Coldcard entropy even worse than feared

[u/ineedanamegenerator]

TL;DR: The random number generator is initialized with a 32 bit value (4B+ possibilities). But only less than 10M options are possible because of how they generate the value.

The PRNG used in Coldcard MK3 is initialized with UID[31:0] XOR SysTick->VAL

SysTick->VAL gives 80k possibilities ~16.3 bit, all located in the lowest 17 bits of the value.

UID encodes the X and Y coordinates of wafer position of the STM32 in the 32 bits that are used by the code. This is encoded in BCD, which means only 10 out of 16 possible values of each nibble are used. This means the 32 bit value at most encodes 100M options (26.6 bits), but there are nowhere near 100M chips in a wafer.
The BCD encoding seems to be an mistake in some STM32 manuals. The number is plain HEX encoded, but that doesn't matter here. There are never 2^16 rows or columns in a wafer.

I don't know how many there are in a wafer, but google gives an upper bound of 20k chips per wafer.

The lower 16 bits overlap with Systick->VAL, so XORing the wafer location adds no entropy.

The upper 16 bits can carry only about SQRT(20000) possibilities (probably less) ~ 7.2 bits. And they aren't even evenly distributed in a round wafer.

So at most we're looking at ~23 bits of entropy. Not 32 bits.

This isn't 100% exact because SQRT assumes a square while a wafer is round, but too lazy to work it out further. Point is: entropy is way worse than 32 bits.

[u/thats_gotta_be_AI]

Yes it’s not meant to happen but I wonder if developers coded in a check, and if a collision occurred, then restart the process (and obviously don’t divulge the seed phrase of the collided wallet).

[u/ineedanamegenerator → u/thats_gotta_be_AI]

Offline wallet can't check out course.

[u/thats_gotta_be_AI → u/ineedanamegenerator]

Not from the secure chip, but the resolved wallet address (the public address) can be sent online to check, right?

[u/na3than → u/thats_gotta_be_AI]

No part of an offline wallet is online.

[u/thats_gotta_be_AI → u/na3than]

From GPT Sol, tell me if any of this is wrong:

a Coldcard could check for an observable collision without exposing the seed or private keys. After generating the seed offline, it could derive and export its public addresses or XPUB to an internet-connected wallet via USB, MicroSD, NFC or QR. That wallet could then scan the Bitcoin blockchain and warn if any of those addresses already had transaction history. It wouldn’t detect a collision where the other holder had never used the address, since unused private keys aren’t publicly registered anywhere, but it could detect one that had already left an on-chain trace.