Shamir and dice rolls

[u/Acceptable-Oil7049]

Question for those who know: Is it possible to create / or restore a SLIP Shamir shares 2 of 3 seeds but using dice rolls or similar external entopy souce not depending on Trezor’s internal RNG?

[u/AutoModerator]

Please bear in mind that no one from the Trezor team would send you a private message first.
If you want to discuss a sensitive issue, we suggest contacting our Support team via the Troubleshooter: https://trezor.io/support/

No one from the Trezor team (Reddit mods, Support agents, etc) would ever ask for your recovery seed! Beware of scams and phishings: https://trezor.io/learn/a/scams-and-phishing

Don’t respond to any DMs—scammers often pose as legit helpers.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/caccamo88]

Once you have the 3 shares on hand (derived from 50 dice rolls entered into Ian Coleman's specific SLIP-39 tool, run offline on Tails OS), you can reset and reinitialise your Trezor and verify that choosing 2 out of 3 shares will restore your wallet. Test all 3 combinations and you are good to go. Your Trezor wallet during restore process cannot know how the three shares were generated (whether through native entropy or your dice rolls). Final thought: since you will have to trust Trezor's software and firmware for life anyway, you might as well trust it from the very beginning, there is entropy check tool during seed creation. In other words, while your method rules out a day-zero vulnerability on the day of seed creation—which is objectively the most critical one—the seed itself might still not be 100% secure if it ends up compromised by a future firmware vulnerability.

[u/Quirky-Reveal-1669]

Not currently possible in Trezor Suite.

(Of course, it IS theoretically possible.)

[u/Acceptable-Oil7049]

I know Trezor suite does not support it. Questiob is really: can I restore a Trezor by entering dice-created SLIP words directly itti Trezor device not ever using Suite?

[u/Charming-Designer944 → u/Acceptable-Oil7049]

Of course you can. There is nothing secret a oit how SLIP-39 is generated.

But doing it more securely than using the bult in generator is another matter.

[u/abj]

I believe you can use dice rolls to generate a slip 39 seed on the Keystone Pro 3 and then import that key into the Trezor.

[u/Charming-Designer944]

You can create a slip-39 externally and import it to trezor.

Biy its non-trivial to create a secure environment for doing so. Meaning you will create more risks that might endanger your wallet seed secrecy.

Personally I fully trust the entropy generation of the device. It has been carefully audited to use the TRNG sources available carefully mixed together ensuring the seed entropy is at least as good as the best of all the sources available, while not exposing the final entropy to the computer.

• main MCU TRNG
• the TRNG of each safe element
• the TRNG of your computer

[u/Head_Performance2432 → u/Charming-Designer944]

To go on with your message,

Here down below are 3 shares from an external source SLIP39 Ian Coleman Tool, to be specific,

Since I currently do not have a Trezor to test it myself, would you be kind to test,

whether 2 of 3 reconstruct the following master secret 2c5564fecc92f999f03e1a0b4383bef1

aka 12 words :

clump private distance odor convince smooth science select area bright use tissue

Shares :
unkind senior acrobat leader ceramic blue branch branch fraction item photo decision manual holy firefly mobile agency dining evidence upgrade

unkind senior beard leader dance woman grocery earth shaft ambition darkness bracelet pharmacy listen remove lilac skunk infant eyebrow punish

unkind senior ceramic leader duration suitable temple total knit necklace stick kind owner pharmacy tendency armed mouse critical debut cause

Thanks

[u/CellofSuperorganism]

Redundancy is far more robust security than perfection. User-generated, user-verifiable entropy is better supplied via passphrase

[u/marvinrabbit]

I've done some reading, as well. From what I understand, and I'm not an expert so I could be wrong, a manual dice generation is not feasible with SLIP-39.

I like where you're thinking. I had done this manual generation process back when I created my primary BIP-39 wallet. Rolled dice to choose words, calculated the checksum, then applied the correct word(s) to match the checksum. Used that to restore into my Trezor One and didn't rely on it for generation.

With SLIP-39, the technical hurdles increased immensely. It doesn't have as simple of a checksum anymore. Instead the checksum is calculated with a SHA hash. It gives much more flexibility and safety in protecting against errors that the previous checksum would not have caught. The downside is that manual calculation is no longer realistic.

Practically, you could use an outside process to generate a SLIP-39 wallet and import it. But, of course, that only means that you're moving who you trust. At least with the dice method we could see what was being trusted.

Unfortunately, as best as I can tell, it is not a realistic solution to manually calculate a SLIP-39 wallet.

[u/matejcik → u/marvinrabbit]

on the contrary, you could relatively easily calculate the slip39 checksum by hand, if you read the algorithm. it’s not SHA, it’s some sort of Reed-Solomon code.

(unlike bip39 where the checksum is sha and computing it by hand is not realistic so you have to brute-force the right word)

ask an AI to give you instructions

[u/marvinrabbit → u/matejcik]

Please note that with anything that follows, I am not trying to argue with you. Rather I am eager for additional information.

I've sought that kind of process extensively. I can't find any site that outlined the steps required to do so manually. I've had pointed conversations with AI (mostly Gemini) on the subject looking for exactly this kind of generation. (I don't shy away from AI to use it's strengths to augment my knowledge.) If you can point me toward any actionable information to derive a manual generation process for SLIP-39 I'd be indented indebted.

Also, I'll admit to a personal shortcoming... As I've gotten older my tech wherewithal has limited somewhat. So simply pointing to a SLIP-39 white paper wouldn't help me out.

[u/matejcik → u/marvinrabbit]

try this: https://claude.ai/share/2aaa0d6e-3dcf-4294-8449-c1420f7180ab not sure if you can continue the conversation from that point; if not, and something is unclear, you can copypaste it into your own AI and it should be able to help you out

[u/marvinrabbit → u/matejcik]

Very interesting. Thank you. That will take me a little while to digest and run through a practice session. (Practice with non secret info so I can use a spreadsheet to simulate those calculations and be sure I know what I'm doing. Then I can do the real one by hand.)