1

I want to generate a seed using CSPRNG. I then want to shuffle a standard pack of playing cards (52) using said seed, however, I want the shuffle to be accurate enough that it covers all the possible shuffle outcomes which is 52 factorial. I read from a blog post online that I need at least 226 bits of entropy to cover this. Here is the post for more information.

How would I go about implementing a CSPRNG seed that can shuffle a deck of cards in the same pattern each time given that the seed is the same? I am happy enough to take pseudo code as an explanation, or NodeJS/TypeScript code if possible.

Any help would be greatly appreciated, I'd like to understand exactly how this is achieved. If it is possible, and would still be considered a CSPRNG?

forest
  • 15,253
  • 2
  • 48
  • 103
Kieron Wiltshire
  • 11
  • 2
  • 3
    See, https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates_shuffle , you need DRGB and seed it with CSPRNG. You, however, need to store the seed for your repeating purposes. – kelalaka Sep 30 '22 at 21:48
  • Yeah, Fisher-Yates is the general idea. Another way similar to that is to randomly choose an integer from $0$ to $52!-1$, mod it by 52 to get first Fisher-Yates choice, divide by 52 rounding down, mod by 51 to get second Fisher-Yates choice... For choosing the random number, there are many ways using a CSPRNG. The simplest is to generate a 226-bit random string using methods kelalaka linked (DRGB), interpret as an integer, and retry if $r \ge 52!-1$. This will eventually succeed in practice, though theoretically could take forever. – Myria Sep 30 '22 at 21:55
  • Oh, and another way is to double the number of bits and "mod": select a 452-bit random string and mod it by $52!$. This has bias, but the bias will be very small by doubling the number of input bits. Depending on your security requirements, this may be fine. RFC 4226 is an example where a mod is used because the bias is sufficiently small as to still be within security bounds. – Myria Sep 30 '22 at 21:59
  • Are you absolutely sure you need it to cover all shuffle outcomes? If no one will ever be able to tell which shuffle outcomes are impossible, what would you lose by using a 128-bit seed? Here is javascript code to do it: https://crypto.stackexchange.com/questions/98841/deterministically-produce-an-array-of-indexes-based-on-input-number/98842#98842 – knaccc Sep 30 '22 at 22:52
  • @Myria I've described a method to actually do a very efficient random number generator [0..N) that uses 1.7 bits of overhead on average. Basically you only compare the most significant bits with N and then regenerate only those bits if the number is higher. See here – Maarten Bodewes Sep 30 '22 at 23:08
  • @knaccc so realistically the answer is no, but I think if you're making a game of sorts which requires this sort of thing, the fairest way possible I think is to ensure that all possible outcomes are part of the RNG. Just my 2 cents.

    Myria and others, much appreciated for your responses. I actually just built a small prototype between posting this question and this comment. Thank you!

     – Kieron Wiltshire Oct 01 '22 at 00:14
  • 2
    Hiya & welcome! Struggling to understand the question though. Is the answer not your link (AESCounterRNG) + Fisher Yates? And if it's a casino situation, why would you want to exactly repeat the shuffle? Casino's can't. – Paul Uszak Oct 01 '22 at 01:00
  • It's unclear if the question is about 1) obtaining the seed of a CSPRNG; or/and 2) using the seeded CSPRNG to shuffle a deck of cards in the same pattern each time given that the seed is the same, and all 52! shuffles are (about) equally as likely. – fgrieu Oct 04 '22 at 03:52
  • @PaulUszak provably fair system is an answer I could give you, but honestly... it's for testing, auditing and customer support reasons. – Kieron Wiltshire Oct 14 '22 at 23:46

0 Answers0