Poker Stack Exchange is a question and answer site for serious players and enthusiasts of poker. It only takes a minute to sign up.
Sign up to join this community
I'm developing a poker app in java and using java.util.Random to shuffle the deck. Literature I've read suggests that this is flawed and that alternative methods be introduced to generate a random number which does not "fall on the planes". How could a player take advantage of their knowledge that this code was in use?
http://www.javamex.com/tutorials/random_numbers/java_util_random_algorithm.shtml#.VRzx_PzF-25
Shuffling a deck on a computer is not a trivial task. It is not the same task as encryption and it is not the same task as game simulation, both of which use PRNG's. http://www.datamation.com/entdev/article.php/616221/How-We-Learned-to-Cheat-at-Online-Poker-A-Study-in-Software-Security.htm
Is a description of a flaw in the way the deck was shuffled at PlanetPoker.com, the very first web site to offer online poker for cash. A really short description of the flaw is that they produced the seed for the shuffle from the CPU clock. It was a total failure. It was predictable and could be hacked quickly and easily and it was also statistically flawed. There is only one million possible shuffles that could be had from the CPU clock, and there are 80,658,175,170,943,878,571,660,636,856,403,766,975,289,505,440,883,277,824,000,000,000,000 ways to shuffle a 52 card deck, which makes one million just a very tiny tiny fraction of all possible shuffles.
Planet Poker had a shuffle routine that was neither secure, or random in the gaming sense.
This exploit was the most well known. A lot of people thought good they plugged the hole lets move on. But there have been exploits since that involve getting at peoples hole cards. Patches have been made, but is it fixed, not likely.
The challenges of securing a poker game online is daunting, much more complicated then most security problems.
The PP exploit only needed a little data to break a hand, the hole card and the flop, was enough to use a little brute force to figure out what the rest of the players had in hand and what the turn and the river was going to be. And that is one of the main challenges, you have to give up a little of the key in a poker hand, to every one involved.
Anything can be decrypted with enough time and computer power. When you have to give up some of the solution(IE a poker hand and flop is part of the solution) you are giving a hacker a lot of information that does not need to be figured out with brute force.
A shuffle in poker also has to be a statistically valid shuffle. This means that the shuffle has to play like a real poker game. If you go looking on the web for PRNG (Pseudo Random Number Generators), you will find a wide variety of them. Some are made for simulation, some are made for secure random numbers. You cannot guarantee a secure PRNG will produce statistically valid numbers for a poker game, nor can you guarantee a statistically valid PRNG will produce secure numbers that will keep the shuffle key unknown in a meaningful way.
What you really need to consider is a pretty comprehensive survey of the state of the art with security at a online poker room. You need highly specialized advice if your going to be playing for money with your software. It is a cat and mouse game between hacks and poker sites that is still going on.
"Anyone who considers arithmetic methods of producing random digits is, of course, in a state of sin." - John von Neumann, 1951
The short answer: If your player knows your seed, in theory he can predict the outcome of the randomizer. In practice, you want to reseed your randomizer with a random seed that is very difficult to guess. If the seed is static (a hardcoded value) or changes in a predictable manner (example: date/time as the seed) then in theory it's possible to guess it by taking enough random samples. How? A mathematician will have to answer it :)
The long answer: It is not easy to achieve a "true" randomization in computers, instead programmers use pseudo-randomization that comes close to true randomization for their particular purpose. (http://en.wikipedia.org/wiki/Random_number_generation). However, mathematically speaking it is not a true random generator.To put it another way, under 100% identical environments, the same code will produce the same number on two different machines. 100% identical environments is the key here.
Poker stars has a page on security and deck shuffle, you might wanna check it out (https://www.pokerstars.com/poker/room/features/security/)
In Java, when you use Math.random() multiple times, Java only creates the Random object one time. When a large number of random numbers are drawn from this seed, it should in theory be possible to predict the next random number with some amount of precision.
However, you can easily circumvent this by generating a new seed every so many random numbers, or even for every random number. The only downside to this is that will be very bad for performance.
So instead of
double randNumber = Math.random();
you could do:
double randNumber = new Random().nextDouble();
Of course, there are many more factors that you should take into account when developing a production-grade poker application. This is a very interesting article about some of the things that can go wrong: http://www.datamation.com/entdev/article.php/616221/How-We-Learned-to-Cheat-at-Online-Poker-A-Study-in-Software-Security.htm
Exploits on shuffle due to random rare. A bad algorithm is the big weakness.
A site was exploited is due to off by one (they failed to shuffle the last or first card).
Another exploit is making ever card move. You need to allow for a card not moving.
Not uniform. A shuffles that swaps every position is not uniform. A variation of 7 is the common total on a roll of two dice.
Random seed is available by listening to atmospheric noise. You don't need to reseed very often as not may cards are actually seen.
The Fisher-Yates shuffle is proven to be uniform and it is efficient. It only requires 52 random numbers. You would need to know the existing deck and also the next 52 random numbers to know the next shuffle.
-- To shuffle an array a of n elements (indices 0..n-1):
for i from n−1 downto 1 do
j ← random integer such that 0 ≤ j ≤ i
exchange a[j] and a[i]
Even with a truly random you typically only get like 4.3 billion. Problem is that there are actually 52! possible deals which is a really big number. But if you look at the Fisher Yates closely it produces exactly 52! variations. So if you can generate a good random from 1-52 then you cannot be exploited.
In theory if the random was not perfect you could identify some shuffles that don't happen or happen less often or more often. But with poker the order does not matter so a board Ah Kc 4d 3s 8h is same as 4d Ah Kc 3s 8h so if one happens more than the other is no advantage. There are like 4.6 million boards so if you know some happen more than another might happen more might be an advantage but if you know QQ wins 80% versus 80.0000000000001% is not real advantage. But you do get to see the order of the cards so in theory you could limit the cards. But if the chance of having QQ goes from 0.5550% to 0.5551% there is not advantage to be gained. Even with a bad random you are going to generate a very large numbers of deals with a good distribution.
A less than perfect random itself is not much of a risk. If now the seed to a prefect or imperfect random is the only way to take advantage (IMHO).
