Skip to main content

Video Poker PF

Written by Birate

terms used

client seed: a string chosen by the player (or automatically generated if you don't choose one)

server seed: 64-hex string generated using crypto.randomBytes(32) and hashed with SHA-256, used as 'key' for HMAC

nonce: the number of round you're on, increases by 1 for every round across all house games

cursor: internal number representing a nonce within the round, in video poker – it increments with every shuffle. given 52 cards, the shuffle needs 51 steps, so cursor starts at 0 and goes up to 50

HMAC: cryptographic function that mixes unhashed server seed, client seed, nonce and cursor to produce a result

here's a 3rd party HMAC tool to verify each step for yourself: https://cryptii.com/pipes/hmac - (or any other one you prefer)


basics

Video poker uses the "Fisher-Yates" shuffling method to shuffle cards from 0- 51, each corresponding to a playing card in a standard deck.

these are shuffled one by one for every round, with the "cursor" increasing for each shuffle

the final outcome is a result of your server & client seed combination – meaning there's no possible way for us to influence your odds


how HMAC is used to determine shuffles, example round to demonstrate

unhashed server seed:

095d6816179b10fb2edaa28f5ca48260a09045ed00d6529621fe037e5ba9d0b7

client seed: u6bEgvYMZivkzbAv

nonce: 3693

cursor: 0 (starts at 0 for each round, ends at 50)

for each shuffle, the code generates this 'message' for the HMAC input:

<clientSeed:nonce:cursor> = u6bEgvYMZivkzbAv:3693:0 (second shuffle would be u6bEgvYMZivkzbAv:3693:1)

the "key" part is your unhashed server seed

if you're using the 3rd party site above to follow along it would look like this:


these values result in the following hexadecimal string: 283703451a2dd0ab4232417789ff2a4bf7def1f06eb149be60fb0ab0ea02bc9b

each string is sampled 4 bytes (8 hex) at a time, in this case the first 4 bytes would be "28370345"

this is then converted from hexadecimal → decimal (28370345 674693957) this is the number we're left with for calculating the 1st shuffle: 674693957


what does that have to do with a poker hand

the decimal number is ran through a modulo calculation to determine which card to use for shuffling, this looks like:

674693957 % 52 = 41 (meaning 'if you divide x by 52, what number is left over')

here's how the cards are laid out before shuffling:

wat shuffling

shuffling works by swapping a number from a specific position in the sequence with the last number which hasn't been swapped yet, in this case it'd be swapping 41 (42nd card in the sequence, QH) with 51 (52nd number in the sequence, AC) the last card in this deck is now locked in as the Queen of Hearts

deck order after first shuffle:

next shuffle uses u6bEgvYMZivkzbAv:3693:1 as the "message" part, which gives 2280786805 as the decimal number

since the 52nd slot is already decided, the calculation is 2280786805 % 51 = 46 (next one would be x % 50 etc.)

deck order after second shuffle:

the deck is then shuffled 49 more times, after which the final sequence looks like this:

after all shuffles are done, the first 10 cards of the final sequence are used as the results, so your first hand would be: AH, 5D, 2H, 3H, 7H.

no matter what cards you choose to keep, the following cards will always be the next 5 in the sequence, which in this case are: JH, 8C, 4H, 2S, 3C.

if you were to discard the 5 of diamonds from the first hand, you'd be left with a flush, this can be verified on the fairness page - https://duel.com/fairness/verify


how would you know if it was rigged

  1. if your hashed server seed wasn't shown before playing

    (would allow the casino to change which seed is used)

  2. if your hashed server seed was shown to you only after committing to a client seed
    (would allow the casino to cherrypick a favorable server seed based on your client seed)

  3. if the algorithm was changed to use a different part of the hash

    (you can verify that isn't the case with the steps above)

  4. if your hashed server seed didn't match the unhashed seed when checking with a SHA-256 tool
    (would allow the casino to do whatever they want with your results)


TL;DR

• pf in video poker works by combining your client seed, server seed, nonce and cursor in HMAC to shuffle numbers corresponding to playing cards in a random and unpredictable way

• final cards are already determined before you press play

• "Fisher-Yates" shuffling method is used for the final positions - meaning that for each round, the deck is shuffled one card at a time, 51 times, and the resulting sequence of numbers dictates if you get royal flush or not

• as long as you're able to set a client seed (after the hashed server seed is revealed), there's nothing the casino can do to fuck with the odds without players immediately noticing

• every individual shuffle can be verified through 3rd party tools online, no need to blindly trust Duel

Did this answer your question?