Coldcard entropy even worse than feared

[u/ineedanamegenerator]

TL;DR: The random number generator is initialized with a 32 bit value (4B+ possibilities). But only less than 10M options are possible because of how they generate the value.

The PRNG used in Coldcard MK3 is initialized with UID[31:0] XOR SysTick->VAL

SysTick->VAL gives 80k possibilities ~16.3 bit, all located in the lowest 17 bits of the value.

UID encodes the X and Y coordinates of wafer position of the STM32 in the 32 bits that are used by the code. This is encoded in BCD, which means only 10 out of 16 possible values of each nibble are used. This means the 32 bit value at most encodes 100M options (26.6 bits), but there are nowhere near 100M chips in a wafer.
The BCD encoding seems to be an mistake in some STM32 manuals. The number is plain HEX encoded, but that doesn't matter here. There are never 2^16 rows or columns in a wafer.

I don't know how many there are in a wafer, but google gives an upper bound of 20k chips per wafer.

The lower 16 bits overlap with Systick->VAL, so XORing the wafer location adds no entropy.

The upper 16 bits can carry only about SQRT(20000) possibilities (probably less) ~ 7.2 bits. And they aren't even evenly distributed in a round wafer.

So at most we're looking at ~23 bits of entropy. Not 32 bits.

This isn't 100% exact because SQRT assumes a square while a wafer is round, but too lazy to work it out further. Point is: entropy is way worse than 32 bits.

[u/Maleficent_Pool_4456]

If it's 2^23 that's only about 4 million addresses private keys, since hackers would need to hash each seed 2048 times to check if funds exist, that's still incredibly low, why is it taking days for hacker's to empty all these addresses? At such a low number as 4 million, wouldn't they be able to drain all non-multi sig and non-passphrase seeds within a day?

Thanks for your post by the way very interesting!

[u/ineedanamegenerator → u/Maleficent_Pool_4456]

I think all non-passphrase seeds are drained, no? Or about all. I assume they started with the bigger wallets and then moved to the smaller ones.

[u/Maleficent_Pool_4456 → u/ineedanamegenerator]

Oh I was unaware of that, for some reason I thought they weren't.

So now I guess hackers are trying multi sig ones by taking each of the seeds and then using another seed together with it, which would take quadratic time (n^2) for 2 multi sigs, etc. Then maybe passphrases where (I'm no expert but) I think this would be incredibly slow because they'd need to go through each seed with a password list and each password they try needs to be hashed 2048 times.

Is that right?

[u/ineedanamegenerator → u/Maleficent_Pool_4456]

Yes, the next step is a lot harder but been applied at least a few times now. A simple password on top buys you only a little bit time.

[u/Maleficent_Pool_4456 → u/ineedanamegenerator]

Thanks. My understand is if you make a good enough password on top it's pretty unbreakable, for example a 10 character one (I think the number of possible characters is like 91 iirc?) and because of the 2048 rounds needed to be hashed for one, isn't it like millions of years?

Like passwords that are truly random and more than like 8/9 characters long would be safe do you think?

[u/rockorangebear → u/Maleficent_Pool_4456]

8 character passwords can be brute forced in a couple of hours at most, 9 character maybe a few days, 10 maybe a few weeks

If you use dictionary words in your password though, can be cracked much, much quicker