A comparative analysis of dice methods for seed generation.
Every dice defines a bounded outcome space. A d6 maps to {1, 2, 3, 4, 5, 6}. A d8 maps to {1, 2, 3, 4, 5, 6, 7, 8}. The cardinality of this space is fixed by geometry — no material change can add or remove faces.
Maximum entropy per roll is log2(faces). This is the theoretical ceiling: the most information a single roll can carry, achieved only when every face has exactly equal probability.
| Dice | Faces | Max Entropy (bits) |
|---|---|---|
| d4 | 4 | 2.000 |
| d6 | 6 | 2.585 |
| d8 | 8 | 3.000 |
| d10 | 10 | 3.322 |
| d12 | 12 | 3.585 |
| d20 | 20 | 4.322 |
The entropy field is fixed by geometry. Material quality determines how close a real dice gets to this ceiling. A fair d8 achieves 3.000 bits. A biased d8 achieves less. The field itself cannot change.
A fair dice has uniform probability across all faces. A biased dice has non-uniform probability. The shape of the outcome space does not change; only the distribution over it does.
This is the same structure as difficulty in Bitcoin. The nonce space is bounded (232 × difficulty). Difficulty does not expand the space; it contracts the probability of finding a valid hash within it. Material bias in a dice contracts the probability of each face within a fixed outcome space.
A biased d8 can have lower entropy than a fair d6. Solve for the crossover:
Hd8 = 3.0 − bias < 2.585 ⇒ bias > 0.415 bits
A d8 losing more than 0.415 bits to material bias is entropy-inferior to a fair d6. Material quality matters more than face count.
When converting base-N dice rolls to binary, non-power-of-2 bases create modulo bias — some binary values become more likely than others. This is not a material defect. It is a mathematical certainty.
A dice with N faces produces exact integer bits per roll if and only if N = 2k for some integer k. In that case, log2(N) = k, and every k-bit pattern has probability exactly 1/N.
| Dice | Faces | Bits/Roll | Exact? | Bias |
|---|---|---|---|---|
| d4 | 4 = 22 | 2.0 | Yes | 0% |
| d6 | 6 | 2.585 | No | 16.9% |
| d8 | 8 = 23 | 3.0 | Yes | 0% |
| d10 | 10 | 3.322 | No | 60% |
| d12 | 12 | 3.585 | No | 16.9% |
| d20 | 20 | 4.322 | No | 37.5% |
Of the rolling Platonic solids, only d4 and d8 have power-of-2 faces. d4 does not roll reliably (it tends to stick or land rather than tumble). This leaves d8 as the only practical dice with zero conversion bias.
The general rule: dice faces must equal 2k. d4 (22) and d8 (23) qualify. d6, d10, d12, d20 do not.
Three dice methods are used in practice for BIP-39 seed generation. Each has distinct properties.
d6 raw (SeedSigner method). Roll d6 99 times. Each roll maps to a digit 1–6. Entropy: 99 × log2(6) ≈ 255.91 bits. Bias: ~17% modulo bias. Some seeds in the 256-bit space are never generated; others are more likely. An attacker can eliminate approximately 17% of the possibility space.
d6 base-10 (Ian Coleman method). Roll d6 99 times. Enter rolls as base-10 digits. The tool treats each digit as 0–9 and claims 99 × 3.322 = 329 bits. Actual entropy: 99 × 2.585 = 256 bits. The tool overestimates by 73 bits (28%). This is the overestimation bias: the user is told they have more entropy than they do.
d8. Roll d8 86 times. Each roll maps to 3 bits (1 → 000, 2 → 001, …, 8 → 111). 86 × 3 = 258 bits. First 256 = entropy, next 8 = checksum. Zero bias. Every seed in the 256-bit space is equally likely.
d20 (rejection sampling). Roll d20. Accept 1–16 (4 bits), reject 17–20. Expected rolls: ~80 for 256 bits, but the actual count varies (typically 75–95). Bias amplification: 2.5× that of d8 (20 faces vs 8). The variable roll count makes the process unauditable without a complete log of every roll.
d6 raw: ████████████████████████████████████████████████░░
256 bits gap (~17%)
d6 base-10: ████████████████████████████████████████████████░░
256 bits gap (~17%)
d8: ██████████████████████████████████████████████████
264 bits (100% coverage, zero gap)
A fixed roll count is a security property. A variable roll count is a liability.
With d8, you roll exactly 86 times. The count is the proof. If someone asks “did you actually roll?” you answer: count the entries. If count = 86, the process is complete. No rejection log. No accepted/rejected tally. No “did I miscount?”
With d20 rejection sampling, the expected count is ~80, but the actual count varies. Without a complete log of every roll (accepted and rejected), you cannot prove the process was followed correctly. Most errors are silent: accepting a 17–20 is invisible; rejecting a 1–16 is invisible. Only the final count reveals anything, and a wrong count is indistinguishable from an honest variance.
With d6, the bias is the liability. Every roll carries ~17% modulo bias. This does not average out over 99 rolls — it compounds. The bias is systematic, not random.
The verifiability hierarchy: d8 (trivial — count = 86) > d6 (minutes — requires rejection log) > d20 (hours or impossible — requires full roll log).
Manufacturing imperfections erode entropy. The amount of erosion depends on both the dice’s geometry and the precision of its manufacture.
For a given manufacturing precision ε (relative error in face area, center-of-mass offset, edge rounding):
Effective entropy = Hmax − k × nfaces × ε
| Dice | Hmax | Geometry factor (k) | Faces | Tax per 1% ε |
|---|---|---|---|---|
| d4 | 2.0 | 1.5 | 4 | 0.06 bits |
| d6 | 2.585 | 1.0 | 6 | 0.06 bits |
| d8 | 3.0 | 1.0 | 8 | 0.08 bits |
| d12 | 3.585 | 1.3 | 12 | 0.16 bits |
| d20 | 4.322 | 1.3 | 20 | 0.26 bits |
At 1% manufacturing error: d6 loses 0.06 bits, d8 loses 0.08, d20 loses 0.26. d20 still wins on absolute entropy, but the gap narrows significantly. The d6 and d8 are geometrically “forgiving” — their right angles and triangular faces are easier to manufacture accurately.
Edge rounding sensitivity scales with total edge length. d20 has 30 edges (vs d8’s 12) — rounding hurts d20 2.5× more. d12/d20 also require smooth, high-friction surfaces to utilize their rolling advantage; d8 rolls well on any surface.
Beyond conversion bias, the physical dice itself introduces material bias. Manufacturing defects — air bubbles, edge rounding, center-of-mass offset, uneven engraving — reweight the probability distribution over faces.
| Defect | Mechanism | Typical εrms |
|---|---|---|
| Air bubbles | Lighter faces float up | 0.02 – 0.05 |
| Rounded edges | Energy dissipation bias | 0.01 – 0.03 |
| Off-center COM | Weighting toward heavy side | 0.015 – 0.04 |
| Uneven engraving | Mass removal asymmetry | 0.005 – 0.015 |
| Mold gate mark | Injection molding artifact | 0.01 – 0.02 |
Classification of dice quality by εrms:
Most biases are systematic — they do not average out. A dice with εrms = 0.03 will always lose approximately 0.3 bits per 86 rolls. Testing is the only way to know your dice’s actual quality.
The entropy framework from Bitcoin maps directly to physical dice.
| Bitcoin Concept | Dice Analogue |
|---|---|
| Bounded entropy field (232 nonce space) | Fixed face count (6, 8, or 20) |
| Difficulty contracts probability | Material imperfections reweight faces |
| Entropy priced in advance (difficulty) | Geometry sets max entropy |
| Temperature revealed after block | Bias measured after rolling |
| Work = energy to resolve entropy | Kinetic energy to roll |
| Irreversible block commitment | Outcome fixed when dice stops |
The analogy is not metaphorical. It is structural. Both systems have a bounded field of admissible outcomes, a probability distribution over that field, and a resolution event that collapses the distribution into a single outcome. The cost of the resolution (kinetic energy, proof-of-work) does not determine fairness — only the resulting distribution matters.
Each method has properties that suit different priorities. No method is universally “best.”
| Property | d8 | d6 | d20 (rejection) |
|---|---|---|---|
| Conversion bias | 0% | ~17% | 0% (with rejection) |
| Rolls required | 86 fixed | 99 | ~80 variable |
| Roll count variance | 0 | 0 | ~4 rolls (sigma) |
| Mapping complexity | 8 entries | 6 entries | 16 entries + reject |
| Bias amplification | 1× (baseline) | 0.75× | 2.5× |
| Human error surface | Minimal | Medium | High |
| Audit time | Seconds | Minutes | Hours / impossible |
| Dice availability | Medium | High | Medium |
The d8’s fixed roll count is a security property: the count itself proves the process was completed. The d6’s ubiquity is a practical advantage: cubes are everywhere. The d20’s higher bits-per-roll is a theoretical advantage that is offset by its variable count, higher bias amplification, and larger error surface.
What level of assurance satisfies your threat model is a personal question. The data above lets you weigh the tradeoffs for yourself.