By using a "high entropy" method of selecting bits like a coin flip, you make it more likely to reach one of those very high and hard to guess keys. But high entropy does not in itself mean that you will obtain the safest seed.
quotingA thought experiment about entropy
nevent1q…s4rh
Imagine a perfect random machine generates 128 bits. Every bit has exactly a 50% chance of being 0 or 1.
It produces:
00000000000000000000000000000000…
The probability of producing this exact sequence was 1 in 2¹²⁸.
Now imagine instead it produces:
10110100111001010010110101110010…
The probability of producing this exact sequence was also 1 in 2¹²⁸.
Mathematically, neither outcome was more likely than the other.
And yet, if these values were being used as secrets, which one would an attacker guess first?
Obviously, all zeros.
The machine did nothing wrong. Its process was perfectly random. It simply landed, by extraordinary chance, on a value that is highly predictable to an attacker.
This leads to an important distinction:
Equal probability of generation does not imply equal difficulty of guessing.
Among all 2¹²⁸ possible values are a tiny number of extraordinarily simple ones: all zeros, all ones, alternating bits, repeated patterns, counting sequences, and other values an attacker would naturally test first.
A perfect random process can produce any of them. It is just extraordinarily unlikely to do so.
These are the values people often intuitively describe as “low-entropy keys,” although technically entropy describes the process or probability distribution that generated the value, not the individual value itself.
So where would you place 000…000 in a map of the 2¹²⁸ possible values: among the enormous mass of difficult-to-guess values, or at the very bottom among the tiny set an attacker would try first?
