Fair dice

How Tavli fixes a match's dice before its first roll, and how anyone can check them afterwards.

Every tavli player has said it: the dice are against me. In Tavli that is an answerable complaint. The dice of a match are decided before it starts, and at the end the app hands you everything needed to prove it.

What the app does

Before the first roll of a match, the app draws a secret 32-byte seed from the system's secure random source.
It shows that seed's fingerprint, the SHA-256 of the seed as 64 hexadecimal characters, in Settings under "Fair dice". This is published before a single die is thrown, and the seed itself stays hidden.
Every die of the match comes from the seed and nothing else. The SHA-256 of the seed followed by an 8-byte big-endian counter (0, 1, 2 and so on) gives 32 bytes at a time. Bytes of 252 and above are thrown away, so every face is exactly as likely as every other; each byte kept is one die, its value modulo 6 plus 1. The opening roll, both players' rolls and the computer's rolls all come from this one sequence, in the order they are rolled.
When the match is decided, the app reveals the seed, shows how many times each face came up for each side, and offers "Copy the proof": the fingerprint, the seed and every die in order.

Checking a match yourself

With the copied proof and any SHA-256 tool:

The SHA-256 of the seed's bytes must equal the fingerprint the app showed before the match started. If it does, the app could not have changed the seed once play began.
Replaying step 3 above from that seed must give exactly the dice listed in the proof, in that order. If it does, no roll was chosen after the fact.

The app performs both checks itself on every finished match before it says "These dice were fixed before the first roll."

Matches between two devices

A Game Center match is turn-based, so neither device can wait for the other to answer before rolling. One shared seed revealed in advance would not do, because both sides would then hold every future die, and a fresh exchange before every roll is not possible when the other player may be asleep. Tavli does this instead.

Each device draws a 32-byte secret and hashes it 4,096 times. The end of that chain is its anchor, published in the match before that device's first die. The secret never leaves the device.
A sitting is one device's time with the turn. Its dice come from a seed that is the SHA-256 of two links: the roller's own next link, working back along its chain from the anchor, and the link the other device revealed at its last hand-over. From that seed the dice come exactly as in a one-device match.
At every hand-over a device reveals the link it used, even if it rolled nothing, so the other side always takes a link it could not have known in advance.
On arrival, a device checks that the record is its own carried forward, that every link hashes back to the anchor published at the start, that each sitting took the right link, and that every die is the one those links give. If any check fails the match carries on, but the result card says "These dice could not be checked."
Finished games in a match are folded away, because Game Center carries 64 KB for a whole match. "Copy the proof" gives both anchors and the record.

So neither device can choose a die, and neither knows a roll before its own sitting begins.

What this does not claim

Published here because a fairness claim with the limits left out is worth less than one with them written down.

The device that creates an online match rolls its first sitting on its own chain alone, because the other device publishes its anchor after seeing that. A tampered copy of the app could try secrets until one gave it a good first sitting. Nothing after that first sitting can be picked.
Within a sitting, a tampered copy could read its own coming roll before deciding whether to double. The app itself never shows it.
A match taken up on another of your own devices has no secret there. It carries on with that device's own dice, and the record says so.
A match begun by a version of the app older than this one keeps each device's own dice, with no joint record.
None of this makes the dice kinder. Fixed in advance and fair are the same thing as random; a bad run is still a bad run.

Questions

Email tavli@dkcreative.uk. If you find a fault in any of this, it is worth telling us and it will be fixed and credited.