One would think that if a person generated a private key client side and never exposed that key to the internet, that they would be secure. However, the risk is that the paper wallet generation code is compromised such that it provides the victim with private keys that are already known to an attacker. How best to mitigate this risk?


You can generate the random bits yourself to eliminate possibly weaknesses / backdoors in an offline wallet generator. For example throw a dice 100 times and write down the sequence, and use the SHA256 hash as your private key. Or if you don't have a dice, toss a coin 256 times is ok too.

  • How does generating the bits yourself "eliminate backdoors"? You still need to use someone else's software, right? – Brad Thomas Mar 9 '14 at 0:12
  • 1
    You can never be 100% sure unless you perform the EC point multiply and SHA256+RIPEMD by hand. Even the compiler and the CPU can have backdoors. But RNG weakness is most common and exploitable. – uminatsu Mar 9 '14 at 1:17
  • RNG weakness is most common? Can you substantiate that is the major risk? It seems to me that the majority of losses are not due to RNG weakness even though there was the Android RNG issue. That was quickly patched. It seems to me that the majority of losses are simple theft where people do not have control of their private keys. The recent exchange failures are a case in point. Huge amounts have been lost there. – Brad Thomas Mar 9 '14 at 1:23
  • 1
    @Brad - I never said RNG weakness is most common in general. But it is the most plausible backdoor in the particular case of "Paper wallet generated client side and off network" because there is no other conceivable channel through which information can be leaked. Your examples regarding exchange failures are irrelevant. – uminatsu Mar 9 '14 at 1:52
  • Look, the offline wallet generator is all about performing some well-known functions such as EC point multiply, SHA256+RIPEMD hash, and Base58Check coding. There are tons of reference open-source implementations that can be checked against. Except for the RNG weakness, a bug in software implementation in the worst case would just render the generated key un-usable. – uminatsu Mar 9 '14 at 2:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.