Is it safe to generate an account with 256 coin flips?

Question

Suppose one generates an account with the following procedure:

1. Flip a coin 256 times;

2. On a paper, write each heads as 1 and each tails as 0;

3. Convert the 256-bit string to hex by mapping each 4-bit sequence to a char from 0 to F;

4. Save that 64-character hex string to a file (say, echo 'ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD' > priv.txt);

5. Import that private key using geth account import;

6. Remove the file: rm priv.txt;

7. Store the private key in a safe place, offline.

Is to know if this procedure is safe or if is there any potential issue with it.

Answer 1

Nothing is 100% secure, at least nothing you can be certain of.

Your procedure is a pretty good idea. I just played it through. Possible security implications:

1. The coin might not flip randomly enough. It's reported that some coins turn out more often heads than tails. Try a dice maybe (odds = 1, even = 0)?
2. If you use a machine to convert the binary number to hexadecimal, ensure it's offline and secure. Try to boot from a live medium before doing this.
3. The step saving it to disk (priv.txt) might leave a magnetic footprint on your harddisk. Again, boot from a live medium which operates in memory. But don't forget to backup your encrypted keystore.

I think it's easier and more safe than using geth directly to generate an encrypted keystore. Just make sure it's offline and operating in memory and well backed up.

Answer 2

While unlikely to flip so many heads in a row, it's still worth mentioning that not all 256-bit numbers are valid private keys in Ethereum and as explained here:

Specifically, any 256-bit number from 0x1 to 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140 is a valid private key.