A guide to how Provably Fair works.

[SRoulette]

if you bet 20 times in a row and loose every time and some else evens the house edge by winning 20 times it isn't very fair is it?

Very fair. It is the nature of random, try flipping a coin 10'000 times and see if you dont get 20 heads on a row.

[madmadmax]

if you bet 20 times in a row and loose every time and some else evens the house edge by winning 20 times it isn't very fair is it?

Very fair. It is the nature of random, try flipping a coin 10'000 times and see if you dont get 20 heads on a row.

The problem occurs though when >90% of bets are like that for example. The house edge seems normal more or less but you were already predetermined to loose to a greater degree before even placing the bet,  this coupled with stealing from investors = success.

[madmadmax]

hmmmm, maybe my 15 years in the field wasn't enough to compreend the text. so, can you point me what I miss about that NIST (National Institute of Standards and Technology) paper?


and please, try to prove what you're saying because until now you just chitchatting

Please refer to the following posts where I have already addressed the issue so you may better "compreend" everything:

Satoshidice claims it is "provably fair" but decides they will not prove that they are fair and so far it hasn't been proven once. Now I do understand your claim that they must not prove that they are fair to really be fair but then it's the argument of religion basically, if I hold my hand behind my back and claim I have a couple of pounds of diamonds in my hand I would be the one making the statement thus I would be the one needing proof (e.g. showing you the diamonds) and not you needing proof of me not having the diamonds in my hand behind my back in order to establish that they really are not there, since I have no initial proof of my statement it is disregarded.

Makes sense? Gox has everything to do with it since both of the companies are ran by teenagers that fail to employ the proper people to do a job they are unqualified to do out of pure greed.

We can now establish who is right in the second argument: Me

As I have already expressed this in the most childish way possible so even an infant may understand: I am not the one that needs to prove they are NOT fair, they are the one needing to prove that they ARE fair, it hasn't been done once.

You say this a lot. so, can you explain me what exactly you mean by your "industries standards"?

The chance of it being fixed by an established and licensed casino is much lower than ANY bitcoin casino.

S. Dice for example claim they have fair play, yet it is possible for them to submit selective bets since they know the secret word in advance and potentially steal from their investors. Okay not bad right? Wrong, nobody can vouch for the quality of the numbers that satoshidice generates and how random they are exactly, have they been certified by the Swiss Federal Office of Metrology (also known as METAS) and confirmed for quality number output that could compare to commercial RNGs such as Quantis? No? Didn't think so, it was certified by a bunch of smartasses on bitcointalk.

Using the (salted) hash of the chat as a seed is also a bad idea for various reasons, please leave it to the pros to generate quality random numbers, especially when it comes to gambling on virtual property, fund your project properly and hire a qualified person to do that work.

I think it is related to the dark side of anarchism whereas people begin to disregard technological advances and standards that have been established as a result of perfecting the systems and simply claim that these standards are a series of monopolized marketing schemes aiming at increasing profitability.

Basically the logic of fuck METAS, licensing, technological institutions that specialize in metrology, they are all greed seeking pigs, so we'll use a lava lamp as an RNG instead since we can do it better (and increase our own profits in the grand scheme of things).

This is the new dawn of cryptocurrency demagogism that, from their perspective, will ideally misguide fools, give themselves a piggyback ride on the economy and leave fools scratching their heads and blaming Bitcoins when they have hit rock bottom.

The sole fact that they haven't shown one bit of evidence just makes it painfully obvious to anyone who doesn't have urine in their circulation system. Stop showing us your right hand while giving us the ol' switch and grab, the true members of the community will still look at your other hand.

[SRoulette]

if you bet 20 times in a row and loose every time and some else evens the house edge by winning 20 times it isn't very fair is it?

Very fair. It is the nature of random, try flipping a coin 10'000 times and see if you dont get 20 heads on a row.

The problem occurs though when >90% of bets are like that for example. The house edge seems normal more or less but you were already predetermined to loose to a greater degree before even placing the bet,  this coupled with stealing from investors = success.

But >90% of the bets are not like that. SatoshiDice does not publish an ordered bet log as we do but as members like dooglus have shown it is easy to extract.

We are not statisticians ourselves but we did notice when running our own simulations that sha512_hmac(txid, secret) frequently produced large groupings of similar results, though despite this the number distribution evened out over a large enough sample size. 
We have noticed that our new improved RNG using sha512_hmac(txid, secret) and mersine twister produces this less often but it still does occur and the number distribution is still the same after a big enough sample size.

Its no secret that when we first started running simulations on our reimplementation of satoshidice's RNG we sampled our own wallets txids and kept trying secrets to see if any trended towards low or high, they do. Before your alarm bells start ringing you need to appreciate that as new data was added (new bet txids from players) the trends would often start correcting. Our own simulations using real data showed at best you could hope to gain another 1% edge.

It sounds like you are using a martingale system which is when you really notice these long losing streaks, if you suspect SatoshiDice is picking secrets that have trends of long losing streaks then apply the reverse martingale, thus turning any cheating into an advantage.

If specifically you feel that our casino may be cheating by doing this you could then play reverse dice where low numbers win, if we are attempted to trend to high, play Jackpot Dice where the high numbers win.

It really is in the best interest of a casino to set a reasonable house edge and use the best RNG they can, this is the safest way to a steady income.

[BRules]

hmmmm, maybe my 15 years in the field wasn't enough to compreend the text. so, can you point me what I miss about that NIST (National Institute of Standards and Technology) paper?


and please, try to prove what you're saying because until now you just chitchatting

Please refer to the following posts where I have already addressed the issue so you may better "compreend" everything:

Satoshidice claims it is "provably fair" but decides they will not prove that they are fair and so far it hasn't been proven once. Now I do understand your claim that they must not prove that they are fair to really be fair but then it's the argument of religion basically, if I hold my hand behind my back and claim I have a couple of pounds of diamonds in my hand I would be the one making the statement thus I would be the one needing proof (e.g. showing you the diamonds) and not you needing proof of me not having the diamonds in my hand behind my back in order to establish that they really are not there, since I have no initial proof of my statement it is disregarded.

Makes sense? Gox has everything to do with it since both of the companies are ran by teenagers that fail to employ the proper people to do a job they are unqualified to do out of pure greed.

We can now establish who is right in the second argument: Me

As I have already expressed this in the most childish way possible so even an infant may understand: I am not the one that needs to prove they are NOT fair, they are the one needing to prove that they ARE fair, it hasn't been done once.

sorry, but your bold text has nothing to do with RNGs, if you want me to prove if 1+1 is equal 2 I can gave you the apples proof. but there's no mathematical formula that proves the entropy of a system, and that's what RNG is all about.

this reminds me of a dilbert strip:
http://www.random.org/analysis/dilbert.jpg

You say this a lot. so, can you explain me what exactly you mean by your "industries standards"?

The chance of it being fixed by an established and licensed casino is much lower than ANY bitcoin casino.

S. Dice for example claim they have fair play, yet it is possible for them to submit selective bets since they know the secret word in advance and potentially steal from their investors. Okay not bad right? Wrong, nobody can vouch for the quality of the numbers that satoshidice generates and how random they are exactly, have they been certified by the Swiss Federal Office of Metrology (also known as METAS) and confirmed for quality number output that could compare to commercial RNGs such as Quantis? No? Didn't think so, it was certified by a bunch of smartasses on bitcointalk.

Using the (salted) hash of the chat as a seed is also a bad idea for various reasons, please leave it to the pros to generate quality random numbers, especially when it comes to gambling on virtual property, fund your project properly and hire a qualified person to do that work.

I think it is related to the dark side of anarchism whereas people begin to disregard technological advances and standards that have been established as a result of perfecting the systems and simply claim that these standards are a series of monopolized marketing schemes aiming at increasing profitability.

Basically the logic of fuck METAS, licensing, technological institutions that specialize in metrology, they are all greed seeking pigs, so we'll use a lava lamp as an RNG instead since we can do it better (and increase our own profits in the grand scheme of things).

This is the new dawn of cryptocurrency demagogism that, from their perspective, will ideally misguide fools, give themselves a piggyback ride on the economy and leave fools scratching their heads and blaming Bitcoins when they have hit rock bottom.

The sole fact that they haven't shown one bit of evidence just makes it painfully obvious to anyone who doesn't have urine in their circulation system. Stop showing us your right hand while giving us the ol' switch and grab, the true members of the community will still look at your other hand.

I understand that, for the regular user, any stamp from a renowned institute that proves the way that the random numbers are generated are fair maybe is a relief they aren't being cheated. But, while this doesn't happen, doing a little research you can use the common sense to see that they are using a fair way to determine the bet results.

I'm not taking this discussion further as in any discussion there are 3 viewpoints: your viewpoint, my viewpoint and the right viewpoint. Just keep in mind that we gave you a paper and statistics, and you only your opinion.

best regards

[🏰 TradeFortress 🏰]

Bump

[Dabs]

but it is unfair to the players that the numbers are not generated according to the standards of the industry

Thing yes provable fair has not been proven even once until today.

yes it is possible to prove that the bet result was generated using the transaction id, the secret key and whatnot but who guarantees even distribution across all numbers as it needs to be by the industries standards?

1. Generate 10 billion 256-bit numbers. These are your transaction id hashes.
2. Generate 1 secret key of any length. This is your secret.
3. Hash those together using SHA-256 to get 10 billion 256-bit numbers.
4. Study the distribution of those 10 billion numbers.
5. For specific applications, use only the digits used, like for many dice games, the first 4 hex digits or 0 to 65536.

Alternatively

For number = 1 to 100,000,000,000  (one hundred billion numbers)
  print sha256(i)
Next number

The output should be uniformly distributed. Each pattern of output bits should be equally likely. The distribution from this study will essentially be your industry standard.

While this test does not illustrate it, it can be surmised from the purpose of SHA and from its proven history as a cryptographic primitive that the test would show uniform distribution for any classes of keys and any subset of its output bits. If it did not, this weakness would provide a way to identify collisions with less than brute-force effort.

SHA-2 is a set of cryptographic hash functions (SHA-224, SHA-256, SHA-384, SHA-512) designed by the U.S. National Security Agency (NSA) and published in 2001 by the U.S. National Institute of Standards and Technology (NIST) as a U.S. Federal Information Processing Standard.

In the United States the National Institute of Standards and Technology (NIST) plays the dual role of maintaining and furthering both commercial and scientific metrology.

Of course, 10 billion numbers or even 100 billion numbers does not prove anything. We need it to infinity for it to be a true mathematical proof.

However, even a normal person will say that if it talks like a duck, and quacks like a duck, 10 billion times in a row, perhaps we can consider that provably fair.

[Dabs]

And this all reminds me, that there is no such thing as Provably Fair. This is actually Probably Fair. But the probability of being fair is very high or extremely high. Or the other way around, the probability of being unfair is very low, to the point it is almost negligible, for all practical intents and purposes.

Now, I'm maybe just nit picking on language and terminology used, but what odds do you consider Provably as opposed to just Probably? Is a 1:100,000,000,000,000 probability good enough? Because we can even use MD5 or SHA1 and no one will probably cheat. We can even use a 64 bit hash and the odds are still 1.8 * 10^19.

So, anyone using 256 bit hashes or higher (384 and 512) are overkill.

And I'm bumping this thread because I'm working on a provably fair poker game. Good luck to me.

[dooglus]

So, anyone using 256 bit hashes or higher (384 and 512) are overkill.

Also, some sites (like Just-Dice and CoinRoll) use the same seed on multiple rolls.  So you need to raise your probability of cheating to the N'th power, where N is the number of rolls with the seed.  The chance of breaking sha512 once is currently so close to zero as to be effectively zero.  Raise that to the 200,000th power (or however many rolls you made with your current JD seed pair) and it just gets silly how tiny the difference between "provably" and "probably" gets.

To put it in perspective, Just-Dice is "probably" fair in the same way as a person sending Bitcoins "probably" owns the private key and didn't just guess it.  Maybe he just got lucky and brute-forced the private key, but "probably" he didn't.

[Atruk]

To put it in perspective, Just-Dice is "probably" fair in the same way as a person sending Bitcoins "probably" owns the private key and didn't just guess it.  Maybe he just got lucky and brute-forced the private key, but "probably" he didn't.

Well... There are those people who were using Android Wallets that trusted Google's PRNG...

[faiza1990]

Fortress you are not breaking laws you are helping peoples for good

[Dabs]

So, anyone using 256 bit hashes or higher (384 and 512) are overkill.

Also, some sites (like Just-Dice and CoinRoll) use the same seed on multiple rolls.  So you need to raise your probability of cheating to the N'th power, where N is the number of rolls with the seed.  The chance of breaking sha512 once is currently so close to zero as to be effectively zero.  Raise that to the 200,000th power (or however many rolls you made with your current JD seed pair) and it just gets silly how tiny the difference between "provably" and "probably" gets.

To put it in perspective, Just-Dice is "probably" fair in the same way as a person sending Bitcoins "probably" owns the private key and didn't just guess it.  Maybe he just got lucky and brute-forced the private key, but "probably" he didn't.

Thanks for the support. . . . .


Seriously though, I'm just using the words that should be used. It turns out that we still can't prove it, unfortunate as that may be. However it has to be better explained to people or they will call us marketing scams or something.

However, on this topic of using the same seed on multiple rolls, does this logic apply to the same seed (or the same group of seeds linked to each other) on cards games? For example, a 52 card deck that uses 52 different "card seeds" or "card secrets". If you reveal only the cards the player has, how "provable" or "probable" is it that all the other cards are rigged even if you can't see them?

If that question can be satisfied, then we have a partial solution to the poker issue (how to prove that mucked / discarded / folded cards are what they are, because only the original player knows them)... or I ask the other question "if the other player folded, does it matter that you don't know and can't prove what his cards are?"

psst, @dooglus, I made a thread specifically for poker, it's in the games sub-forum. Go there, I could use your input. Thanks.

Back to topic, what is a good level or high enough probability for us to consider as something provable? Certainly 2^16 is not enough, or 2^32 is still only 4 billion. Is 2^64 good enough? 2^80? 2^96? 2^112? Or do we "require" 2^128 at least?

My guess, is that we match what is considered "unbreakable" for the time being, which is 128 bit encryption as the minimum. Implementing something in Triple-DES at 112 bit, while not recommended is also "provably" unbreakable. DES was never cracked. It was simply brute-forced due to such a small key space.

[masterluc]

Hi. Great post!

I can explain here caesarbit.eu provably fair implementation variant.

Each game starts from generating server and client seed numbers.

Server generating 50 random numbers and stores them in session providing SHA256 hash of this sequence to client before each game. Player may write down a hash to verify game fairness later. From now server can not change its random seed numbers, as hash will be broken.

Client browser doing the same using Javascript browser capabilities. Player also may write down a browser generated sequence to verify game fairness later.

When this two side random handshake complete, game starts. When server needs to pick a random number, it uses both server and client random number in sequence by doing bitwise XOR operation with two server/client numbers in sequence. Resulting number is used as seed for random engine and random number is picked using this seed.

After game player may visit seed logs for Blackjack or Roulettte and discover server seed sequence verifying its hash.

We provide open source php scripts which may replay all random items in game used particular seed: BlackJack PHP command line tool and Roulette PHP command line tool.

On this page player can find input data for particular game for these scripts. Script will show:
- Server seed
- Server seed hash (verify to written down before game)
- Client seed (verify to written down before game)

And then replays all random game items in sequence they appear in a game.

[m19]

Hi guys,

Let's say I want to make an heads or tails game, but only with a 49.5% chance to choose the right one (thus making it not a real heads or tails game, but for house edge).
Is it possible to proof I am doing this fair? I am still trying to get an grasp on this whole "provably fair" thing.

For chances I'd like to use the Chance.js (http://chancejs.com) library. I've run simulations and it's pretty accurate.

Code:

var statistic = function(){
	var win = 0;
	var lose = 0;
	var streak = 0;
	var longest_streak = 0;

	for(var i = 0; i < 10000000; i++)
	{
		if(roll())
		{
			streak++;
			win++;
		}
		else
		{
			if(streak > longest_streak)
			{
				longest_streak = streak;
			}

			streak = 0;
			lose++;
		}
	}
	return "Win: " + win + " Lose: " + lose + " Longest streak: " + longest_streak;
};

gives result:

Code:

Win: 4949365 Lose: 5050635 Longest streak: 24

[masterluc]

Choose another game behavior. Heads and tails has 50% probability and zero house edge.

The main benefit of proven fair feature is to prove that house doesn't craft random items during game, but picks really random ones.

So in your case it would be "Provably cheat" game

[m19]

Choose another game behavior. Heads and tails has 50% probability and zero house edge.

The main benefit of proven fair feature is to prove that house doesn't craft random items during game, but picks really random ones.

So in your case it would be "Provably cheat" game

Well let's change scenario:

If you click play you have an 49.5% of doubling your money.

How can I prove it now?

[masterluc]

Create a way to:

1. Create a set of data your numbers picked from
2. Provide a cryptographic seal on that set - show its sha2 hash to customer before game to prove you will not change it
3. Run game
4. Show your original set to player along with its hash and provide open source script to replay all picked numbers on client PC

[dooglus]

Create a way to:

1. Create a set of data your numbers picked from
2. Provide a cryptographic seal on that set - show its sha2 hash to customer before game to prove you will not change it
3. Run game
4. Show your original set to player along with its hash and provide open source script to replay all picked numbers on client PC

All you are proving there is that you picked the results early, and not during play.  It doesn't prove that you picked the fairly.  You could, for instance, have deliberately included long runs of high and low numbers in the result set in order to bust players who always pick the same result (hi or lo, say) and double their bet on loss.

To make it provably fair, allow the user to provide input that affects their results in a repeatable way but which they can't predict.

[masterluc]

All you are proving there is that you picked the results early, and not during play.  It doesn't prove that you picked the fairly.  You could, for instance, have deliberately included long runs of high and low numbers in the result set in order to bust players who always pick the same result (hi or lo, say) and double their bet on loss.

To make it provably fair, allow the user to provide input that affects their results in a repeatable way but which they can't predict.

He is asking how to prove a fairless game lol - I answered

[dooglus]

He is asking how to prove a fairless game lol - I answered

I know.  And I pointed out a flaw in your answer.

Here's a game.  I'm going to pick numbers between 0 and 100.  You have to guess whether they are below 49.5 or above 50.5.  It has a 1% house edge.

To prove it's fair, using your system, I'm going to provide the hash of the set of numbers I preselected.

It's bcb708ddadd008c0d48a204f2c923c010ac0bbef22aa531b3e8d39bd20ae1fe1

Now play 5 times.

Oh, you lost every bet?  That was unlucky.

Here's the list I hashed, to prove I wasn't cheating:

$ echo -n '49.6 49.7 49.8 50.2 50.4' | sha256sum
bcb708ddadd008c0d48a204f2c923c010ac0bbef22aa531b3e8d39bd20ae1fe1  -

My point is that publishing a hash of numbers you have chosen unfairly doesn't prove fairness.  It just means you have to cheat before the user plays instead of during.