This is related to https://crypto.stackexchange.com/questions/48622/how-safe-is-xor-with-multiple-independent-but-non-random-keys but not exactly the same question.

Let's say there are three different vendors in the market, they sell a product called preprinted key tag. A preprinted key tag is a stainless steel card engraving with a barcode encoding a 256 bits random number. It is solid, waterproof, and fireproof, safe to store for a long time. In other words, a preprinted key tag is a random number in cold storage.

I don't trust the vendors, they might secretly keep a copy of those random numbers they sell. I don't trust the independence of the vendors, they might collude together. I don't trust any retail seller, they might secretly steal the information before they sell the preprinted key to me. I don't trust any delivery company, they might secretly steal the information before they pass the preprinted key to me.

The only guarantee is, those random numbers printed on the stainless steel cards are as random as from any modern crypto-secure random number generator, no matter from which vendor.

Now, here is what I am going to do:

  1. Buy my first preprinted key tag from Vendor A via online shopping.
  2. Buy my second preprinted key tag from Vendor B via a local retailer.
  3. Travel to another country, buy my third preprinted key tag from Vendor C via a retailer in that country, and come back to my country.

Finally, XOR the above three 256 bit numbers from these three tags to create a private key. Then lock those three preprinted key tags in a vault. In case someday I forgot the private key I can recover it from the three tags in my vault.

Assume the last step is safe, in other words, assume my vault is safe.

My question is: how safe is the private key created in this way?

  • Is that a real product? For what market? Who would buy that vs generating a fresh random number on your own hardware? – Mike Ounsworth Oct 27 '20 at 18:22
  • A real product close to that is called bitcoin cold storage coin: coldstoragecoins.com/products/bitcoin-cold-storage-wallet The imagined product I described in the question is a combination of bitcoin cold storage coin and billfodl wallet: hardware-wallets.net/billfodl-review The disadvantage of billfodl wallet is its inconvenience, you need to arrange the characters by yourself. The disadvantage of bitcoin cold storage coin is you are relying too much on the vendor's integrity and the delivery service's integrity. Hope that clarifies a bit! – Qian Hong Oct 27 '20 at 18:31
  • Step #1 - Buy random numbers. Wait, what? Have I got a deal for you! – user10216038 Nov 28 '20 at 23:29

Have you considered generating your own high-entropy key input BitBabbler and marking the stainless steel yourself mechanically, or with an electro-chemical process:

Edit: then I got to thinking, how hard should it be?

  • that drill is the smallest I own, 1mm (~0.04") .. I'll be impressed if it lets me knock out hundreds of holes, but I'm going into mild steel, so, anyway!
  • the thing holding it is called a pin vise
  • you would actually need "fair" dice (don't use the ones you stole from the casino)
  • ... and say I had two, I'd roll 50 times to get to 256 bit, ie. log₂(6^2)x50, but personally, I'd stop sooner - needing enough energy to boil an ocean is sufficient enough of a barrier for me!

Hand-tools to make your own cold storage

  • It's gratifying to see the Covid lock-ins being productive. Now let me tell you about ....... – user10216038 Nov 28 '20 at 23:37

TL;DR: The basic assumptions are questionable already. But even if they hold the procedure is very insecure.

To summarize the assumptions you make to make sure I got these right:

  1. You trust that each number is actually random
  2. You don't trust any vendor. Specifically you could imagine that vendors keep track of the issued numbers and that they work together.

First note that the first assumption is very likely a bad idea, given the second assumption. It is easy to generate pseudo random numbers based on some algorithm and seed, which look totally random even if they are not. And why should one trust a suspicious vendor to generate real random numbers, given that this would be the easiest thing to fake without anybody noticing.

But even assuming that these numbers are actually really random (again: big doubt): if the vendor keeps track of all issued numbers and if vendors collude, than the security basically depends on the number of possible combinations which itself depends on the number of number cards issued. Given that there are significantly costs involved in creating, distributing and selling these cards, the number of cards will be very limited and thus the possible combinations of these cards will be very limited too. This makes it feasible to simply brute-force all possible combinations, which also easily can be massively parallelized to make it even faster.

  • Thanks for the answer. I agree with your doubt on the random number itself, and I like your point of brute-forcing all possible combinations. Make sense, thank you! – Qian Hong Oct 28 '20 at 3:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.