Quote from: vernell on March 13, 2014, 06:55:09 AM

SUBJECT: Re: Armory's Random Number Generator (Is Armory Broken?)

...

I am not saying Armory isn't secure. I am saying the security of Armory == the security of the underlying /dev/random. Which is not terribly bad, but not terribly good either if you are paranoid as me.

You're suggesting Armory might be "broken" in your subject. I'd appreciate if you'd change the top post subject if you don't actually believe that.

Also, in your example of "If I sell you a laptop"... if you sell me a laptop for secure computing and I don't wipe the OS before I use it, there's always something you can do to compromise it. Even if I fix the RNG thing as you recommend, there's plenty of other ways you can compromise a system if you have full root access to it for an unlimited amount of time.

Finally, I don't have a GUI method for inputting entropy directly into Armory. It's not laziness, I'm avoiding users entering "99999999999999" for their entropy because they want a brainwallet and think no one would ever guess that. So I have simply provided (in other posts) the way this can be done from the Linux shell very quickly, to make it clear it can be done but you accept the risks if you don't do it "right".

Example using a shuffled deck of cards:

Code:

>>> from armoryengine import * # With version 0.90 and lower
>>> from armoryengine.ALL import * # With version 0.91+
>>> entropy = hash256('Ad3s4s9c7hKhKd...')
>>> print makeSixteenBytesEasy(entropy[:16])
fntf euji uofg kkhf ewfe keft uawj garh twsu
>>> print makeSixteenBytesEasy(entropy[16:])
sdwe nift ijso dhgg ghjf sigo tunw uteu hafo

In Armory, go to "Restore Wallet" and restore a single-sheet backup. Enter that:

fntf euji uofg kkhf ewfe keft uawj garh twsu
sdwe nift ijso dhgg ghjf sigo tunw uteu hafo

You can do everything as you did it before. Including making a paper backup, which will just show those two lines. Which of course should be backed up.