A PRACTICAL FIELD GUIDE

Rolling Your Own

Randomness

How to generate 256 bits of entropy with nothing but dice, a pencil, and SHA-256 — and turn it into a BIP39 Bitcoin seed phrase.

TECHNICAL BUT PRACTICAL · FOR DEVELOPERS AND FIRST-TIMERS

ROLL → PAD → CONCAT → SHA-256 → 24 WORDS

EDUCATIONAL MATERIAL — ALL EXAMPLE SEEDS IN THIS DECK ARE PUBLIC AND MUST NEVER BE USED

COIN · D6 · D20 · D30

01 · THE CORE IDEA

Entropy measures how many bits of surprise a roll contains

THE DEFINITION

Shannon entropy H(X) is the average uncertainty of a random source, measured in bits — how much information you gain, on average, each time you learn one outcome.

\(H(X) \;=\; -\sum_{i} p(x_i)\,\log_2 p(x_i)\)

When all n outcomes are equally likely — a fair die — every p(xi) equals 1/n, and the formula collapses to one line:

\(H \;=\; \log_2 n \;\;\text{bits per roll}\)

WHAT A BIT FEELS LIKE

One bit is one fair coin flip — the answer to a single yes/no question. n bits describe a number from 0 to 2ⁿ−1.

256 bits is a number near 10⁷⁷, on the scale of the atom count of the observable universe. Guessing it by brute force is not a practical concern.

THE BOUNDARY THAT TRICKS PEOPLE

Entropy belongs to the process, not to the digits. A recorded roll is fixed data — the randomness existed only while the die was tumbling. Guard the process (fresh rolls, no camera, no software peeking) and the digits take care of themselves.

REMEMBER  Fair source ⇒ H = log₂(n) bits per roll. Everything else in this deck follows from that one line.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

02 / 11

02 · SHANNON ENTROPY, PER ROLL

More faces give more bits — but only logarithmically

Bits of Shannon entropy per single roll, H = log₂(n), assuming a fair source: every face equally likely.

READING THE NUMBERS

Growing a d6 into a d30 multiplies the faces by 5 but adds only 2.32 bits per roll — the payoff of bigger dice shrinks fast.

Fractional bits like 2.585 are awkward in raw bit strings. Slide 6 shows how SHA-256 tidies them up.

REMEMBER  Bigger dice mean fewer rolls, but the gain is logarithmic — pick the die you can stand rolling 50–100 times.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

03 / 11

03 · THE MATH YOU ACTUALLY NEED

How many rolls buy you 256 bits? Divide, then round up

THE FORMULA

\(\text{rolls} \;=\; \left\lceil \frac{256}{\log_2 n} \right\rceil\)

Target ÷ bits-per-roll, rounded up to the next whole roll. 256 bits is the standard size for a Bitcoin private key or a 24-word BIP39 seed.

WORKED EXAMPLE — D6

256 ÷ log₂(6) = 256 ÷ 2.585 = 99.03 → roll 100 times.

Stop at 99 and you hold 99 × 2.585 = 255.9 bits — just under target. Rounding up is not optional.

RULE OF THUMB

Round up, then add margin. The next two slides show why the extra rolls are your insurance policy.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

04 / 11

04 · REAL DICE ARE NOT PERFECT

Fight bias by collecting more entropy than you need

WHY DICE LIE

• Imperfect weighting, air bubbles, off-center pips
• Chipped or rounded edges and corners
• A soft or uneven landing surface
• Lazy rolls that slide instead of tumble

A 1–2% face preference is invisible to the eye — and still valuable to an attacker.

DETECT IT (OPTIONAL)

Log every roll, then run a chi-square goodness-of-fit test against a uniform distribution.

The test needs volume — roughly 300+ logged rolls for a d6 before it has teeth — and a passed test is reassurance, never proof. Treat testing as a sanity check, not as the defense.

MITIGATE IT — THE PRACTICAL LADDER

1

Over-collect. Roll 1.5–2× the computed minimum: d6 → 150–200 rolls instead of 100, d20 → 90–120, d30 → 80–105. Mild bias costs you a fraction of a bit per roll; the margin pays for it.

2

Hash everything. SHA-256 acts as an entropy extractor: it concentrates whatever min-entropy you actually collected into an output that looks uniform — bias patterns leave no statistical fingerprint.

3

Coins instead of dice? The classic von Neumann extractor — read 01 as 0, 10 as 1, discard ties — removes bias exactly but throws rolls away. For dice, margin plus hashing is the simpler route.

REMEMBER  You cannot eyeball fairness. Margin plus hashing beats testing — every time.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

05 / 11

05 · THE GREAT EQUALIZER

SHA-256 turns your roll string into a clean 256-bit number

PADDED ROLL STRING

"1808110208021113…" (ASCII digits)

SHA-256

32 BYTES = 256 BITS

8c8a1144 499005cd … 76085394a

Deterministic — the same string always yields the same hash, so an offline machine can re-verify your seed years later.

Avalanche — change one digit anywhere and every output bit flips with 50% probability. The real pair below differed in a single roll.

Uniform — the output is indistinguishable from a perfect 256-bit random number; mild source bias leaves no statistical fingerprint.

One-way — nobody can work backwards from the hash to your roll sequence; the hash is safe to handle as the seed itself.

A …562562243 → fa8585ce 34e74278 d00ea439 610c8635…

B …562562244 → 42065cca ea007a8f f6f6bba5 d263660d…

REAL SHA-256 OUTPUTS · LAST DIGIT OF A 100-ROLL D6 STRING CHANGED 3 → 4

Warning: hashing concentrates entropy — i~~. 100 bits in ⇒ a 256-bit string with only 100 bits of strength.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

06 / 11

06 · ONE DIGIT CAN WRECK EVERYTHING

Always pad single-digit rolls with a leading zero

✗ RAW CONCATENATION

Write each roll as-is and jam the digits together. On a d20, three different roll sequences collapse into the very same string:

rolls 1 · 2 · 3 → "123"

rolls 12 · 3 → "123"

rolls 1 · 23 → "123"

3 sequences → 1 string → 1 hash

The recording is ambiguous: you can no longer tell which rolls produced it, an auditor cannot reproduce the hash, and distinct physical sessions silently collide into one seed.

✓ FIXED WIDTH, ZERO-PADDED

Width = the digit count of the face count. A d20 or d30 gets 2 digits per roll: write 01, 02 … 09, then 10 … 20. Single-digit rolls take a leading zero.

rolls 1 · 2 · 3 → "010203"

rolls 12 · 3 → "1203"

rolls 1 · 23 → "0123"

every sequence has its own string

Every roll owns exactly two characters, so the string decodes in only one way — unique, auditable, reproducible. D6 faces are all single-digit, but keep the habit anyway.

REMEMBER  Decide the format before the first roll — width, padding, no separators. Changing convention mid-session invalidates the whole recording.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

07 / 11

07 · HANDS-ON — THE EXACT COMMANDS

From padded string to 256 bits: one pipeline, any OS

LINUX / MACOS TERMINAL

# 1. string → SHA-256 (hex)

$ echo -n "1808110208021113…" | shasum -a 256

8c8a1144 499005cd c45196de 3968b3c8 … 76085394a

​

# 2. same string → the 256 individual bits (Binary Entrophy)

$ echo -n "1808110208021113…" | shasum -a 256 | xxd -r -p | xxd -b -g 0 -c 8

10001100 10001010 00010001 01000100 01001001 10010000 …

​

# 3. Checksum

$ echo -n "100011001000101000010001010001000100100110010000 …” | shasum -a 256 -0 | xxd -r -p | xxd -b -g 0 -c 8

11100001 01001001 10111111 10111111 10000100 10011011 …

WHAT EACH STAGE DOES

echo -n — no trailing newline; even "\n" changes the hash

sha256sum — hex digest of the string

xxd -r -p — hex text → raw 32 bytes

xxd -b — bytes → 8-bit binary groups

​

Run this on an offline machine — the roll string and its hash are your seed in the clear.

REMEMBER  The checksum for the next slide is already on screen: the first 2 hex characters (8c) are the first 8 bits (10001100). Same input → same bits on any OS — that is what makes the result auditable.

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

08 / 11

08 · BUILDING A BIP39 SEED — STEP BY STEP (1 OF 2)

First half: from 256 bits to a checksummed 264-bit stream

1

Collect. Roll and record — our running example uses 60 zero-padded d20 rolls (259.3 bits of raw entropy, with margin).

2

Hash. SHA-256 over the 120-digit ASCII string gives 32 bytes. These 32 bytes are the BIP39 entropy (ENT).

3

Checksum. Retrieve the first 8 bits of SHA-256(ENT). In sha256, it is the first 2 chars, since it is in hex.

4

Append. Glue the 8 checksum bits after the entropy: 256 + 8 = 264 bits = exactly 24 groups of 11. Continues on the next slide.

THE BIT LAYOUT

ENT — 256 bits (from SHA-256)

■ CS — 8 checksum bits

OUR RUNNING EXAMPLE (REAL VALUES)

string 1808110208021113…

(120 digits, 60 rolls)

ENT 8c8a1144 499005cd …

…6a2d9624 ba7bd0e7 6085394a

CS 11100001 (1st 8 bits of sha256(ent))

BIP39 allows entropy of 128–256 bits in 32-bit steps: 256 bits → 8-bit checksum → 24 words · 128 bits → 4-bit checksum → 12 words. Spec: BIP-0039 (Bitcoin Improvement Proposals repository).

GENERATING ENTROPY WITH DICE — EDUCATIONAL MATERIAL

09 / 11

09 · BUILDING A BIP39 SEED — STEP BY STEP (2 OF 2)

Second half: eleven bits at a time, indices become 24 words

5

Split. Chop the 264-bit stream into 24 consecutive groups of 11 bits. Each group reads as a number from 0 to 2047.

6

Look up. Each number is an index into the official 2048-word list (English wordlist in BIP-0039). Index 0 → "abandon", index 2047 → "zoo".

7

Write down. The 24 words, in order, on paper — never on a connected device. This word sequence is the mnemonic seed phrase.

8

Derive. The wallet stretches the words with PBKDF2-HMAC-SHA512 (2048 rounds, salt "mnemonic" + your optional passphrase) into a 512-bit seed, then BIP32 derives the key tree.

OUR EXAMPLE, CONTINUED (REAL VALUES)

1st group 10001100100₂ = 1124

wordlist[1124] → "milk"

WORDS 1–4

milk · explain · extra · nasty

WORD 24 ENDS WITH

… dream · topple · express

CHECKSUM BITS SIT INSIDE THE LAST WORD

BEFORE YOU TRUST IT

Recompute the words with a second, independent offline tool and compare letter by letter. If the checksum were wrong, a compliant wallet would reject the phrase on import.

These 24 words are printed on a public slide — this example wallet is burned. Never use entropy, hashes, or words you did not generate privately.

WORDLIST — BIP-0039 ENGLISH (2048 WORDS), GITHUB.COM/BITCOIN/BIPS

10 / 11

10 · DO IT FOR REAL

The full pipeline, and the rules that keep it safe

WHAT YOU LEARNED, END TO END

CHOOSE DIE → COMPUTE ROLLS ⌈256/log₂n⌉ → OVER-ROLL 1.5–2× → PAD & RECORD → CONCAT → SHA-256 → 24 WORDS → VERIFY & RESTORE-TEST

PRE-FLIGHT CHECKLIST

✓  Fresh, precision-made dice, a cup, and a hard flat surface

✓  Paper and pencil; the width-and-padding convention written down before the first roll

✓  An offline, air-gapped machine for hashing and word lookup

✓  A second independent tool re-deriving the same 24 words

✓  A wipe-and-restore drill on the wallet before any funds move

NEVER DO THIS

✗  Photograph the words or type them into any online device

✗  Skip the extra rolls because the die "looks fair"

✗  Reuse the example entropy, hashes, or words from this deck

✗  Keep the only copy of the phrase in a digital file

PRACTICE WITH A THROWAWAY SEED FIRST — MOVE FUNDS ONLY AFTER A SUCCESSFUL RESTORE TEST

11 / 11