Timeline for Provably fair coin flip system in Laravel
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 5, 2017 at 20:34 | comment | added | Chris Baldwin | Let us continue this discussion in chat. | |
| Aug 5, 2017 at 20:27 | comment | added | Chris Baldwin |
Here is how you generate the hash: hash_hmac('sha512', $request->clientstr."-".$bet->id, $bet->secret_key) The result i not entirely determined by the clientstr. If changes were made to either the bet->id or the secret_key then a different hash would be created which could change who wins. The bet-id comes from the database and the secret_key is a random 40 character string generated by the server. So already your users need to trust that your server is not doing anything nefarious so why not just use random_int() which has been verified by outside sources.
|
|
| Aug 5, 2017 at 20:23 | comment | added | FriedChicken | No because the string that the client sends determines who wins. The only problem is that I'm not sure if the outcome is 50/50. Is there something to create a "random" number based on a string? | |
| Aug 5, 2017 at 20:02 | comment | added | Chris Baldwin | Your server is already determining who wins. You are taking information generated by the server (bet id and secret), combining it with something from one of the clients, processing it and hoping that the result is random. In fact the majority of the data you are putting into the hash function to determine who wins comes from the server. | |
| Aug 5, 2017 at 19:20 | comment | added | FriedChicken | Using random_int() means that the server will decide who wins and I don't think there's a way to make this provably fair. Isn't it worse if the server can make you lose on purpose? | |
| Aug 5, 2017 at 18:46 | comment | added | Chris Baldwin |
From the documentation for PHP's random_int() function: "Generates cryptographic random integers that are suitable for use where unbiased results are critical, such as when shuffling a deck of cards for a poker game." Using this to generate you flips would be a good start to guaranteeing fairness.
|
|
| Aug 5, 2017 at 17:02 | comment | added | FriedChicken | The hash of the secret and the id of the game are shown to the player before accepting the bet. When the bet ends, the secret is also shown. With this secret key, people can see that the server did not cheat, because the bet outcome was influenced by the client. I don't see why it's unsafe to let the client alter the code. If the player messes with the code, e.g. sending an empty client string, the outcome would still be fair. I have no proof that the 2nd char of a HMAC will give a 50/50 outcome. How can I make it 50/50? Is there an other method to make the game 100% provably fair? | |
| Aug 5, 2017 at 5:12 | history | edited | Chris Baldwin | CC BY-SA 3.0 |
added 1 character in body
|
| Aug 4, 2017 at 20:04 | review | First posts | |||
| Aug 4, 2017 at 20:43 | |||||
| Aug 4, 2017 at 20:00 | history | answered | Chris Baldwin | CC BY-SA 3.0 |