I'm hoping for an intuitive answer to why low entropy matters, in general. I get why predictability is bad and why high entropy yields low predictability.
What I don't have good intuition for is why low entropy would always imply high predictability. In particular, I'm thinking about the Feynman quip along the lines of "Today I saw the license plate CDU 778. What are the odds?" The point being that every particular sequence is equally improbable.
So, why would 12 numbers that pop into my head be predictable? I get that they have lower entropy than 12 truly randomly drawn words but what actually makes them easier to find? How would someone actually go about finding them?
I thought about this a bunch more, so let me give answering it another shot — by way of analogy, because that's what we do in Bitcoin (shout-out Gigi <3):
If you somehow leak the info that a) Undisc likes Earth, or b) some people appreciate the beauty of a seed phrase poem, you've vaaaaastly reduced the search space for an attacker. (And incidentally, somebody has/is already probing for that) Searching all the atoms on earth takes a while, but nowhere near as long as the universe.
(If you in proper key generation rolled earth, or one of the well-known poems, you're very likely to get fucked)
Same thing applies, really, because it's a conversation with the infinite. More possible chess moves/games than observable universe. But if I told you, or an attacker, that my private key is in a sideline off move 18 in the mainline Spanish, all of the sudden there aren't that many candidates left. A bunch of entropy, but only a handful of moves that make sense.
= Chess moves aren't random (they have purpose and intention) so they don't provide entropy, whereas all the possible moves on a board basically is.
how's that?how's that?
...or to get lucky. It is the same odds as finding a collision with someone else's seed when generating your own.
But this is a fun one to think about!
Let’s dig into the chess analogy a little.
Imagine you base your seed phrase on the configuration of a particular chess board.
An attacker doesn’t have to know that you did that to know someone might and they may decide to search particularly chessy seeming addresses. Fine, that’s not great for security.
What if you start a game with a non-standard board configuration, though? Now your low entropy midgame snapshot won’t look quite so chessy, despite having no more entropy than before. What would make those keys easy to find?
probably still quite predictable. Shuffled backrank (Chess960) only has 959 fresh starting positions. Enough to confuse humans out of opening prep but not much for machines. You'll still end up in pretty regular, well-trodden middle games I'd think.
Ok, but maybe the distribution of pieces are different as well as their placement and the game is being played by 6 year olds rather than experienced players.
That’s like adding entropy, but not exactly. The game itself would be similarly limited to common games, while guessing which game is being played converges to impossibility.
That's my understanding too:
Low entropy -> high predictability -> increased vulnerability to brute force attack.
After this discussion, I think there’s more nuance to it than that.
If a process is low entropy but unknown it may essentially be as if it were high entropy.
The intuition for that is that the number of unknown low entropy processes is sufficiently vast that the output is unguessable.
There is still increased vulnerability, but it comes from the possibility of someone else discovering the same process.
It's a combination of low entropy with some hint of how the entropy was generated that causes vulnerability, not just low entropy itself.
Since the attacker knew how ColdCard was generating its seeds, they can reproduce the process and scan through the low entropy seed space looking for wallets with coins in them
I get that. I don't really get why low entropy without a hint about generation is bad, but people talk about it like it is.
Bc we vastly reduce the search space to find the secret?
Brute-forcing a known key (ie, any UTXOs with non-zero balances) becomes way easier when I don't have guess the entire universe.
= low entropy, by chance, isn't necessarily bad... You could randomly draw a key in Earth...
except that an attacker is already trying that (on the chance it might not be chance, lol). So that screws you anyway.
What I hear Simplestacker saying is in "some hint"; that gives me somewhere to go, some place to start guessing, knowing that the spoils may lay here
This reply is my best current understanding. #1541001
I'm definitely not an expert, but I seem to recall that without knowing the mechanism, the ability to observe the outcomes in the reduced space can help too.
Maybe by coming up with a model that closely enough correlates to what the actual mechanism produces. No perfect match needed, a really good overlap should be enough to generate collisions.
Don't forget that everything after the seed phrase is deterministic and standardized. And even if you just roll 256 bits of random, key derivation is even more standardized.
So the only thing that sits between poor entropy and keys is everything obfuscated that you do to the bitstreams between that and the standardized process, and that no one guesses now or in the future.
For example, maybe doing 2 dice rolls
SHAKE256(nil, 512).update(6).update(5).digest(256)is not something anyone is monitoring because why would anyone use about the slowest modern hash there is because NIST required a dumdum?But the moment someone does it, they have your keys. And it would have taken them at worst a whole 36 guesses.
This gets at part of what I'm wondering about.
Is the mechanism of the vulnerability that people are watching some of these easily derived addresses just in case someone is dumb enough to use them?
In the case of me choosing 12 words, I suppose someone could look at my writing and see what words (or kinds of words) I like and that would reduce the search space. Maybe there are also useful patterns in which kinds of words people generally pick, which would make my habits a refinement of a refinement.
In part. I.e. try any password that is in anyone's password dictionary with billions of entries, through a classic brainwallet, and your funds will even be fought over by multiple people watching these. Same for standard derivation of low amounts of dice rolls with all the known algos. It takes longer for you to read what is on 3, maybe even 4 dice you just rolled than for a modern gpu to calculate the entire range of possible outcomes.
The other part - what is going on now - is that you can just explore a novel search space and find keys as you explore and sweep as you find coin. Like digital mining for gold.
This would be mostly damaging if this is an expired or low value seed and you have the same bias sitting in other, more high value seeds. Patterns, even ones that you're not aware of can be found. Some weakening is acceptable though, true random means it's also possible you hit exactly the outcome of the
sha256('secret')brainwallet - just extremely unlikely.Addendum: I hear people worried about 70+ bits, but even though that is not acceptable long-term, that search space is already huge. It just means you should fix it now.
Possible but extremely unlikely is the entire security framework, right?
Right! Remember that the bit count are the exponent so the difficulty / search space grows (and is reduced!) on the exponent too, until you hit the sum of all limitations.
I think even without a hint, if the process itself is easily guessable, you could still be vulnerable.
Like, if you rolled 6 dice to generate your seed, someone could think to themselves one day: hey what if I just roll six dice and scan through the seed space generated by those 6 dice rolls...
I think if your generation process is truly hard to guess (or even stumble upon), then even if the process is deterministic, your seeds could still be safe. But in that case the "entropy" probably comes from the idiosyncratic nature of the process.
Entropy is about the number of arrangements in each state, so while my state has fewer arrangements, the state-space might be sufficiently unknown that no one can plausibly identify that my state exists.
In that sense, it would be lumped together with some collection of other also unknown states that would collectively have a very large number of arrangements.
Exactly. I think.
Your seed phrase is access to your Bitcoin. Entropy is making sure that the words in that seed phrase are random and very hard to guess. If the way you came up with those words was easy to guess, then someone can get your Bitcoin.
Deeper than ELI5 here:
Your seed phrase is actually a really big number. The BIP39 word list specifies how to take every 8 places of that number and encode it into a word. Therefore, making sure that the number is difficult to guess is really really important.
Guessing a number between 1 through 10 is much much easier than guessing a number 1 through 100. Guessing a number 1 to 340282366920938463463374607431768211455, checking if that number is able to spend Bitcoin, and then guessing another number, is much much harder.
If your entropy (or randomness is bad), it can in effect make guessing a very large amount of numbers, into a matter of guessing a much smaller amount of numbers.
This is the part I'm looking for more clarity on. I get why it's true for a known process, but why would it be true for an unknown process?
How would someone narrow down the search window without having an idea about the process behind a particular low entropy seed?
I think I'd still be a bit concerned if you "hand-rolled" your own low-entropy-but-unknown process. The problem is the "if I thought of it maybe someone else would've thought of it" problem.
It not only has to be an unknown process, it has to be a process that someone else isn't likely to think of or stumble into
This is not financial advice. The questions being posed here are for academic curiosity only.
Another thing is some types of randomness are easy to quantify, like number of coin flips or dice rolls.
But if you are relying on the obscurity of your process, it's hard to quantify how unknown it really is.
Is that the issue?
If so, I think we talk about this in a misleading way when describing security.
I think most people just haven't thought about it as deeply or as meta as you.
It matters for helping people understand the actual threat environment they're in, as well as demystifying some of this stuff.
If the process were unknown, but enough known keys were generated from said process, mathematicians could probably work out a way to guess the search space.
That makes sense. Is there any risk for a single key, other than the process becoming known?
Just that, to do it well enough to not get guessed, is more complicated to work out, than just using dice lmao.
A one time use psuedo random process could be created, but....no lmao
This was to help me check my intuition about what's going on.
Even if I rolled my own process, I'd do enough reps to have high entropy.
Yeah, right, it's gonna be knowable or connectable to you, then, I'd think. Like, if you take the 12 words that make grammatic/poetic sense, you drastically reduce the search space (= I, as attacker, can intuit that some people will make poetry of their mnemonics). Or if I know that Undisci is a Bitcoiner and he loves a certain number combo, it's trivial for me to guess that.
Whereas actual, safe addresses, are safeguarded by not having anything but raw chance to go on.
How's that?
Right, so poems or anything with regular structure would be much easier to find, even if they're original and unshared.
What about me just thinking of words "at random" though? There will be some reduction in entropy, from my limited vocabulary and preferences, but what actually makes those words easier to find?
Or, what if I use a low entropy result from a really unusual process? Are those in some way easy to find for someone with no knowledge of the process that was used?
this is a great q tbh. that license plate analogy always trips people up
It's truly a great quote for explaining entropy.
"What are the odds?" gets you to think. The odds of seeing that specific license plate are miniscule. But the odds of seeing a license plate that means nothing to you, very high.
Orders of magnitude lower search space, anyway
~math
Thank you. Also added ~science