♠DexPoker

Zen Focus audio paused

Protocol spec

Decentralized shuffle & deal protocol

DexPoker deals with SRA mental poker — commutative encryption over a shared card set, with threshold key shares and verifiable reveals. There is no dealer process, no house RNG and no server that ever holds the deck order. This page states the protocol, what it guarantees, what it does not, and the exact order of operations from deck setup to the zk showdown.

Selection

Why SRA over VSS shuffles or a zk-shuffle circuit

Three candidate families were evaluated for dealing: SRA-style commutative mental poker, verifiable-secret-sharing deck protocols, and a full zk-SNARK shuffle circuit proving a permutation of re-randomized cards.

  • zk-shuffle circuit — strongest single-round guarantees, but per-shuffle proving is hundreds of milliseconds to seconds in-browser and grows with table size. Too heavy for a 6-max cash table dealing a hand every ~25 s.
  • VSS deck protocols — good abort tolerance, but each seat must handle O(n·52) share traffic per hand and reveals are chatty over WebRTC.
  • SRA (selected) — one modexp pass per card per seat, a few hundred KB total per hand, no trusted setup, and reveals are a single share plus a small equality proof. zk is then applied only where it pays for itself: the showdown.

Net result: dealing costs no gas and no proving system, and the one place where secrecy must survive a public claim — hand rank at showdown — is covered by a small Groth16 circuit instead of a whole-deck one.

Primitive

Commutative encryption in one page

Work in the multiplicative group modulo a large safe prime p agreed per hand. Card m is encoded as a group element; seat i holds a secret exponent ki coprime to p−1. Encryption is exponentiation, so order does not matter:

E_i(m) = m^k_i mod p          D_i(c) = c^(k_i^-1) mod p
E_1(E_2(m)) = m^(k_1*k_2) = E_2(E_1(m))     // commutes

deckCommit = H( sort(cardEncodings) || p || tableId || handNo )

Because the operations commute, seats can strip their own layer in any order. A card becomes readable exactly when every layer above the intended reader has been removed — which is why hole cards, board cards and mucked cards all use the same machinery with different reveal sets.

Flow

From deck setup to showdown

  1. 01

    Table keys & commitment

    Seats exchange session public keys over the state channel, agree on the prime p and the encoding of the 52 cards, and publish deckCommit as part of channel state nonce 0. Buy-ins are already locked in the per-table escrow vault.

  2. 02

    Blind encryption round

    In seat order, each player raises every card to their secret key and shuffles the resulting ciphertexts, then signs a commitment to the new order. After n rounds no one knows any card's position — the deck is the composition of n secret permutations.

  3. 03

    Per-card key split

    Each seat re-encrypts individual cards with per-card keys and publishes only commitments to them, plus t-of-n Shamir shares of those keys, encrypted to the other seats. This is what makes a mid-hand disconnect survivable.

  4. 04

    Hole card dealing

    For the two cards assigned to seat j, every other seat sends its per-card key share directly to j with an equality proof. Seat j strips the layers locally and sees its hand; nobody else can, because their own layer was never removed for them.

  5. 05

    Betting rounds off-chain

    Check / bet / call / raise / fold are signed channel updates with a monotonic nonce over (stacks, pot, bets, deckCommit, street). Zero gas, sub-100 ms target latency, every action countersigned by the active quorum.

  6. 06

    Board reveals

    Flop, turn and river are opened by publishing all key shares for those specific cards. Each share is verified against its commitment, so a forged share is rejected before the board updates. A burn card's shares are never published.

  7. 07

    Showdown claim (zk)

    Instead of dumping hole cards, each remaining player posts a Groth16 proof: “my two committed hole cards plus the public board contain a 5-card hand of rank R.” Peers verify locally in a few milliseconds. Losers can muck — they prove a lower rank without exposing cards.

  8. 08

    Settlement

    The winning state is signed by the quorum and sent to the escrow contract, which pays the net pot to the winner and splits rake 33% affiliate / 33% rakeback / 34% treasury in the same transaction. All per-card keys are then published so anyone can audit the full hand afterwards.

Guarantees

What the protocol actually promises

Deck secrecy

enforced

No party — player, relay or platform — learns a card it is not entitled to.

Each card stays under the product of all n player keys; a single missing key share keeps the ciphertext information-theoretically useless for that seat.

Shuffle unpredictability

enforced

No coalition smaller than all n seats can predict or bias the final deck order.

Permutations compose: the final order is the composition of every seat's secret permutation, so one honest shuffler is enough to randomize the whole deck.

Deck integrity

enforced

Nobody can inject, duplicate or remove a card mid-hand.

The initial 52-card multiset is hash-committed; every re-encryption round publishes a commitment, and each reveal is checked against the committed set.

Non-equivocation

enforced

A player cannot show one deck state to seat A and another to seat B.

Every round commitment is signed and folded into the state-channel nonce chain, which all seats countersign.

Verifiable reveal

enforced

A revealed key share provably belongs to the committed ciphertext.

Each share ships with a Chaum–Pedersen style equality-of-discrete-log proof, so a wrong share is rejected instead of corrupting the board.

Fair abort

enforced

Quitting or stalling never lets an attacker profit.

Threshold (t-of-n) key shares let remaining seats finish the hand; the stalled seat is force-folded on its signed action clock and its escrow stays in the pot.

Threat model

What it does not solve

  • Collusion by chat. Cryptography cannot stop two humans sharing their own cards out of band. Mitigation is behavioural: seat-pair VPIP analysis, randomized seating and shared-IP flags.
  • Bots. A provably fair deal says nothing about who is acting. Mitigation is rate/pattern analysis and stake-tiered friction, not the deal protocol.
  • Full n-party collusion. If every other seat colludes, your hole cards are known — an inherent bound of any n-of-n mental poker scheme.
  • Traffic metadata. The relay sees ciphertext only, but timing can leak tells; actions are padded and jittered to blunt this.
Budget

Cost per hand (6-max)

  • Shuffle: 6 encryption rounds × 52 modexps ≈ 312 modexps per seat, ~40 ms in a WASM worker.
  • Traffic: ~180 KB per hand per seat including shares and proofs, all off-chain.
  • Showdown: one ~1.2 kB proof per contender, < 300 ms proving, < 10 ms verify.
  • On-chain: 0 transactions in the happy path until a single settlement call at hand end.