terms used
• client seed: a string chosen by the player (or automatically generated if you don't choose one)
• server seed: 64-character hex string generated using crypto.randomBytes(32) and hashed with SHA-256
• nonce: number of the round you're on, increases by 1 for every round across all house games
• cursor: internal number representing a nonce within the round, increments by 1 for each card dealt, starts at 0
• HMAC: cryptographic function that mixes the unhashed server seed, client seed, nonce and cursor to produce a result
here's a 3rd party HMAC tool to verify each step for yourself: https://cryptii.com/pipes/hmac - (or any other one you prefer)
how HMAC is used to determine cards (with example)
unhashed server seed: e8c83961a3961baee67cc08da34ada1c00a4515450a3cdbd2b1db81a35ca7f72
client seed: UzR5CIqog4DXox5H
nonce: 470
cursor: 0
here's what the "message" part of the HMAC looks like for calculating the first card: <clientSeed:nonce:cursor>: UzR5CIqog4DXox5H:470:0 (for the second card in the deck it'd be ”UzR5CIqog4DXox5H:470:1”)
the ”key” part is your unhashed server seed
if you're using the 3rd party site above to follow along, it would look like this:
first card HMAC result: c3a71f38b3988ffca7fbdb7a52f7fab2bf33ce7349afb8f3c7cf12689e5b7475
the first 4 bytes (8 hex characters) are then taken from this string and converted from hexadecimal → decimal (c3a71f38 → 3282509624)
the first 4 bytes are only used if the outcome is less than 4,294,967,248 (essentially to eliminate a miniscule bias towards the first 40 cards) otherwise the next 4 bytes will be tried
the final calculation of decimal to card value looks like: 3282509624 % 52 = 4 (which means "if you split 3282509624 into groups of 52, 4 is left over)
number 4 aligns with ”3D” in the card table
the table is from 0-51, meaning 0 = 2D, 1 = 2H etc.
you can find the following table by clicking "expand" on the code here
didn't read any of that but it's still probably rigged
the server seed itself isn't enough to rig anything - as long as you're able to set a client seed (after the hashed server seed is shown), the HMAC output where your card comes from will be entirely random and unpredictable
the total number of possible 32-bit values is 2^32 = 4,294,967,296
the maximum fair range is 4,294,967,248 (to ensure it's divisible by 52)
every one of those 4,294,967,248 results are equally likely to happen, meaning every single card has a 1-in-52 chance of appearing
so how would i know if it WAS rigged?
1. if your hashed server seed wasn't shown before playing
2. if your hashed server seed was shown to you only after committing to a client seed
3. if the algorithm was changed to use a different part of the hash (you can verify that this isn't the case with steps above)
4. if your hashed server seed didn't match the unhashed seed when checking with a SHA-256 calculator
in short, if your hashed server seed is shown to you prior to selecting your client seed and you're able to verify the outcomes through either our calculator or one you find online, there is nothing anyone could do to make your results unfair.
cool document but i lost 5 hands in a row which is mathematically impossible
flip a coin 100 times, it’s not impossible to get 60 heads and 40 tails
flip a coin 1 billion times, it’s effectively impossible to get 600 million heads and 400 million tails
RTP is the expected return to player per round (with perfect play) the results are still random, even with a provably fair and random system, you're never guaranteed to win - it’s still gambling.