I built a small BIP-39 checksum device for manually generated entropy

The idea started from something that bothered me with hardware wallets and other similar devices, and it really sparked during the coldcard mishap (which shows that letting the hw generate the seed for you is not ideal for real cold storage).

Hardware wallets allow you to provide your own entropy, for example using dice rolls. This is already much better than blindly trusting an internal rng, but imho there is still one part of the process you have to trust: you cannot usually verify, step by step, that the entropy bits you provided are actually being mapped to the correct BIP-39 words.

You provide the entropy, and eventually the wallet shows you a mnemonic.

But what happened in between?

This device is meant to solve exactly this problem.

I made a similar project before this one but the word-building process wasn't fully auditable, Redditors pointed out this problem, which I really appreciated.

This device does not generate entropy. You generate it yourself using coin flips or dice rolls. The device only helps you convert that entropy into a BIP-39 mnemonic and calculate the checksum required for the final word.

While entering the entropy, the 2x16 LCD shows the current 11-bit group being built. When the 11 bits are complete, it shows the decimal index and the corresponding BIP-39 word.

For example, this is the 7th word while being built, with only 5 bits entered so far:

+----------------+ |W07 11000______ | |A:H=0 B:T=1 | +----------------+ 

...and this is the final result once all 11 bits have been entered:

+----------------+ |W07 11000010110 | |1558 security | +----------------+ 

So you can independently check:

11000010110 -> 1558 -> security 

against any BIP-39 wordlist, even a wordlist as pdf or txt file on your computer, it doesn't have to be on paper. Indexes are 0-based !!!

This happens for every word.

The final word is the only special one because part of its 11 bits comes from the SHA-256 checksum. For a 24-word mnemonic, for example:

+----------------+ |W24 101|01100110| |1382 <word> | +----------------+ 

The 101 bits come directly from your entropy, while the remaining 8 bits are the checksum calculated by the device.

Unlike the previous project, this one currently supports 12, 18 and 24 word BIP-39 mnemonics, with three entropy input methods: direct coin flips, Von Neumann debiased coin flips, and dice rolls. Von Neumann allows to get statistically fair results from a biased coin (any real word coin is slightly biased of course).

The goal is basically to have a very small device where you provide the randomness and you can audit the entropy-to-word conversion while it happens, instead of trusting a hardware wallet to do that part correctly behind the scenes.

Project here:

https://github.com/gianlucag/LastWord

I would really appreciate any feedback, or simply whether you think this approach makes sense