Quote from: Remember remember the 5th of November on December 22, 2015, 11:32:52 AM

Quote from: lottoshares on December 21, 2015, 10:52:41 PM

How do you propose generating a random number? Unless your computer is hooked up to a hardware random number generator it could be producing pseudorandom numbers which are unsuitable for sensitive applications like cryptography.

And how do you think generating private keys happens on a computer?

According to Stackexchange Bitcoin core uses RAND_bytes from OpenSSL.

http://bitcoin.stackexchange.com/questions/24722/what-kind-of-random-numbers-source-does-getnewaddress-in-bitcoin-core-api-bitco

Quote

It uses RAND_bytes from OpenSSL. The relevant call is CKey::MakeNewKey.

getnewaddress is in rpcwallet.cpp. It tries to get a key from the pool, and if the pool is

empty it allocates a new one which is populated using RAND_bytes

Quote

As others mentioned Bitcoin core uses OpenSSL random sources.

This means that it uses any random source available, like:

the operation system, i.e. interrupts
random sources of the CPU or the chip set
dedicated hardware for entropy generation
So in order to make sure your hardware random generator works with Bitcoin you must make sure it works with OpenSSL.

RAND_bytes from OpenSSL uses OS specific calls to various random sources. However that system can sometimes fail silently according to some of the Bitcoin core devs.

https://github.com/bitcoin/bitcoin/pull/5885#issuecomment-78611027

Quote

We've seen operating system RNG's fail silently in really frightening ways several times over the last few years, a belt-and-suspenders approach where silent failure at least gets a best effort bit of entropy-snake-oil (or maybe not so snakeoil: after going and writing a bunch of entropy collecting code I'm more impressed with the performance than I expected) seems to be a clear improvement. OpenSSL's (and libressl's) system entropy randomness generator is also pretty scary (it can fail silently back to snakeoil entropy much weaker than what this code does).

That's why the core devs have been developing their own random number generating system, which is slated to replace OpenSSL RNG use in core version 0.13,

https://github.com/bitcoin/bitcoin/pull/5885#issuecomment-161609639

Quote

Slated for 0.13 (with the goal of getting rid of OpenSSL dependency by then), opened #7162 to track this

However, the core devs say the weaknesses they identified in OpenSSL RNG do not significantly undermine Bitcoin's security because Bitcoin Core hardens the RNG input with additional timing information.

https://www.reddit.com/r/Bitcoin/comments/3ccb7w/bitcoin_core_uses_rand_bytes_from_openssl_to/csu885c

Quote

There are many theoretical concern related to OpenSSL's operation as well as Linux's /dev/random (and other operating systems) behavior in general-- and there is a long term project underway to replace it: https://github.com/bitcoin/bitcoin/pull/5885 (and you can see from the comments there, we're well aware of how it works, more so than even the concerns you've expressed here).

That said, these are theoretical weaknesses. In Linux /dev/random and /dev/urandom are the same rng, but /dev/random uses an entropy estimator. The estimator provides basically no value and is often misunderstood. This page has an excellent and correct debunking: http://www.2uo.de/myths-about-urandom/

The "aren't very random" you're quoting is taken out of context-- the context is "The main thing which I am much more worried about is that on various embedded systems, which do not have a fine-grained clock, and which is reading from flash which has a much more deterministic timing for their operations, is that when userspace tries to generate long-term public keys immediately after the machine is taken out of the box and plugged in, that there isn't a sufficient amount of entropy, "--- e.g. context that matter a lot for generating SSH keys, but not so much for Bitcoin.

Beyond the basic operation there, OpenSSL and Bitcoin Core further harden the input with additional timing information.

Finally, the bit of concern you're sowing there doesn't make a relative comparison. It would be no good to chase someone from using Bitcoin Core due to niche and speculative issues to something that was practically less secure.

For a simple random number generation as proposed by spartacusrex I would find a better alternative than an OpenSSL RNG.

There is a thread full of posts by heavyweights discussing the best way to manually generate a truly random private key by repeatedly throwing dice. The reason they generate keys that way is to avoid 100% of all BS regarding computer-generated entropy sources & algorithms.

Quote from: etotheipi on November 15, 2013, 06:01:55 PM

Quote from: Abdussamad on November 15, 2013, 05:59:08 PM

Anyway a lot of the heavy weights are in this thread. I would have thought that generating private keys manually might be termed a little extreme.

Depends on your definition of cost-to-benefit ratio:

Cost: Spending 20 minutes, one time, to create entropy and convert it to a wallet
Benefit: Avoiding 100% of all BS regarding computer-generated entropy sources & algorithms, until the end of time

If you're holding a "lot" of money, some people would rather just remove all doubt. And the cost of doing so really isn't that high.