How Do Online Casinos Work?

[MangoJ]

Having a 32 digit (I assume bit) random number (so 1 out of 2^32) is not sufficient for most card games. It will only give you 5(!) random cards from a 52 card deck, as the 6th card is not random anymore: 52!/(51-6)! > 2^32.
After the 7th card seen you would be able to predict all other cards in the deck.

You would really want to play Texas Holdem with your system, knowing all hole cards on the river.

[jstrike]

Hey Mango. I simplified the example of how my system's shuffling works, for the sake of keeping the explanation clear. In truth, no one is generating decks with 52! possibilities. But you're completely right that a 32 bit seed doesn't give enough possibilities to prevent prediction in a Hold'em game.

I don't use a single 32-bit seed to shuffle decks. When I said my software takes a 32 digit number from the random pool, I mean it's a 32 digit decimal number. This number is considered truly random as it comes from a remote RNG. We use the first 10 digits of the random number to create a hash which is then bitmasked to create our first unsigned 32-bit seed. The seed is fed to a Mersenne Twister, which is an algorithm that will always produce the same series of numbers given the same seed. MT is considered unpredictable for the period of about the first 623 numbers...meaning that from the first 623 in any given series, you can't guess the key. That doesn't make it random of course. The only random part is which MT sequence we're using, which is determined by our 32-bit seed, which means there are only 2^32 possible sequences.

So anyway, we use the MT to generate a predictable series of numbers from our random seed. We then use those numbers to do a Fisher-Yates shuffle on the deck. The point of the FY is that it provides an even distribution of possible shuffles from any given starting deck over a 32-bit period. After that, though, the last number we take from that MT sequence is used to cut the deck at a random point. Then we re-seed the MT with the next ten truly random numbers in our 32-number sequence, shuffle and cut again. Then we do it a third time.

If we started with a single 32-bit seed and shuffled three times, we'd still obviously only end up with 2^32 possible decks. But by doing it this way we have what amounts to a 96-bit seed, which can produce around 27! possible combinations, or a period of 16 known cards that have to be seen before the rest of the deck becomes predictable. While it's true that that's still only a tiny fraction of possible poker decks, it's far too many to be useful to an attacker. What historically has happened is that hackers were able to narrow down the possible sets of decks by cuing into how pseudo-random generators were being seeded, specifically, when one casino was dumb enough to publish its algorithm which turned out to be nothing more than seeding by their system's microsecond value. Once a hacker synchronized with that value, they could predict the seeds and didn't have to brute-force their way through 2^32 decks to figure out what deck they were looking at after 5 cards.

This is the classic paper on the subject, btw...
http://www.developer.com/tech/articl...e-Security.htm

Brute force times have improved a lot since then, but you still can't crack a 96-bit shuffle in real time if the seeds used to generate it are genuinely random.