Wallets that sign transactions using true random numbers

Question

From https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm:

Another way ECDSA signature may leak private keys is when 'k' is generated by a faulty random number generator.

It would be nice if a wallet instead of forcing you to blindly trust a specific PRNG would let you increase the randomness of 'k', for instance by moving your mouse around (as in https://www.bitaddress.org) each time you're about to make a transaction.

Is there any Ethereum or Bitcoin wallet that allows for such a thing? If not, is there a technical reason behind it?

Answer 1

The bitcoin world used to use random k values, but has largely thought better of it, because you need a way to make random numbers, and this is prone to implementation or platform bugs like the Android random number generation turning out to suck, or pulling a number from an HTTP URL at random.org and ending up using something like "HTTP is now disabled. Please use HTTPS".

The solution, which is also mentioned on the linked Wikipedia page, is to use a deterministic number instead of a random one. The number is based partly on the message that's being signed, so you can be confident that you won't deterministically generate the same value twice for different messages. This is what pretty much all crypto-currency wallet software does nowadays, and if they don't it's a red flag.

See this answer for more discussion of the pros and cons of this (basically all pros) including some comments by Pieter Wuille, who wrote libsecp256k1, the ECDSA library that is used in both Bitcoin and Ethereum.

Note that although you can do the signing without a random number, you still need random numbers to generate the keys in the first place, and that may be a good place to make you move your mouse around or whatever.

Answer 2

The source of randomness like moving mouse could be used as a seed (which must be fully random) for an RNG. However, I think such source didn't offer a high entropy and don't forget there is some lazy people won't provide a good mouse movement. Besides, we use the standardized RNG because they was tested and we could for example check if there is something wrong like with the generator Dual_EC_DRBG that was backdoored by NSA. The only remaining problem is about the parameters using in the standards for ECDSA we don't know how they was chosen. I think the community now is moving toward adopting schnorr algorithm which is a provably secure algorithm but still non-standrized.