<p>You can generate the random bits yourself to eliminate possibly weaknesses / backdoors in an offline wallet generator. For example throw a dice 100 times and write down the sequence, and use the SHA256 hash as your private key. Or if you don't have a dice, toss a coin 256 times is ok too.</p>

CC BY-SA 3.0
2014-03-09T00:12:30.567Z
How does generating the bits yourself "eliminate backdoors"? You still need to use someone else's software, right?
Bradley Thomas
CC BY-SA 3.0
2014-03-09T01:17:42.533Z
You can never be 100% sure unless you perform the EC point multiply and SHA256+RIPEMD by hand. Even the compiler and the CPU can have backdoors. But RNG weakness is most common and exploitable.
uminatsu
CC BY-SA 3.0
2014-03-09T01:23:35.883Z
RNG weakness is most common? Can you substantiate that is the major risk? It seems to me that the majority of losses are not due to RNG weakness even though there was the Android RNG issue. That was quickly patched. It seems to me that the majority of losses are simple theft where people do not have control of their private keys. The recent exchange failures are a case in point. Huge amounts have been lost there.
Bradley Thomas
CC BY-SA 3.0
2014-03-09T01:52:12.817Z
@Brad - I never said RNG weakness is most common in general. But it is the most plausible backdoor in the particular case of "Paper wallet generated client side and off network" because there is no other conceivable channel through which information can be leaked. Your examples regarding exchange failures are irrelevant.
uminatsu
CC BY-SA 3.0
2014-03-09T02:16:34.423Z
Look, the offline wallet generator is all about performing some well-known functions such as EC point multiply, SHA256+RIPEMD hash, and Base58Check coding. There are tons of reference open-source implementations that can be checked against. Except for the RNG weakness, a bug in software implementation in the worst case would just render the generated key un-usable.
uminatsu
CC BY-SA 3.0
2014-03-08T18:34:04.097Z
2014-03-08T18:34:04.097Z
uminatsu
<p>One would think that if a person generated a private key client side and never exposed that key to the internet, that they would be secure. However, the risk is that the paper wallet generation code is compromised such that it provides the victim with private keys that are already known to an attacker. How best to mitigate this risk?</p>

<security><paper-wallet>
Paper wallet generated client side and off network is not necessarily secure
Bradley Thomas
# Paper wallet generated client side and off network is not necessarily secure

(Asked by: username_0 on 2014-03-08)

One would think that if a person generated a private key client side and never exposed that key to the internet, that they would be secure. However, the risk is that the paper wallet generation code is compromised such that it provides the victim with private keys that are already known to an attacker. How best to mitigate this risk?

**Tags:** security, paper-wallet


---

## 1 answers

### Answer by username_1 on 2014-03-08. Score: 2 | Accepted answer

You can generate the random bits yourself to eliminate possibly weaknesses / backdoors in an offline wallet generator. For example throw a dice 100 times and write down the sequence, and use the SHA256 hash as your private key. Or if you don't have a dice, toss a coin 256 times is ok too.

> **Comments:**
> **username_0**: How does generating the bits yourself "eliminate backdoors"? You still need to use someone else's software, right?  
> **username_1**: You can never be 100% sure unless you perform the EC point multiply and SHA256+RIPEMD by hand. Even the compiler and the CPU can have backdoors. But RNG weakness is most common and exploitable.  
> **username_0**: RNG weakness is most common? Can you substantiate that is the major risk? It seems to me that the majority of losses are not due to RNG weakness even though there was the Android RNG issue. That was quickly patched. It seems to me that the majority of losses are simple theft where people do not have control of their private keys. The recent exchange failures are a case in point. Huge amounts have been lost there.  
> **username_1**: @Brad - I never said RNG weakness is most common in general. But it is the most plausible backdoor in the particular case of "Paper wallet generated client side and off network" because there is no other conceivable channel through which information can be leaked. Your examples regarding exchange failures are irrelevant.  
> **username_1**: Look, the offline wallet generator is all about performing some well-known functions such as EC point multiply, SHA256+RIPEMD hash, and Base58Check coding. There are tons of reference open-source implementations that can be checked against. Except for the RNG weakness, a bug in software implementation in the worst case would just render the generated key un-usable.  

---

