Thoughts on BTC Mini Key Generator Security

Hey everyone Can I get your thoughts on any security issues with https://github.com/raritycheck/BTCMiniKeyGenerator? We’re looking to use it for creating BTC mini private keys for some projects. Just want solid feedback.

Interesting tool, but why’s it requiring PortAudio? What’s that got to do with generating mini keys? Is this mini key like a mini private key? Will it work with Electrum? Don’t wanna install random software on my PC. Maybe clarify how this whole thing works.

Good questions PortAudio helps by adding randomness through audio. Yep, the mini keys are fine for Electrum, we’ve generated over a thousand keys with it. But it’s not a standalone program, just a Python script.

Open source is cool but is this entropy really reliable? I see you’re using secrets.token_bytes() and mixing it with audio and system time. Do you think the mini key is cryptographically secure?

with randomness, I’d say it’s pretty secure since it combines uRandom and audio-based randomness. Plus, there’s timing entropy involved too. For the mini private key, it takes a 29-character segment from the base58 entropy and appends 'S' at the start, which isn’t terrible considering there’s no real standard for these keys. But I’d like to see a modern update with a compressed pubKey for SegWit compatibility.

Thanks for the info This tool focuses on mini keys, which we need for secure collectibles. We’re also thinking about a WIF tool.

Most folks here aren't developers, so don’t expect deep insights. Just my two cents: 1. What happens without audio input? Weird data or error? 2. How about adding tests to the code? 3. Using audio, os.urandom, and secrets seems safe enough.

If the audio input fails, the program crashes, but the private key won’t be generated. It’s meant to pull randomness from the user’s audio. Just saying, I wouldn’t trust this for keys with real value. Mini keys have less entropy, plus they start with '0', which reduces randomness even further.

Thanks for your input Quickseller We’ve been through a bad RNG attack before, trusted some software and lost keys. Trying to refund everyone affected. We want to build something more secure. The audio helps with randomness, but we’re open to suggestions.

It’d be good to mention that software for comparison. The script makes 256-bit entropy, but a lot gets discarded for the mini private key, which lowers security to about 2^168. That’s still decent, but wait for more reviews before using it for actual bitcoin storage.

Good point. Since it's a mini key, is it possible to use a full 256 bits?

Nah, the current standard limits it to 30 base58 characters, starting with 'S'. Even if you could use 256-bit entropy, security wouldn’t reach 2^256. An attacker could just target the mini private key itself.

Wait, so it's less about the mini keys and more about poor entropy?

Exactly, this is about compromised sites or malicious code. Just look at these threads: Vulnerabilities on bitcoinpaperwallet... avoid it. walletgenerator.net scam exposed.

Yeah, those sites have sketchy entropy or backdoors. Trust is hard to come by these days.

Definitely. Bad entropy is a real issue. The attacker could replace the RNG with a deterministic one, making the keys predictable.

Is there a way to get this generator officially audited?

Short answer, get a security audit.

Who would do that?

Not really my area, but you usually have options: 1. Automated auditing service 2. Hire an auditor 3. Look for security firms that offer audits. Best to ask around in security communities or check how similar tools got audited. Just an example, WALLET.FAIL found flaws in hardware wallets.