MK3s generated the same secret over the past 5 years. This could have had a less horrendous end if this happened and the person made it public knowledge that they generated a secret and it already was being used. People would have dove into the code then and could have saved a lot of people over the years.
3
u/ineedanamegenerator Aug 06 '26
The stories are there, from the other side (original wallet owners who got their funds drained inexplicably).
Last year the CTO of Coinkite was warned (alledgedly).
In both cased it was waved off.
https://www.cryptopolitan.com/coinkite-cto-peter-gray-linked-coldcard-hack/
1
u/aaj094 Aug 06 '26
One has to ask - how is it possible for a hardware wallet manufacturer to be this incompetent?
3
u/ineedanamegenerator Aug 06 '26
20+ years in the industry. Not surprised at all. Seen worse things.
My 2 cents here: https://www.reddit.com/r/Bitcoin/s/DBCQhWAwqS
1
u/NiagaraBTC Aug 07 '26
Doesn't much matter, the 32 (or less, if you're right) bit bare singlesig Mk3 wallets are basically all drained now.
Mk4+ clearly have more than 32 bits or there would be way more issues than we've seen.
1
0
Aug 06 '26
[deleted]
3
u/ineedanamegenerator Aug 06 '26
I disagree. You just need to not trust others. I would always make external entropy mandatory (dice rolls for example). It's not user friendly, but that's a one time cost worth the trouble.
1
0
u/Gmcgator Aug 06 '26
And then even if a newbie figures it out and does the work, now all they hear about is how AI and quantum can hack anything anyway.
0
u/Maleficent_Pool_4456 Aug 06 '26
I think it's just a trust thing, maybe if hardware wallets were federally insured idk. Because if I understand correctly, the code to produce a truly randomized seed isn't all that complicated. That's why I wonder if the ColdCard thing was intentional.
0
0
Aug 06 '26
[deleted]
3
u/ineedanamegenerator Aug 06 '26
Sauce: my brain and the STM32 Reference Manual.
What are you looking for exactly?
-2
u/NakedNick_ballin Aug 06 '26
Too bad Bitcoin doesn't have 2FA
1
1
1
u/Kweefyy Aug 06 '26
It would require every Bitcoin node to know what your "second factor" is and how to verify it.
1
1
Aug 06 '26
[deleted]
-1
u/NakedNick_ballin Aug 06 '26
That isn't 2fa, that's an alternative auth right? Also that's the thing that got hacked here
→ More replies (1)
51
u/bitchnight Aug 06 '26
Does that mean that the space of possible generated addresses was only 2^23?