6 ms·

Just so we're clear, we're talking about a virtual coin flip here, right? Anything else would require trust. Even if you tried to use an API that checked the sc

by nwah1 8y ago

Just so we're clear, we're talking about a virtual coin flip here, right? Anything else would require trust. Even if you tried to use an API that checked the scores of a sporting event.

detaro 8y ago
yes, it's just a coin flip.
- lawlessone 8y ago
  Now i'm wondering, what is the ratio of odd to even outputs when calculating this? are they perfectly even or is one more likely for each flip?
tylersmith 8y ago
The example is a coin flip but it could be any random based game by using a different algorithm than "number mod 2". You're correct that it can't act on real world data.
- nwah1 8y ago
  Could this be modified to support, say, a chess game?
  - tylersmith 8y ago
    Chess doesn't have any random element so it wouldn't need this kind of system. You could implement card games and board games that do have randomness like candyland. You could implement chess with only movement commitments and no atomic fair random number generation.
    - detaro 8y ago
      Some aspects of it would be interesting for non-random games too, e.g. the payout if one player stops submitting moves, verifying who won, ..
- Retric 8y ago
  More specifically xor 2 initially hidden integers and mod X + 1 gives you a random number from 1 to X. PS: Adding numbers mod X will provide a fair random number as long as at least one side provides a fair random number to start with. Which is a stronger guarantee if your making a real money wager.
  - fyi1183 8y ago
    ... with a bias if X is not a power of 2.
    - deleted 8y ago
      [deleted]
    - Retric 8y ago
      Depends on the maximum range provided. If both part's pick a X bit number then you need a power of 2. If they pick a number 1 to X then can use X.
      - fyi1183 8y ago
        You're right of course. Just remember to use addition mod X instead of xor in that case to combine the choices.
Boulth 8y ago
That has been possible in pure Bitcoin already: https://curiosity-driven.org/bitcoin-contracts#multilottery https://curiosity-driven.org/bitcoin-contracts#multilottery
- JohnJamesRambo 8y ago
  Wouldn't it cost a lot to play though compared to Bitcoin Cash or even Ethereum? https://bitinfocharts.com/comparison/transactionfees-btc-eth-bch.html#3m https://bitinfocharts.com/comparison/transactionfees-btc-eth...
  - xorcist 8y ago
    All your graph says is that those coins are less valuable in terms of USD. Transaction costs are specified by the protocol in satoshis, which is the base unit of Bitcoin. How much you can buy for one satoshi only depends on what people want to pay for it. We call this the coin value. A coin without value is free to transact with. Run your applications on testnet if there are no other considerations.
    - JohnJamesRambo 8y ago
      What are you talking about? That graph is the transaction fee in USD.
- chrispacia 8y ago
  Thanks for sharing that. Didn't know someone else had done it before. Nitpicking a little in that with that scheme the losers could attempt a double spend, but for 2014 it's still pretty cool. Also a very clever hack to get around the scripting limitations by using the length of the secret instead of the actual secret itself.
apo 8y ago
It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. Alice and Bob commit to their rolls by hashing them then making a future spend contingent on revealing the roll that produced the hash. The trick is how to reveal both rolls without giving an advantage to the one who reveals second. This is the problem the protocol solves - through transaction setup and the newly-activated Script opcodes.
- EthanHeilman 8y ago
  >It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. What you are describing is a coin flipping protocol [0]. From the article: >To my knowledge this is the first time someone has proposed such a scheme on Bitcoin though I suppose it's possible it has come up before and I just missed it. There have been coin flipping protocols for Bitcoin since at least 2013-2014 [1]. The main contribution of the above post appears to be that they actually performed the protocol which is neat and quite a bit of work. [0]: https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flipping https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flippin... [1]: Back, Bentov (2014) https://arxiv.org/abs/1402.3698 https://arxiv.org/abs/1402.3698
  - Promarged 8y ago
    This paper [0] (from 2013) linked from this article [1] was also executed on chain, see date here [2] and the actual script via API here [3]. [0]: https://eprint.iacr.org/2013/784 https://eprint.iacr.org/2013/784 [1]: https://curiosity-driven.org/bitcoin-contracts https://curiosity-driven.org/bitcoin-contracts [2]: https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e... [3]: https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188...

by nwah1 8y ago

Just so we're clear, we're talking about a virtual coin flip here, right? Anything else would require trust. Even if you tried to use an API that checked the scores of a sporting event.

detaro 8y ago

yes, it's just a coin flip.

lawlessone 8y ago
Now i'm wondering, what is the ratio of odd to even outputs when calculating this? are they perfectly even or is one more likely for each flip?

tylersmith 8y ago

The example is a coin flip but it could be any random based game by using a different algorithm than "number mod 2". You're correct that it can't act on real world data.

nwah1 8y ago
Could this be modified to support, say, a chess game?
- tylersmith 8y ago
  Chess doesn't have any random element so it wouldn't need this kind of system. You could implement card games and board games that do have randomness like candyland. You could implement chess with only movement commitments and no atomic fair random number generation.
  - detaro 8y ago
    Some aspects of it would be interesting for non-random games too, e.g. the payout if one player stops submitting moves, verifying who won, ..
Retric 8y ago
More specifically xor 2 initially hidden integers and mod X + 1 gives you a random number from 1 to X. PS: Adding numbers mod X will provide a fair random number as long as at least one side provides a fair random number to start with. Which is a stronger guarantee if your making a real money wager.
- fyi1183 8y ago
  ... with a bias if X is not a power of 2.
  - deleted 8y ago
    [deleted]
  - Retric 8y ago
    Depends on the maximum range provided. If both part's pick a X bit number then you need a power of 2. If they pick a number 1 to X then can use X.
    - fyi1183 8y ago
      You're right of course. Just remember to use addition mod X instead of xor in that case to combine the choices.

Boulth 8y ago

That has been possible in pure Bitcoin already: https://curiosity-driven.org/bitcoin-contracts#multilottery https://curiosity-driven.org/bitcoin-contracts#multilottery

JohnJamesRambo 8y ago
Wouldn't it cost a lot to play though compared to Bitcoin Cash or even Ethereum? https://bitinfocharts.com/comparison/transactionfees-btc-eth-bch.html#3m https://bitinfocharts.com/comparison/transactionfees-btc-eth...
- xorcist 8y ago
  All your graph says is that those coins are less valuable in terms of USD. Transaction costs are specified by the protocol in satoshis, which is the base unit of Bitcoin. How much you can buy for one satoshi only depends on what people want to pay for it. We call this the coin value. A coin without value is free to transact with. Run your applications on testnet if there are no other considerations.
  - JohnJamesRambo 8y ago
    What are you talking about? That graph is the transaction fee in USD.
chrispacia 8y ago
Thanks for sharing that. Didn't know someone else had done it before. Nitpicking a little in that with that scheme the losers could attempt a double spend, but for 2014 it's still pretty cool. Also a very clever hack to get around the scripting limitations by using the length of the secret instead of the actual secret itself.

apo 8y ago

It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. Alice and Bob commit to their rolls by hashing them then making a future spend contingent on revealing the roll that produced the hash. The trick is how to reveal both rolls without giving an advantage to the one who reveals second. This is the problem the protocol solves - through transaction setup and the newly-activated Script opcodes.

EthanHeilman 8y ago
>It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. What you are describing is a coin flipping protocol [0]. From the article: >To my knowledge this is the first time someone has proposed such a scheme on Bitcoin though I suppose it's possible it has come up before and I just missed it. There have been coin flipping protocols for Bitcoin since at least 2013-2014 [1]. The main contribution of the above post appears to be that they actually performed the protocol which is neat and quite a bit of work. [0]: https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flipping https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flippin... [1]: Back, Bentov (2014) https://arxiv.org/abs/1402.3698 https://arxiv.org/abs/1402.3698
- Promarged 8y ago
  This paper [0] (from 2013) linked from this article [1] was also executed on chain, see date here [2] and the actual script via API here [3]. [0]: https://eprint.iacr.org/2013/784 https://eprint.iacr.org/2013/784 [1]: https://curiosity-driven.org/bitcoin-contracts https://curiosity-driven.org/bitcoin-contracts [2]: https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e... [3]: https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188...