Offline Seed Entropy, GF(256) Shamir & Multisig Quorum Lab

Why Cryptographic Key Lifecycles Fail at Entropy Generation & Quorum Design

Every elliptic-curve signature (secp256k1, Ed25519) and post-quantum lattice keypair (ML-KEM, ML-DSA under NIST FIPS 203 and 204) rests on one foundational assumption: an adversary cannot predict or enumerate your secret key scalar faster than 2^128 operations. Yet real-world self-custody failures almost never involve breaking discrete logarithms. Instead, keys are lost or stolen at the two bookends of the key lifecycle:

1. Sub-128-Bit or Biased Entropy Generation: Human-invented "brainwallets," flawed browser pseudo-random number generators (Randstorm Math.random() vulnerabilities in 2011-2015 WebKit/V8), or counterfeit hardware signers pre-seeded with deterministic nonces collapse a 2^256 keyspace into an enumerable dictionary swept by automated bots within milliseconds.
2. Brittle Single-Key Backup & Signing Topologies: Storing an unsplit 24-word mnemonic on paper creates catastrophic fire/theft vulnerability, whereas naive DIY splitting ("cutting a 24-word seed into two 12-word halves") exponentially weakens brute-force resistance while forfeiting redundancy. Even true SLIP-39 Shamir splitting is frequently misunderstood as equivalent to multi-vendor on-chain multisig, despite reconstructing a single point of failure in RAM during signing.

Module 1: Mathematical Verification of Physical Dice (Base-6) & Coin (Base-2) Entropy

Verifiable hardware signers allow paranoid operators to bypass internal silicon TRNGs (True Random Number Generators) or mix user-supplied physical entropy into the TRNG output via HMAC/SHA-256 entropy pooling (ensuring that even a kleptographic Dual_EC-style hardware RNG backdoor cannot predict the resulting seed so long as either the physical dice or the silicon TRNG is unpredictable).

1. Combinatorial Capacity vs Empirical Shannon Entropy

Given N independent trials over an alphabet of b equiprobable outcomes (b = 6 for precision casino dice; b = 2 for fair coin flips), the maximum theoretical min-entropy capacity is:

C_theoretical = N * log2(b) bits
  - Base-2 Coin Flip : log2(2) = 1.000000 bits/flip  -> 128 flips = 128.0 bits | 256 flips = 256.0 bits
  - Base-6 Casino Die: log2(6) = 2.584963 bits/roll  ->  50 rolls = 129.2 bits | 100 rolls = 258.5 bits

Humans attempting to "simulate randomness" on a keyboard (typing sequences like 142536142536... or subconsciously avoiding repeated digits like 666) or rolling cheap rounded-corner injection-molded board-game dice introduce measurable statistical bias. Module 1 evaluates two complementary diagnostics on your raw roll sequence:

• Empirical First-Order Shannon Entropy (H): Computed from observed symbol frequencies p_i = O_i / N as H = - sum_{i=1..b} p_i * log2(p_i) bits per symbol. While high H alone cannot prove cryptographic unpredictability (a deterministic counter 123456123456 achieves maximum H = 2.585 bits/symbol despite having zero min-entropy!), depressed H immediately flags skewed face distributions.
• Pearson's Chi-Square (chi^2) Goodness-of-Fit Test: Compares observed face counts O_i against uniform expectation E_i = N / b using chi^2 = sum_{i=1..b} ((O_i - E_i)^2 / E_i). For 6-sided dice (df = 6 - 1 = 5 degrees of freedom), the upper p = 0.01 (99%) critical cutoff is 15.086 (11.070 at p = 0.05). For binary coin flips (df = 1), the p = 0.01 cutoff is 6.635. Exceeding this threshold triggers an immediate bias warning (is-danger), signaling either physically unbalanced dice or non-random human entry.

2. BIP-39 Entropy Conditioning & Checksum Tail Derivation

Under BIP-39, a mnemonic phrase encodes ENT bits of conditioned entropy (128 bits for 12 words; 256 bits for 24 words) appended with a CS = ENT / 32-bit deterministic checksum derived from the leading bits of SHA-256(entropy_bytes):

• 12-Word Mnemonic (132 bits = 12 x 11-bit indices): 128 bits (16 bytes) of entropy + first 4 bits of SHA-256(entropy_16B). Notice that the 12th word contains 7 entropy bits and 4 checksum bits (2^7 = 128 valid final words in the 2,048-word list for any fixed first 11 words).
• 24-Word Mnemonic (264 bits = 24 x 11-bit indices): 256 bits (32 bytes) of entropy + first 8 bits of SHA-256(entropy_32B). Here the 24th word contains 3 entropy bits and 8 checksum bits (2^3 = 8 valid final words).
• Optional BIP-39 Passphrase (25th Word): Stretches the ASCII mnemonic sentence (NOT the raw entropy bytes!) via PBKDF2-HMAC-SHA512 (2,048 iterations, salt "mnemonic" + passphrase) into a 512-bit BIP-32 root seed. Because 2,048 iterations of SHA-512 can be evaluated at millions of guesses per second on modern GPUs, any passphrase relied upon for physical theft protection ($5 wrench / stolen metal plate defense) must carry >= 60 to 80 bits of true passphrase entropy (e.g., 5 to 6 Diceware words), never a short dictionary word.

Module 2: Finite-Field Mathematics of GF(256) Shamir Secret Sharing

Adi Shamir's 1979 threshold scheme (How to Share a Secret, Communications of the ACM) achieves information-theoretic security: an attacker who compromises up to k - 1 shares learns literally zero bits about a B-byte secret S, even given unbounded quantum computing power! Every candidate B-byte secret remains strictly equiprobable until the k-th distinct evaluation point is supplied.

Rather than working modulo a large prime p, hardware wallet standards such as SatoshiLabs' SLIP-0039 operate byte-by-byte over the Galois Field GF(2^8) = F_2[x] / (x^8 + x^4 + x^3 + x + 1) (irreducible polynomial 0x11B, identical to the Rijndael / AES finite field) so that every share has the exact same byte length as the input secret with zero bit-expansion overhead:

1. Field Addition & Subtraction (XOR): Every byte a in 0..255 represents a degree-7 binary polynomial. Because characteristic 2 satisfies 1 + 1 = 0, both addition and subtraction in GF(2^8) reduce to bitwise exclusive-OR (a XOR b).
2. Field Multiplication & Inversion: Multiplication shifts and XOR-reduces high bits modulo 0x11B (gf256Mul in seed-quorum-lab.ts), and multiplicative inverses satisfy Fermat's Little Theorem over the 255-element multiplicative group (a^-1 = a^254 for all non-zero a).
3. Polynomial Splitting (Degree k - 1): For each byte index r in 0..(B-1) of secret S, the splitter sets constant term c_0 = S[r] and draws k - 1 CSPRNG bytes c_1, ..., c_{k-1} (c_{k-1} != 0), forming f_r(x) = c_0 XOR (c_1 * x) XOR ... XOR (c_{k-1} * x^(k-1)). Share i in 1..n records (x_i, [f_0(x_i), ..., f_{B-1}(x_i)]).
4. Lagrange Interpolation at x = 0: Given any subset of k distinct shares [(x_1, y_1), ..., (x_k, y_k)], evaluating the unique degree-(k-1) interpolating polynomial at x = 0 recovers each secret byte directly via S[r] = f_r(0) = XOR_{j=1..k} ( y_j[r] * PROD_{m != j} (x_m / (x_m XOR x_j)) ).

Test this property interactively in Tab 2 above: split a 128-bit synthetic hex secret into 3-of-5 shares, delete any two lines (Shares 01 and 04), click Lagrange Interpolate, and observe exact recovery; then delete one more line (2 shares remaining, below threshold k = 3) and verify that f(0) collapses into uniformly distributed noise uncorrelated with the original secret.

Silicon RNG Failures, Nonce Kleptography & Anti-Exfil Signing

Auditing initial seed entropy solves only half of the hardware trust problem. Even if you generate a mathematically perfect 256-bit seed using 100 casino-grade razor-edge dice, an evil or compromised signing device can still leak your private key during ECDSA or Schnorr signature generation through nonce kleptography (Dark Skippy-class firmware attacks):

• How Two Biased Nonces Leak a 256-Bit Private Key: An ECDSA signature (r, s) over message digest z uses an ephemeral per-signature secret scalar k (R = k * G, r = R.x mod n, s = k^-1 * (z + r * d) mod n, where d is your private key). If malicious firmware embeds fragments of your seed phrase inside the k values of just two on-chain transactions, the attacker watching the public blockchain extracts d directly via algebra without ever needing a USB return channel! Even leaking 4 to 8 bits of bias per k allows lattice basis reduction (LLL / BKZ Hidden Number Problem attacks) to recover d across a few dozen signatures.
• Deterministic Nonces (RFC 6979) Are Necessary but Not Sufficient: Under RFC 6979, honest signers derive k = HMAC_DRBG(private_key, message_hash) deterministically so accidental RNG failure never repeats a nonce. However, an external verifier inspecting (r, s) on-chain cannot tell whether a closed-source Secure Element genuinely followed RFC 6979 or covertly ground a malicious k!
• Cryptographic Anti-Exfil (Pay-to-Contract Nonce Commitment): Implemented in Blockstream Jade and supported by Sparrow / BitBox02 protocols, Anti-Exfil forces the hardware signer to commit to its nonce point R_hw before the host computer reveals a random blinding tweak e (R_final = R_hw + e * G). Because neither the hardware signer nor the host PC controls R_final unilaterally, malicious firmware is mathematically prevented from grinding low-entropy or seed-leaking nonces onto the blockchain.

Module 3: Engineering Trade-Off Matrix: Single-Sig vs Shamir vs Multisig vs MPC-TSS

Choosing a self-custody architecture requires modeling simultaneous failure modes: physical fire/flood loss, $5 wrench residential home-invasion coercion (amplified by KYC data-broker leaks documented in our Location & Data-Broker Exposure Hub), supply-chain firmware compromise, and host-PC blind-signing hijacks.

Taproot Miniscript Timelock Inheritance vs Threshold MuSig2 (BIP-327)

On Bitcoin, modern Taproot (BIP-341 / BIP-342) script trees unlock hybrid quorum designs unavailable in legacy P2SH or P2WSH vaults:

• Key-Path MuSig2 (BIP-327) & FROST: Aggregates multiple Schnorr public keys into a single 32-byte x-only Taproot internal key. Cooperative spends produce a single 64-byte Schnorr signature indistinguishable on-chain from a single-sig wallet (maximizing on-chain privacy and minimizing miner fees), while requiring interactive multi-round nonce commitments carefully guarded against state-reset replay bugs.
• Script-Path Miniscript (BIP-379) Decaying Quorums: Encodes deterministic spending policies such as "Require 2-of-3 hardware keys under normal operations, OR degrade to 1-of-3 survivable inheritance key + 1 recovery lawyer key after 52,560 blocks (~1 year CSV relative timelock) if the primary holder is incapacitated." Because unused MAST (Merkelized Alternative Script Trees) branches remain hashed off-chain until spent, this inheritance safety net leaks zero script metadata during routine operations.

Critical Operational Rules for Multi-Vendor Multisig Survivors

1. Back Up the Output Descriptor (BSMS / BIP-380) at Every Seed Location: Every year, Bitcoin holders lose access to 2-of-3 multisig vaults despite still holding two intact 24-word seed plates because they failed to archive all three xpubs, derivation paths, and script types. Unlike secrecy-sensitive private seeds, an output descriptor compromises privacy (revealing balances) rather than spending authority; store printed QR/text copies of your BIP-380 descriptor alongside every seed shard and encrypted in off-site cloud storage.
2. Verify Receive Addresses Across Quorum Signers: A compromised desktop coordinator (Sparrow or Safe web UI) can display an attacker's deposit address instead of your true multisig vault script. Before funding a new multisig vault, import the multisig wallet descriptor onto at least two independent hardware signers from different manufacturers (Coldcard Q + Trezor Safe 7) and confirm both screens derive the identical receive address.
3. Never Co-Locate Quorum Thresholds: Keeping two keys of a 2-of-3 multisig inside the same home safe reduces both fire resilience and physical coercion resistance to 1-of-1. Combine geographic key distribution with aggressive residential PII removal via our Location & Data-Broker Statutory Opt-Out Generator.