Entropy and randomness

Wonder

1. What distinguishes true randomness from human intuition?
2. How did a software bug in a Linux distribution expose thousands of keys to brute-force attacks?
3. Why does a twelve-word phrase represent exactly 128 bits of entropy plus a checksum?

Explore

1. A Bitcoin private key is a random integer between 1 and n-1, where n is the order of the secp256k1 curve’s generator. This space contains approximately 1.158 × 10^77 possible values. To target 128 bits of security against discrete logarithm attacks, the key must be selected uniformly from this range. If the selection process is predictable or biased, the effective entropy drops, reducing the work factor for an attacker to a fraction of the theoretical maximum.
2. Entropy measures uncertainty in bits. A twelve-word BIP39 mnemonic encodes 128 bits of true randomness plus a four-bit checksum derived from SHA-256. A twenty-four-word phrase carries 256 bits. The final word serves partly as an error detector; random words rarely form a valid phrase because the checksum will fail. This structure reduces silent transcription errors, provided the source entropy was genuine.
3. Human-generated randomness is notoriously weak. Phrases people choose carry far less entropy than they appear to, because people favor familiar words, quotes and patterns. Attackers exploit this by running dictionary attacks against keys derived from memorable phrases, known as ‘brain wallets.’ Vasek, Bonneau et al. (2016) documented how such wallets were routinely emptied, often very soon after being funded, because attackers could test enormous lists of likely phrases.
4. Software implementation flaws have repeatedly compromised key generation. A Debian change to OpenSSL (in use 2006-2008, disclosed in DSA-1571) left the process ID as almost the only source of variation, so each key type and size had only about 32,768 possible keys. In August 2013, a flaw in Android’s SecureRandom led some bitcoin wallets to reuse signature nonces, exposing private keys and allowing thefts. These incidents demonstrate that entropy sources must be cryptographically secure and independent of system state.
5. ‘Randstorm,’ disclosed in 2023 by Unciphered, revealed that BitcoinJS-era web wallets (approx. 2011-2015) used weak randomness generators, exposing users to key recovery attacks. Modern hardware wallets gather entropy from multiple internal sources during initialization, displaying the resulting mnemonic one word at a time. Once written down, these words become the sole authority over the funds; losing them means permanent loss of access.
6. Good entropy comes from operating system cryptographic random number generators (CSPRNGs), hardware RNGs, or physical processes like dice rolls (with bias caveats). CSPRNGs mix noise from system events and hardware sensors to produce unpredictable bits. If the output lies between 1 and n−1, it becomes a valid private key; otherwise, the generator retries with new random data. This loop ensures uniform distribution across the entire curve order.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• Debian Security Advisory DSA-1571: openssl - insufficient randomness in key generation (2008)
• Bitcoin.org, 'Android Security Vulnerability' (11 August 2013)
• Unciphered, 'Randstorm: You Can't Patch a House of Cards' (2023)
• M. Vasek, J. Bonneau et al., 'The Bitcoin Brain Drain: Examining the Use and Abuse of Bitcoin Brain Wallets' (2016)
• M. Palatinus, P. Rusnak, A. Voisine & S. Bowe, 'BIP-0039: Mnemonic code for generating deterministic keys' (2013)