Working on an opensource air-gapped crypto vault, in which I have the regular method of relying on OS to provide cryptographically secure random source and use that to generate the mnemonic phrase.

Also wish to provide a manual option of using dice rolls or coin flips to provide your own entropy and not needing to trust the software to do it for you. Exploring how trustless it can be.

As, I understand there are some bias associated with coins & dices as well. They may tend to favor one or some outcomes more than other. I have read a lot about providing your own entropy source and how that will usually be insecure if you accidentally introduce some bias. But considering, I am willing to go as far as flipping/rolling 256 times to generate a 256 bit binary number, does that eliminate the bias?

If yes, then is it possible to utilize less number of flips/rolls to generate less entropy which is well verified to be secure enough for the purpose of mnemonic generation? Wish to explore this option as its simply a lot of monotonous manual work for the extremely cautious user & if its possible to reduce the burden without sacrificing security.

Again, I have read many statements by fellow people on internet but I have no means to verify anybody's claim hence reverting to this community to chime in.

Some of the methods I read about:

  1. Using multiple dices to effectively roll x dices in every attempt and do it faster. Not sure how the order of reading dices matter here. Saw someone mentioning they should be read in the exact same order.

  2. Approach of mixing coin flip along with four dices to use the provided mapping to derive the words. I don't want to trust this. I would very much like to arrive at a random index for each word and then read the value at that index from the wordlist.

  3. Using Ionman's BIP39 tool, how it shows the provided entropy to be enough, it indeed required putting in 256 inputs (0/1) random values in there before the security validation message (mnemonic looks more secure than it really is) goes away. So as per that tool, anything less than 256 flips/rolls isn't secure enough. True?

  4. How to interpret dice rolls: Then there is also the question of interpreting the dice rolls. Do I use odd even numbers as 0 & 1 respectively or should I use half the range of possible outcomes (1-3) as 0 or 1 and the other half range as the other binary bit?

1 Answer 1


Just gather every source of randomness you have all together and apply a 256-bit secure hashing function to it such as SHA-256. The advantage of this approach is that it is as secure as its strongest input up to the limit of the hashing function you use.

There is no benefit to discarding information. Why map 3 and 5 both to 1 and give up some entropy? What benefit would you get?

  • 1
    You are right. I just realized I can utilize additional entropy by converting the mixture to its SHA256 hash and then convert it back into mnemonic code. I was too focused on following the trail for a manual method of doing it and assisting in that form by software.
    – Ashfame
    Jul 14, 2020 at 16:53
  • I have decided to not offer the option in my Vault app, as for being truly trustless, I can provide aids to do it all manually & just import the mnemonic into it, and then adding a passphrase on top of it. But for the sake of the question, if manual flips/rolls are to be used, how many flip/rolls do we really need or what mechanism should be used to make this a sufficient source of entropy?
    – Ashfame
    Jul 14, 2020 at 18:10
  • I wouldn't use fewer than 96 bits if you're 100% relying on the randomness of the flips. But you can also grab the TSC as each bit is input, and then you could probably drop to 60 if you do it right. Jul 14, 2020 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.