Re:Milk Sad: Weak Entropy in libbitcoin (bc) seed generation
by nullc on Tuesday August 08, 2023 @08:39PM
(#37057353)
libbitcoin author is stating that the 'bx seed' function wasn't intended for this use: https://twitter.com/evoskuil/status/1688657656620167169 but I can't figure out what legitimate use it actually was suitable for-- when would anyone want a 128+ bit BIP39 seed phrase with only 32-bits of entropy?
At the very best it sounds like an attractive nuisance itself of a sort that makes Mersenne Twister look safe by comparison.
I'd also agree that MT is an attractive nuisance (for similar reasons Shamir's secret sharing is), but it really doesn't matter what function was used here-- it might as well have used a NIST HMAC DRBG and it would have been equally insecure, because the insecurity comes from using the time as the seeding. Had it initialized the full MT state from the OS's secure RNG that would have been pretty ill advised but probably not practically exploitable in most cases.
At the very best it sounds like an attractive nuisance itself of a sort that makes Mersenne Twister look safe by comparison.
I'd also agree that MT is an attractive nuisance (for similar reasons Shamir's secret sharing is), but it really doesn't matter what function was used here-- it might as well have used a NIST HMAC DRBG and it would have been equally insecure, because the insecurity comes from using the time as the seeding. Had it initialized the full MT state from the OS's secure RNG that would have been pretty ill advised but probably not practically exploitable in most cases.