Reflections on the COLDCARD RNG Exploit

Rise of the machines

Whilst we are all shocked at the catastrophe unfolding amongst innocent users of bitcoin-only ColdCard hardware wallets, it marks a watershed in open source software development and maintenance and is worthy of a blog.

The “new normal” is easy access to powerful adversarial AI for everyone. Historically, great precedent was placed upon passing a code audit before product release. Commercial third-party audit remains a critical step in the development cycle, of course, but continuous use of multiple AI-led audit tools is now required for open-source financial code maintenance — not just release.

The downside is that we expect an avalanche of vulnerabilities to emerge in the digital asset space in the coming months as the barriers to entry for highly technical attack vectors have reduced to virtually zero. Additionally, an incorrect knee-jerk response for some will likely be to shelter in “security through obscurity” by returning to closed-source development.

QRL v1 safe from reduced entropy attack

We have been regularly and will continue to use AI-based audit tools on both our live v1 and QRL 2.0 (codenamed Project Zond) codebase in recent months. The reduced entropy seed generation attack vector does not apply to any iteration of our web wallet from instantiation to present day. That is to say, any seed created with our web wallet from 2018 to now remains safe with 384 bits of entropy.

Attempting to brute force a QRL seed would take far beyond the heat death of the universe by many orders of magnitude to achieve success.

From our dev team:

“Bottom line: Every QRL v1.0 wallet seed is sound: 384 bits from the operating system. Coldcard’s bug survived five years because the bad output looked fine: random-ish bytes, passing every check they had. Our entropy fails closed, rather than degrading. Even though we’re not vulnerable, all industry security incidents are opportunities to learn, and we’ve hardened against future regressions and supply-chain drift: pinning toolchains and build gates that fail when the randomness is quietly swapped, rather than checks that ask whether the output looks random.”

The only hardware wallet implementation we have supported (“Ledger”) has also publicly opined to say no such fallback from secure element TRNG 256bit entropy creation is possible on any of their devices.

Dice

You may have seen social media posts about using dice rolls to add entropy to seeds as being protective in the case of ColdCard devices. Whilst probably outside the realm of the typical retail user, if performed correctly, it may have saved ColdCard users from theft by increasing the entropy of device seed generation into a number space beyond what can be feasibly brute-forced with modern hardware.

QRL has offered code for discerning users to create their own seed using dice since 2018.

Rolling dice multiple times generates entropy and outputs a truly randomly generated seed phrase without relying on computing hardware. We have updated this feature for v1 users who intend to make a v1 QRL wallet without using a hardware wallet.

This can be accessed here: https://dice.theqrl.org.

Quantum theft

Finally, it is worth reflecting that the vast majority of the digital asset space remains completely unprotected against quantum theft. Consider how such a quantum attack would devastate the digital asset space. It would make the unravelling ColdCard fiasco seem minor in comparison. Imagine innocent users waking to find their wallets drained en masse. Panic multiplied across every unprotected blockchain in the space as users and projects try to respond when it is already too late.

A safely generated seed is no protection when the cryptography upon which your funds are secured is broken. “Not your keys, not your coins” does not apply when an adversary can reconstitute private keys - be it your own or Satoshi Nakamoto’s.

The original QRL whitepaper is very nearly a decade old, but the first sentence of its short abstract remains as valid today as then:

“Private digital monies must be secure against computing advances to achieve longevity.”

The overwhelming supermajority of digital assets are completely insecure against quantum computing advances presently. QRL and upcoming v2.0 Zond are exceptionally rare in being serious about security as the post-quantum age races closer.

Stay safe and please adopt best practices with your digital assets. The digital world has never been more dangerous than it is today.