Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to use deterministic entropy in make_seed #6411

Closed
wants to merge 1 commit into from

Conversation

hodlwave
Copy link

I noticed that electrum does not currently have the option to generate a seed with user-provided entropy. Also, the current source of entropy comes from os.urandom() via the python-ecdsa dependency. That project's README explicitly states:

This library depends upon a strong source of random numbers. Do not use it on a system where os.urandom() does not provide cryptographically secure random numbers.

While practically speaking this will rarely be an issue, I think it's a useful to be able to supply entropy deterministically so users can eliminate this risk categorically.

My main concern with adding this feature is novices mistakenly using it and providing a very low entropy input without clearly understanding what it does. Is it correct to assume the CLI is generally only used by power-users? In any case, I made the option's description cautionary to guard against this risk.

@SomberNight
Copy link
Member

There had already been a custom entropy option, I think for several years, but it was removed in 5e5134b
Though note that that mixed in user-provided entropy, unlike your proposal which uses it exclusively.

I think a feature that relies entirely on user-provided entropy is dangerously easy to misuse: it's a footgun.

@SomberNight
Copy link
Member

Related:
#523
#1574
#1964
#2070

@hodlwave
Copy link
Author

Good points. Come to think of it, adding user entropy with a strong passphrase should be sufficient for this purpose anyway.

@hodlwave hodlwave closed this Jul 20, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants