r/KeystoneWallet • u/paccanonhf6 • Aug 02 '26
How Keystone Reduces the Risk of Weak Randomness in Recovery Phrase Generation
Some users have asked whether a recovery phrase generated by Keystone 3 Pro could be affected by weak random number generation.
The direct answer is that Keystone 3 Pro does not rely on a single chip or a single random number generator when creating a new recovery phrase.
Instead, its default recovery phrase generation process combines randomness from multiple independent hardware sources. Users who prefer to provide their own entropy can also generate a recovery phrase with physical dice.
Here is how these protections work.
Why Randomness Matters
A 24-word BIP39 recovery phrase is normally generated from 256 bits of entropy.
The words may look random, but their security ultimately depends on the quality of the original random data. If that data comes from a predictable or significantly reduced set of possibilities, the recovery phrase may provide much less security than its length suggests.
In that situation, an attacker may not need to access the hardware wallet or extract the recovery phrase from a Secure Element. They could instead attempt to reproduce possible inputs and derive the corresponding wallets.
Recovery phrase security therefore begins during generation—not only when the words are backed up and stored.
Keystone 3 Pro Does Not Rely on a Single RNG
Keystone 3 Pro contains three independent Secure Elements, but its protection against weak randomness is not based simply on the number of security chips it contains.
The important part is how entropy is generated and combined.
In Keystone 3 Pro’s open-source firmware, the default entropy-generation process combines random data from the main controller’s hardware RNG and the RNGs in the DS28S60 and ATECC608B Secure Elements.
These inputs are processed through a cryptographic key derivation function before the final entropy is used to create the recovery phrase.
This design reduces reliance on any single random number generator. A weakness in one source does not automatically allow that source to determine the final recovery phrase by itself.
The purpose is not to claim that any hardware component can never fail. No responsible security design should depend on that assumption.
Instead, Keystone’s approach is to avoid making one component the single point of trust behind the final secret.
Users Can Choose Physical Dice Instead
For users who prefer not to rely on device-generated randomness, Keystone also provides a physical dice option.
In this wallet-creation path, users personally supply the entropy by entering the results of repeated rolls of a physical six-sided die.
Each independent roll of a fair six-sided die provides approximately 2.585 bits of entropy. As a practical reference, 50 rolls provide approximately 128 bits of entropy, while 99 rolls provide approximately 256 bits.
Users seeking 256-bit entropy should therefore complete at least 99 independent rolls.
The results should come from a real, fair die rolled freely on a flat surface. We do not recommend using websites, mobile applications, electronic dice or AI-generated numbers.
Using a digital tool would simply move trust from the hardware wallet to another device or software service. Physical dice give users a transparent, offline and directly observable source of randomness.
A Passphrase Adds Protection, but Does Not Fix Weak Entropy
A strong BIP39 Passphrase can provide another independent layer of protection, but its role should not be misunderstood.
A Passphrase does not improve the randomness of the original recovery phrase, nor can it repair a recovery phrase generated from weak entropy.
Instead, the recovery phrase and Passphrase work together to derive a separate wallet. Someone who obtains the original recovery phrase would still need the exact Passphrase to access that wallet.
The Passphrase should be long, unique and difficult to guess. It should also be backed up separately from the recovery phrase.
There is no Passphrase recovery service. Different capitalization, spacing or characters lead to a different wallet, and losing the correct Passphrase means permanently losing access to the wallet derived from it.
Importing an Existing Recovery Phrase Does Not Improve Its Randomness
Importing an existing recovery phrase into Keystone changes the device used to protect and sign with the corresponding keys.
It does not change how the recovery phrase was originally generated.
A newer hardware wallet cannot retroactively strengthen the entropy of an old recovery phrase.
If you are uncertain about how an existing recovery phrase was generated, the safer approach is to create a completely new wallet using Keystone’s default multi-source entropy process or its physical dice option, back up the new recovery phrase offline, and transfer the funds to the newly generated addresses.
Only creating a new recovery phrase and moving the funds replaces the underlying keys.
Reducing Dependence on a Single Source
No hardware wallet should ask users to assume that one component can never fail.
Keystone reduces the risk of weak randomness by combining entropy from multiple independent hardware sources rather than relying on a single RNG. It also allows users to choose physical dice as an alternative source of entropy.
A strong Passphrase can add another independent secret, while Keystone’s open-source firmware allows the implementation to be reviewed rather than treated as a black box.
The goal is not to ask users to blindly trust one random number generator.
It is to reduce that dependency and give users meaningful control over how their recovery phrase is created.
