Do not open a public issue for a weakness affecting entropy, the RNG, BIP-39, seed words, memory clearing, data exposure, firmware builds, or device integrity. Use GitHub private vulnerability reporting. Include the affected version, hardware, reproduction steps, impact, and a proof of concept containing no real mnemonic or private key.
Only the latest published version receives security fixes. Research firmware and development builds must never be used to generate real secrets.
EXPERIMENTAL — DO NOT USE WITH REAL FUNDS.
The ESP32-S3 physical RNG is the cryptographic foundation. Human interaction is mixed as a second source, providing defense in depth without a certified entropy-bit claim. The design does not protect against compromised firmware, toolchains, chips, displays, computers, power sources, or physical access. It has not received an independent cryptographic audit.
- Every hardware-RNG read occurs while the internal entropy source is enabled through
bootloader_random_enable()and is filled withesp_fill_random()before disabling that source. - Session initialization absorbs a domain label, version, 32 bytes of hardware RNG, and a 16-byte random session identifier.
- Accepted DOWN/UP transitions absorb original transition time, interval, duration, button, and game context.
- Logical actions and post-placement board snapshots use separate canonical record types.
- Every placed piece is followed by a fresh 32-byte hardware-RNG sample tagged with its piece number.
- Finalization absorbs a distinct domain, the interaction digest, final statistics, board state, and another 32-byte hardware-RNG sample.
- SHA-256 conditions the combined data into one 256-bit result; repeated RNG reads are not claimed as additive independent entropy.
The game requires 128 placed pieces for 12 words or 256 for 24. A loss clears the complete attempt. This proves sustained participation, not a certified bit count. Board state, piece sequence, score, and elapsed time are context and are not separately credited as entropy.
The final result supplies 128 or 256 entropy bits to the BIP-39 encoder, which appends the standard checksum and maps to the official English word list. Interface language never changes those words.
Production firmware has no Wi-Fi, Bluetooth, application console, filesystem, NVS, OTA, or telemetry. Sensitive state lives in SRAM and is cleared through volatile writes on loss, timeout, completion, and restart. This cannot guarantee removal from CPU registers, unknown compiler/ABI copies, display electrical traces, or hostile physical instrumentation.
The separate research profile exports non-secret interaction records over USB and stops before mnemonic generation. It never includes hardware-RNG samples, digests, indices, or words. Production builds compile the protocol out, and release checks reject research markers. Research CSV files may identify interaction patterns and must remain private and outside Git.
The installer accepts only the production artifact prepared by CI, verifies its SHA-256, writes the full image at 0x0, reads it back, and compares the hash. It has no serial console or telemetry. GitHub Pages, Actions, browser dependencies, and the installation computer remain part of the supply chain; independent verification requires rebuilding the tagged source and comparing the resulting hash.