There's no more than 123 bits of entropy due to the abbreviated length.  Bitcoin addresses themselves have no more than 160 bits of entropy because they are based on ripemd160.  I chose this as a tradeoff for space versus time.  It's still quite expensive to brute force 123 bits, especially when the payoff is that you might bump into a 1 BTC coin sometime before the end of the world, and especially considering that each iteration of any attack requires a relatively slow elliptic curve multiplication operation.  Mining is far more lucrative by several orders of magnitude to say the least.  

My source of entropy is the cryptographic secure random number generator in the .NET Framework, in the System.Security.Cryptography namespace, XORed with the SHA256 hash of (mash + incrementing number).  Mash is a constant string produced by me mashing gibberish (was probably 60-70 chars) on the keyboard and is meant as extra entropy against Microsoft's implementation.  (I'm familiar with Debian SSL flaw and thought that this would mitigate the possibility if there were something similar).

This was done on an airgapped machine, the OS installation dedicated just for this purpose, private keys have never touched any machine on the internet.  The hard drive was strictly controlled, and after the private keys were printed on 33 sheets of paper (each individually checked for accuracy), has since been zeroed over in its entirety (with linux) and a new OS installed over top of it.

I recognize and appreciate the importance of generating these keys securely.  It would be an epic fail for me to say "Whoops!  Hacker found your private keys in my temp directory... SORRY" and fortunately I know how not to do that.

The papers are what literally go in to the coin under the sticker. So nothing to shred.

You should sell them on tv ! Remember the $20 from Liberia to commemorate 9/11.

http://forums.commercialsihate.com/9-11-commmemorative-20-dollar-ad_topic1328.html

From a different thread Casascius wrote:

So just to clarify -- it is possible that these could be circulated without having the hologram tampered with but having no bitcoin funds loaded, correct?  I.e., if I were to accept one of these as payment or purchase one, I should first check the address to confirm it has the bitcoins loaded?

Not exactly.  I'm willing to ship them unloaded and load them on receipt so they aren't as valuable while they're being processed for customs.  But I am not willing to allow them to circulate unloaded.  If they are in the wild, they are either already loaded, or going to be loaded.  Also, any coins shipped that way would be shipped with a method that offers international tracking and a signature, because I intend to load the value whether the coins arrive or not.

maybe i missed this, but how is this coin secured from 2x spend attack.  that is the issuer (Casasious) could also have a copy of teh coin's a privkey.  i know there is a tamper evident seal and a code to check with the issuer its authenticity.

Lastly, how is this secure from counterfeit?  couldn't i just copy the verification code of a legit coin and try to pass one off?  people accepting these will likely not redeem them, so the counterfeit may not have the right privkey inside, but its outer check number thingy would be right...

maybe i dont understand.  but if you can explain this to me i'd love to buy a 25 btc for my 3 year old nephew, just like i've been buying him silver eagles every b-day since.

In a theoretical sense, I could scam my customers.  In a practical sense, seeing as how I give away my real life identity and have PGP signed the list of addresses I have prepared for my coins, those I scammed would have fairly strong recourse against me.


Sure, if anyone wants to spend four figures to get custom holograms done, only to be able to perpetrate a scam that will probably be figured out in days if not weeks.  It's been discussed in the past.  If someone goes to the effort of doing it, that'll be unfortunate.  Hopefully they'd see it as just as lucrative to generate real legit coins (i mean, I'm already charging a 20-25% premium over face value, isn't that good enough?).  Same argument as it applies to mining: it pays more to be an honest miner, and therefore have reasonable faith that miners are honest.


Buy one, and buy a billy club with it.  If I scam you, come to Utah and beat my ass.  My real address is on my website.  If I don't scam you, you've just given a great gift that hopefully will appreciate.


I deliberately chose inkjet.  Laser toner is relatively thick and can be read from the outside with radiation or ultrasound.  Inkjet may fade in the same sense old photos become slightly off color, but you don't see them fading into oblivion like the photos turning into blank paper.  That said, I used an off-black color to ensure that C+M+Y+K ink all contribute to the color, so they would all have to fade to blank for this to be an issue.

Wow, you thought this thru...as soon as some stuff clears i'll buy a few

i received this stuff! Very, very good product. Playing with it like a kid now )))