Quote from: Findingnemo on October 22, 2023, 05:35:27 PM

Even though it is not entirely possible to find the biased nature of a die, if they can find the noticeable results when rolling a die multiple times then it can be considered as the die is biased towards number 2 so they will incorporate it into the brute forcing process which will reduce the time to crack the result if their guess is right.

But it's my die/dice. You can't test them for bias because I own them. You would have to be using the dice I was using.

Quote from: BlackHatCoiner on October 22, 2023, 05:38:53 PM

I don't think dice bias can cause a significant problem, given that you'll roll it 99 times as said. As I have already demonstrated, even in a very biased dice which results in '6' half of the time and every other result 10% of the time each, the generated entropy is more than necessary.

That post and calculation of yours you linked to is way above my understanding. All I can see is the final result in bits of entropy (without knowing if your calculation is ok) showing more than what a 12-word seed has.

Quote from: Pmalek on October 22, 2023, 05:09:00 PM

To take this further, how could someone take advantage of the bias in my dice to
It's all about entropy. If a biased dice gives only 1 bit of entropy in every roll, then 99 rolls would give you 99 bits. All the attacker needs to do is brute force anything in the range of 99 bits, because you can't have possibly exceed that. Practically speaking, that could be implemented by a program that hashes sequences of biased results. (i.e., attempt #1: hash("666123"))

In that post you linked to above, you demonstrated that even a biased dice produces enough entropy with a big number of rolls. If that is true, the dice would have to be awfully biased to only produce 99 bits to the point you can see it with the naked eye.

Quote from: Kruw on Today at 04:17:58 AM

The caution around biased dice is really overblown:

First, the randomness from your dice rolls is combined with the randomness from your device. It's purely additional safety, not a single source of failure.

Are you saying that we should be combining two sources of randomness or that it's already happening in the background? Is that what the Coldcard and Seedsigner are doing when you input dice rolls into the devices to generate your seed?

Quote from: Kruw on Today at 04:17:58 AM

Third, you can circumvent the bias on the dice by adding your own human randomness. For 50% of your dice rolls, you can invert the dice and record the opposite result instead.

Can you provide a few examples?

Quote from: o_e_l_e_o on Today at 08:55:25 AM

You will never know unless you actually test for the bias, which essentially no one does.

If I were to ever generate a seed like that, I would throw each die many times before to satisfy my own curiosity and see if I can notice patterns that shouldn't be there.

Quote from: o_e_l_e_o on Today at 08:55:25 AM

And as you want to become more and more sure, you need more and more rolls. I've not ran the numbers, but you could likely rule out a 10% bias with a few dozen rolls, but to exclude a 1% bias you will need hundreds, if not thousands, of rolls.

In that case, wouldn't 100-200 rolls with 10 different dice (even if biased) be enough to generate randomness of somewhere between 130-200 bits of entropy which is more than enough as you don't get more from 12-word seeds and bitcoin private keys anyway?