Safe 5 Question

schizo · July 12, 2024, 6:15am

Hi there, quick question, is generating a bip39 seed phrase 100% safe using the safe 5? I noticed it was sorta tucked away in the UI under “Legacy backup types”

Still uses TRNG from the device and host etc, properly tested?

I get it’s somewhat offensive to assume that it might not be working properly but that whole situation with the CC dice issue has me weary that insecure entropy is being used to generate the seed if the TRNG isn’t working properly.

matejcik · July 12, 2024, 8:55am

Nothing in the world is “100% safe”.
That said, the BIP-39 generation process is exactly as good as the SLIP-39 one. (There would be no reason to break what’s been working fine for years.)

I was not aware of any CC dice issue before this post – do you mean that thing where users were allowed to generate a seed with not nearly enough dice rolls? That seems very unrelated to what happens when the users don’t try to mess with the process ;)

schizo · July 12, 2024, 9:00am

Yeah basically the user only used 1 dice roll for the seed generation so the random.seed function produced a predictable mnemonic. Also are you the CEO of Trezor? Your names are similar, would be pretty cool if you’re the active on the forum.

schizo · July 12, 2024, 9:10am

Thanks for the quick reply.

matejcik · July 12, 2024, 12:08pm

I’m not the CEO, but you’re not the first to get confused

schizo · July 12, 2024, 11:28pm

Final question, how does Trezor secure their singing key for the firmware? Are there multisignature requirements for signing? I would hope this done via physical devices as well.

matejcik · July 13, 2024, 8:41am

Firmware is signed by a 2-of-3 scheme by two people with two separate physical Trezors. We do eat our own dog food here.

schizo · July 17, 2024, 10:37am

Do you mind linking the code of how Trezor gathers entropy for seed generation? Can’t seem to find it on the github.

schizo · July 17, 2024, 9:56pm

Specifically the code that converts entropy to mnemonic on the Safe 5

schizo · July 18, 2024, 7:00am

nvm tested via trezor ctl with this command
trezorctl -v device setup --show-entropy -b bip39

this is the raw entropy correct? not some digested hash?

matejcik · July 18, 2024, 8:35am

this is how a mnemonic is generated from the entropy:

github.com

trezor/trezor-firmware/blob/main/crypto/bip39.c#L66-L97


      
          const char *mnemonic_from_data(const uint8_t *data, int len) {
            if (len % 4 || len < 16 || len > 32) {
              return 0;
            }
          
            uint8_t bits[32 + 1] = {0};
          
            sha256_Raw(data, len, bits);
            // checksum
            bits[len] = bits[0];
            // data
            memcpy(bits, data, len);
          
            int mlen = len * 3 / 4;
          
            int i = 0, j = 0, idx = 0;
            char *p = mnemo;
            for (i = 0; i < mlen; i++) {
              idx = 0;
              for (j = 0; j < 11; j++) {

This file has been truncated. show original

it’s a pretty straightforward implementation of the BIP-39 spec

as for how the entropy is gathered, here’s some code:

github.com

trezor/trezor-firmware/blob/main/core/src/apps/management/reset_device/init.py#L72-L83


      
          # generate and display internal entropy
          int_entropy = random.bytes(32, True)
          if __debug__:
              storage.debug.reset_internal_entropy = int_entropy
          if msg.display_random:
              await layout.show_internal_entropy(int_entropy)
          
          # request external entropy and compute the master secret
          entropy_ack = await call(EntropyRequest(), EntropyAck)
          ext_entropy = entropy_ack.entropy
          # For SLIP-39 this is the Encrypted Master Secret
          secret = _compute_secret_from_entropy(int_entropy, ext_entropy, msg.strength)

and here’s some accompanying explanation I typed up earlier: What library does Trezor use?

You’ll see the “external” entropy in the verbose output (as a content of EntropyAck message), and the “internal” entropy shown on the Trezor screen.
Then you can use the following script to check that the seed comes out right: trezor-firmware/python/tools/mnemonic_check.py at main · trezor/trezor-firmware · GitHub

schizo · July 18, 2024, 10:31am

Awesome, exactly what I wanted to hear.

a_nice_person · February 11, 2025, 5:11pm

If you don’t trust the seed generation process,
you could create a seed by yourself with a printed out BIP39 or SLIP39 list and 5 dices

Viktor_1BTC · February 11, 2025, 8:40pm

How to generate checksum of the seed with dices?

a_nice_person · February 12, 2025, 1:17am

You can dice 23 words, put them in the Trezor and trust the Trezor only for the checksum.