This is related to https://crypto.stackexchange.com/questions/48622/how-safe-is-xor-with-multiple-independent-but-non-random-keys but not exactly the same question.

Let's say there are three different vendors in the market, they sell a product called preprinted key tag. A preprinted key tag is a stainless steel card engraving with a barcode encoding a 256 bits random number. It is solid, waterproof, and fireproof, safe to store for a long time. In other words, a preprinted key tag is a random number in cold storage.

I don't trust the vendors, they might secretly keep a copy of those random numbers they sell. I don't trust the independence of the vendors, they might collude together. I don't trust any retail seller, they might secretly steal the information before they sell the preprinted key to me. I don't trust any delivery company, they might secretly steal the information before they pass the preprinted key to me.

The only guarantee is, those random numbers printed on the stainless steel cards are as random as from any modern crypto-secure random number generator, no matter from which vendor.

Now, here is what I am going to do:

  1. Buy my first preprinted key tag from Vendor A via online shopping.
  2. Buy my second preprinted key tag from Vendor B via a local retailer.
  3. Travel to another country, buy my third preprinted key tag from Vendor C via a retailer in that country, and come back to my country.

Finally, XOR the above three 256 bit numbers from these three tags to create a private key. Then lock those three preprinted key tags in a vault. In case someday I forgot the private key I can recover it from the three tags in my vault.

Assume the last step is safe, in other words, assume my vault is safe.

My question is: how safe is the private key created in this way?

  • Is that a real product? For what market? Who would buy that vs generating a fresh random number on your own hardware? Oct 27, 2020 at 18:22
  • A real product close to that is called bitcoin cold storage coin: coldstoragecoins.com/products/bitcoin-cold-storage-wallet The imagined product I described in the question is a combination of bitcoin cold storage coin and billfodl wallet: hardware-wallets.net/billfodl-review The disadvantage of billfodl wallet is its inconvenience, you need to arrange the characters by yourself. The disadvantage of bitcoin cold storage coin is you are relying too much on the vendor's integrity and the delivery service's integrity. Hope that clarifies a bit!
    – Qian Hong
    Oct 27, 2020 at 18:31
  • Step #1 - Buy random numbers. Wait, what? Have I got a deal for you! Nov 28, 2020 at 23:29

2 Answers 2


Have you considered generating your own high-entropy key input BitBabbler and marking the stainless steel yourself mechanically, or with an electro-chemical process:

Edit: then I got to thinking, how hard should it be?

  • that drill is the smallest I own, 1mm (~0.04") .. I'll be impressed if it lets me knock out hundreds of holes, but I'm going into mild steel, so, anyway!
  • the thing holding it is called a pin vise
  • you would actually need "fair" dice (don't use the ones you stole from the casino)
  • ... and say I had two, I'd roll 50 times to get to 256 bit, ie. log₂(6^2)x50, but personally, I'd stop sooner - needing enough energy to boil an ocean is sufficient enough of a barrier for me!

Hand-tools to make your own cold storage

  • It's gratifying to see the Covid lock-ins being productive. Now let me tell you about ....... Nov 28, 2020 at 23:37

TL;DR: The basic assumptions are questionable already. But even if they hold the procedure is very insecure.

To summarize the assumptions you make to make sure I got these right:

  1. You trust that each number is actually random
  2. You don't trust any vendor. Specifically you could imagine that vendors keep track of the issued numbers and that they work together.

First note that the first assumption is very likely a bad idea, given the second assumption. It is easy to generate pseudo random numbers based on some algorithm and seed, which look totally random even if they are not. And why should one trust a suspicious vendor to generate real random numbers, given that this would be the easiest thing to fake without anybody noticing.

But even assuming that these numbers are actually really random (again: big doubt): if the vendor keeps track of all issued numbers and if vendors collude, than the security basically depends on the number of possible combinations which itself depends on the number of number cards issued. Given that there are significantly costs involved in creating, distributing and selling these cards, the number of cards will be very limited and thus the possible combinations of these cards will be very limited too. This makes it feasible to simply brute-force all possible combinations, which also easily can be massively parallelized to make it even faster.

  • Thanks for the answer. I agree with your doubt on the random number itself, and I like your point of brute-forcing all possible combinations. Make sense, thank you!
    – Qian Hong
    Oct 28, 2020 at 3:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .