PERSONAL ENTROPY SECURITY CHECKLIST
A practical diagnostic guide to securing Bitcoin from bad randomness.
💻 LONG-TERM COLD STORAGE
• 🟢 GREEN LIGHT: Physical Entropy Generation. [Impact: 🔴 Critical] [Cost: $10]
The only acceptable source of entropy for tier-1 cold storage is physical casino dice (50 rolls) or fair coins (128 flips), providing 128 bits of security. The offline computer should only be used as a calculator to convert this physical entropy into BIP39 seed words.
• 🟢 GREEN LIGHT: The Generic Live USB. [Impact: 🔴 Critical] [Cost: 2hrs + USB Drive]
Boot an offline bare-metal laptop into a mature generic live OS.
• 🟢 GREEN LIGHT: Mandatory Signature Verification. [Impact: 🔴 Critical] [Cost: 30m]
Before moving offline tools (Sparrow, iancoleman/bip39, airgap-coinflip, or Python CLI scripts) to the offline laptop, you must verify their PGP/SHA256 signatures. This prevents supply-chain malware from silently swapping the tool's RNG logic for predictable outputs.
• 🟢 GREEN LIGHT: COTS Hardware Hierarchy. [Impact: 🟠 High] [Cost: $50]
Prefer a Raspberry Pi (ensure you distrust the proprietary Broadcom silicon RNG). Chromebooks are acceptable. Old Windows laptops are a distant third.
• 🔴 RED FLAG: Hardware Wallet Watering Holes. [Impact: 🟠 High] [Cost: $0]
HWWs introduce unnecessary risks: concentrated supply-chain watering holes AND malicious firmware capable of covert nonce exfiltration (e.g., Dark Skippy), leaking your seed to the mempool. An offline laptop provides equal security.
📱 SMARTPHONES & MOBILE WALLETS
• 🟢 GREEN LIGHT: OS-Level Entropy Pools. [Impact: 🟡 Medium] [Cost: 1hr]
Use a security-hardened OS. It derives high-quality entropy from the Secure Element and CPU hardware interrupts.
• 🔴 RED FLAG: Browser Extensions & JS Wallets. [Impact: 🔴 Critical] [Cost: 5m]
Never generate keys inside mobile browsers or connected JS apps. JS cannot zeroize memory, leaving entropy in heap garbage collection. (Running standalone JS on a Live USB is safe, as powering off destroys the RAM).
☁️ HOME SERVERS & NODES (GCP / AWS / Colo)
• 🔴 RED FLAG: Virtual Machine Snapshot State-Reuse. [Impact: 🔴 Critical] [Cost: 1hr]
Never clone or restore VM snapshots for cryptographic nodes. While modern kernels update via VMGENID, it creates a "userspace trap" where long-running apps reuse the exact same pre-snapshot PRNG state.
• 🟢 GREEN LIGHT: CPU Distrust (Linux). [Impact: 🟠 High] [Cost: 10m]
Cloud VMs and CPUs contain closed-source silicon RNGs. Check your server's bootloader to ensure it is configured to distrust the silicon RNG.
• 🟢 GREEN LIGHT: CPU Jitter OS Mixing. [Impact: 🟡 Medium] [Cost: 5m]
For physical home nodes, avoid USB RNG watering holes. Ensure your Linux kernel is actively mixing native CPU execution time jitter.
🌐 HOME ROUTERS & TOR / VPNS
• 🔴 RED FLAG: Embedded Router Starvation. [Impact: 🔴 Critical] [Cost: 30m]
Home routers lack physical hardware interrupts. Check your custom firmware to ensure it manages entropy natively, avoiding obsolete daemons.
• 🟢 GREEN LIGHT: Service Delaying. [Impact: 🟠 High] [Cost: 5m]
Ensure Tor/VPN daemons are explicitly configured to wait for the OS CRNG to fully initialize during boot (check systemd/init scripts).
***
Generated via multi-model asymptotic_audit loop.
5ecfe501552fdae4a17339d84c0d6bdf5988b2fe0b0544d5b61cb0e78dac482e
Last Updated: 2026-08-07 15:15 UTC