2
$\begingroup$

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a third-party server whose trustworthiness can be easily verified (or whose cheating can be easily proven).

For example, let's say a game server is set up that sends messages to players, and every message it sends is signed with its public key and has details about the request that generated it, a timestamp, and so on. So if the server ever, for example, forged a timestamp, someone could publish a signed message from the server, subsequently signed by another timestamp service, proving this. Likewise, if the server ever cheated on someone's behalf, an insider could easily publish a set of signed messages proving that he received information from the server to which he was not entitled.

The hard part, I imagine, would be out-of-band communication. That is, guy at a server on the phone with a player. But that too could be easily exposed by a whistleblower by publishing the information he got out-of-band in a way that makes it statistically unlikely that he could have guessed it (for example, his info signed by another timestamp server earlier than his legal reveal).

Is there such a protocol known/in use? Am I missing something obvious about why this would be impractical and/or not significantly faster than the untrusted server protocols?

| improve this question | |
$\endgroup$
  • $\begingroup$ How would your third sentence work for a fake timestamp dated before the message was created? $\endgroup$ – user991 Apr 11 '13 at 6:09
  • $\begingroup$ It wouldn't. A false-early timestamp is hard to tell from a valid timestamp in a net-delayed message. But you might be able to show, for example, that a message has an earlier timestamp than another one that had to have preceded it logically for game reasons. $\endgroup$ – Lee Daniel Crocker Apr 11 '13 at 8:08
  • $\begingroup$ Here's a thought: how about a slight modification of this idea, which generates a single random number fairly among N players: Have the central server initially act as a player, revealing his commitment along with the others. But then all players except him reveal their secret numbers. The server (who now is the only player who knows the final random number) runs the hand, then publishes the result along with his secret number which can be verified with his earlier commitment, and verified as the number used to shuffle the deck. $\endgroup$ – Lee Daniel Crocker Apr 11 '13 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.