How Tangem Generates Entropy for Private Keys

For seedless mode, Tangem Wallets derive entropy from the hardware True Random Number Generator built into the Secure Element, certified to the German BSI PTG.2 (AIS 31) standard.


If you choose to use a seed phrase instead, entropy is created using audited random number generation methods:

• In Android, we use SecureRandom, a cryptographically secure pseudorandom number generator (CSPRNG) whose output goes through BoringSSL/Conscrypt to the kernel entropy pool. This pool is seeded from interrupt timing, sensors, and the SoC’s hardware TRNG. This means an attacker can’t predict or reconstruct your key material.
   
• In iOS, we use the system-provided SecRandomCopyBytes API, which generates cryptographically secure random bytes suitable for cryptographic key generation. The entropy is sourced from the Secure Enclave’s hardware-based true random number generator (TRNG).
   

What is entropy in a crypto wallet?

Entropy is the raw randomness that a wallet uses to create a private key. It is measured in bits, and more bits mean a larger space of possible keys.

A wallet generates entropy once at setup. Every key, address, and signature after that comes from fixed mathematical rules, so no new randomness enters the system.

This makes the generation step permanent. If the entropy is low, nothing can strengthen the derived mnemonic.
 

How much entropy does a private key need?

Without sufficient entropy, an attacker can exploit patterns or biases in the key generation process to guess the key far more efficiently than brute-forcing the full mathematical space. 

A private key must appear completely random from the perspective of any adversary; low entropy means the effective search space shrinks dramatically, turning an astronomically hard problem into something feasible with enough computing power or clever analysis.

In practice, this randomness comes from high-quality entropy sources feeding a cryptographically secure random number generator. If the source is weak (for example, relying on timestamps, process IDs, or insufficient system noise), the resulting private key will have hidden structure. 

Attackers have exploited exactly this in real incidents, such as recovering Bitcoin private keys from poorly seeded RNGs on devices, where the effective entropy dropped to as low as 32 bits, making mass key theft possible.

Sufficient entropy ensures the key's security matches the underlying algorithm's strength. For elliptic curve keys like secp256k1 (used in Bitcoin and many others), the curve provides roughly 128-bit security against mathematical attacks, so the private key needs at least that much entropy to avoid becoming the weak link.

How does Tangem generate entropy for keys in seedless mode?

In seedless mode, the Tangem card generates the private key inside its secure element chip. The chip contains a hardware true random number generator, which produces randomness from physical processes such as thermal noise and oscillator jitter. Here's the process in detail.
 

Step 1: The TRNG samples physical noise. 

The hardware true random number generator draws entropy from unpredictable variations in the silicon, including thermal noise at the transistor level, electronic noise from quantum effects, and jitter in the timing of high-frequency oscillators. The output at this stage is a raw bit stream with bias and correlation.
 

Step 2: Conditioning removes the bias. The TRNG applies a conditioning algorithm, such as a cryptographic hash or a whitening process, to remove patterns and produce output uniformly distributed over all possible values. It also runs continuous health tests on the raw stream and halts if the noise source degrades. In combination with Step 1, this step is performed using a CC EAL-certified library that undergoes strict tests during certification, comes with the chip, and is never modified.
 

Step 3: The chip extracts 256 bits. A 256-bit sequence is taken from the conditioned output. This value is a candidate private key and nothing more.
 

Step 4: The chip validates the candidate against the curve order. An elliptic curve private key must be a valid scalar inside a specific range. For secp256k1, the key must be an integer between 1 and n-1, where n is the order of the base point and sits slightly below 2^256.

A candidate of zero or a candidate equal to or above n is invalid. The chip discards it and draws again, although the probability of this happening is around 2^-128.
 

Step 5: The value becomes the master key. This is the step that makes the method seedless. The 256 bits enter the key hierarchy directly as the master private key, with no mnemonic. 

Step 6: The chip computes the public key. The public key is obtained by multiplying the private key by G, the generator point of secp256k1, a one-way, irreversible operation.

Step 7: Addresses are derived from public keys. For Bitcoin, the compressed public key at a given path passes through SHA-256 and then RIPEMD-160 to give a 20-byte hash. The encoding of that hash sets the address type.

A key on a BIP-84 path becomes a P2WPKH address with bech32 encoding. A key on a BIP-44 path becomes a P2PKH address with Base58Check encoding. The two paths yield different keys, so they map to different addresses.
 

Step 9: The private key stays in protected memory. The private key stays inside the secure element chip for its whole life. The chip signs transactions internally and outputs only signatures, so the key never reaches the phone, the app, or the internet.
 

How does Tangem generate entropy for seed phrases?

In seed phrase mode, the Tangem app generates the mnemonic on the phone. The app requests random bytes from the platform cryptographic random number generator, which is SecRandomCopyBytes on iOS and SecureRandom on Android.

Both interfaces are cryptographically secure pseudorandom generators. Each takes its seed from the operating system entropy pool, which the device fills from hardware entropy sources at boot and during use.

The app then converts those bytes into words under the BIP-39 standard. It adds a checksum, divides the result into 11-bit groups, and maps each group to one word from a list of 2048. Twelve words encode 128 bits of entropy. Twenty-four words encode 256 bits.

Seedless mode removes the largest single cause of loss, which is a written phrase that someone finds, photographs or destroys. Seed phrase mode gives portability to other wallets, at the cost of creating a copy of the key outside the chip.

Why can users not test their own entropy?

A key made from 40 bits of entropy looks identical to a key made from 256 bits. Both produce a valid address and return the same number of words in the same format.
 

No test that an owner can run at home exists. This is why entropy defects can survive in shipped products for years. Verification, therefore, has to happen before purchase, through published audits and specific technical answers from the manufacturer.
 

How do entropy attacks work?

An attacker cannot calculate a private key from a public address. This would require solving the discrete logarithm problem, which remains infeasible at any realistic scale.

Weak entropy removes the need for that calculation. The attacker searches the reduced set of keys the broken generator could have produced, derives the addresses for each candidate, and then checks those addresses against the blockchain for a balance.

The address acts as the lookup target. This is why entropy attacks find funded wallets and ignore empty ones.

What to watch out for when choosing a wallet

When choosing a hardware wallet, prioritize devices with strong, verifiable entropy generation, as this is the single point that determines the unpredictability of your private keys. 

The recent entropy attack incident is a good example of why open-source firmware should not automatically be equated with better security. Most users cannot realistically audit source code themselves, while sophisticated attackers can study it to identify subtle vulnerabilities and exploit them.

The strongest approach is to minimize unnecessary exposure of critical firmware while subjecting it to rigorous independent audits by recognized security experts. Ultimately, security comes from strong architecture, thorough testing, and independent verification.- Andrey Lazutkin, CTO.

Consider using hardware wallets that feature a certified Secure Element paired with independently audited firmware. This firmware guides the use of the Secure Element, and flaws in its implementation can compromise even the most secure hardware. That's why every firmware update should be reviewed by trusted experts. 

Tangem's security design has been independently reviewed by leading laboratories, including Kudelski Security, Riscure, and Cure53, providing assurance of our wallet's overall safety.