Elliptic Curve Cryptography
The poker protocol that fair.poker is using relies on elliptic curves and their unique properties.
Let's see what makes elliptic curves special:
First, given a point on the elliptic curve P and a scalar k, we can multiply P by k to yield kP
Finding k given the starting point P and the result of the multiplication kP is called an "elliptic curve discrete logarithm problem". This operation is believed to be computationally very hard.
Second, a very important property about elliptic curves (which we are later going to use to build our fair poker algorithm) is the fact that multiplications on the curve are homomorphic. We can multiply our starting point P by multiple different scalars a, b, c in any order and still yield the same result. The order of multiplication does not matter.
Just as in normal math: a * b = b * a.
Now that we know the basics of elliptic curves we will use this knowledge to build a provably fair deck shuffling algorithm.
To best understand the fair poker algorithm, we will follow an example game of poker. Let's say that we have three players on the table: Alice, Bob and Charlie.
Stage 1: Shuffle
We start with a set of 52 points on the elliptic curve. These are points generated by our servers. These points represent the 52 cards we will play poker with. Each card is mapped to a single point on the curve.
Let the starting points be P1, P2, P3, ..., P52.
We send these points to all players on the table.
Alice is the one to start. She generates a scalar a on her computer (the browser) that only she knows. She takes the set of points, shuffles it on her computer (the browser) and multiplies each point by her scalar a.
The result is the set of points:
aP1, aP2, aP3, ..., aP52
She sends this set to all players on the table.
The next player to act is Bob. On his computer, he generates a scalar b. He takes Alice's set, shuffles it and multiplies each point by his scalar b.
The result is the set of points:
abP1, abP2, abP3, ..., abP52
He sends this to all players on the table.
It is Charlie's turn. He does the same as Bob and Alice:
Now that we have a shuffled and encrypted deck of cards, we proceed to the next stage of the algorithm.
Stage 2: Locking
It is Alice's turn again. She takes Charlie's set of points and she multiplies each point of the set by the multiplicative inverse of her scalar a - the one she used during the shuffle stage. This removes her shuffle key from the set. The set looks like:
bcP1, bcP2, bcP3, ..., bcP52
Alice then generates new 52 unique scalars: a1, a2, a3, ..., a52.
She multiplies each one of the 52 points sequentially using these new scalars. This time each point gets multiplied by a different scalar. The result is:
a1bcP1, a2bcP2, a3bcP3, ..., a52bcP5
Note, now each card is encrypted by unique 52 scalars by Alice and by a single scalar form all other players.
Alice sends this set of cards to all players on the table.
It is Bob's turn. He does the same as Alice. He multiplies the set of cards by the multiplicative inverse of his shuffle key b. This removes it from the set. He then generates 52 unique keys and encrypts each card by a unique key. The result is:
a1b1cP1, a2b2cP2, a3b3cP3, ..., a52b52cP5
It is Charlie's turn. He repeats what Alice and Bob did:
The deck circled in red is the final deck of cards. It has been shuffled and encrypted by each player. No player knows the order of the cards and no player can decrypt any card without the cooperation of all other players. We will play poker with this deck.
To open a card at index i all players have to broadcast their respective locking keys at that index.