Verify your dice

Every game's dice are fixed and sealed before the first throw, and the seed is revealed after the last. This page recomputes the seal, the commitment and every roll from that seed. It runs in your browser; nothing you paste leaves it.

Seed and salt — the line under “Seed revealed at the end of the game”: 64 hex digits, a space, 32 hex digits Seal — optional; the fingerprint shown under the dial before you spun Commitment — optional; shown before the first roll Throws — optional; every throw in order, opening throws first, as 31 or 3-1, separated by spaces Recompute

Doing it without this page

The same computation, as a script you can read in full, is at verify_dice.py. It needs only Python 3:

python3 verify_dice.py "SEED SALT" 3-1 5-2 6-6 4-1 …

Or with any SHA-256 tool. The protocol is four lines:

seal        = SHA-256(seed ‖ 16 zero bytes)
commitment  = SHA-256(seed ‖ salt)
block(t, c) = HMAC-SHA-256(key = seed, msg = salt ‖ u32le(t) ‖ u32le(c))
roll t      = first two bytes b < 252 of block(t, 0), block(t, 1), …
              each read as (b mod 6) + 1

Bytes 252 to 255 are skipped so that every face is exactly as likely as every other. Turn t counts from 0 and includes the opening throws, tied ones too.

What a match proves

The seal matches: the seed existed before your spin, so the app could not choose it knowing your salt. The commitment matches: seed and salt were fixed before the first roll. Every throw matches: the dice you saw were the only dice that seed and salt can produce. The opponent program is handed each roll at the same moment you are, and is never given the seed.

If a throw does not match, keep the game and write to us: that is a defect in the application, and we want it. backgammon [at] arcanevoid [dot] com