Do imperfections in dice make them unsuitable to make really good bitcoin private keys? Dice do have imperfections (depending on how expensive ones you get), but would they not still have enough entropy such that a private key generated by them could be considered really safe? I am thinking of paper wallets storing lots of coins, potentially.

It would short circuit the problems with the implementations of random number generators on computers (the recent Android bug, and the Debian bug between 2006 and 2008)

http://www.debian.org/security/2008/dsa-1571

If a die is missing a side one would notice, so they are a lot easier to inspect for big errors than computer code.

So, how much would imperfections in dice lower the entropy? Could you just calculate with a lower base, e.g. 5.765*N rather than 6*N with a perfect die (5.765 then being a measurement of imperfection of a specific die).

Edit: maybe rather 6**(N-x), where x are the extra occurrences of one number.
You can certainly use any randomness source you like to generate a private key; however, any bias or correlation in your random inputs will make your key easier to guess and reduce its security.

I wasn't able to find a comprehensive analysis of dice randomness in the scientific literature, but this paper could be a start:


  Labby, Z. Weldon's dice, automated.  Chance 22(4): 6-13, 2009.  http://statistics.uchicago.edu/about/docs/labby09dice.pdf‎


Based on a total of 315672 die rolls, the author found a statistically significant bias toward the numbers 1 and 6.  The other references in that paper could be useful.  I also found remarks elsewhere that casino dice, which have flat faces rather than hollowed-out pips, may be less likely to be biased.  Of course, your dice could be different; if you wanted, you could roll them a large number of times and perform various statistical tests on the outcomes.

Even if your dice are biased, there are various ways to extract randomness from your data to obtain unbiased random numbers.  One of the simplest approaches (though not the most efficient) was described by von Neumann in 1951:


  Von Neumann, J.  Various techniques used in connection with random digits. NIST journal, Applied Math Series, 12:36-38, 1951.


There's a description of the technique here.  Note that it depends on the die rolls being independent and identically distributed, so you would need to roll the same die in exactly the same way each time to get a truly unbiased result.