I'll start this thread with a simple posting of a sequence of emails between Marty and various levels of management at FT Poker.
****************************************************
I. Initial Query from Marty
[snip]
More than any other competitor's site, there are concerns and
allegations in regards to the fair distribution of hands at Full Tilt
Poker. I was wondering hence, why doesn't Full Tilt Poker publish a 3rd
party hand distribution audit? (see PokerRoom.com)This seems to me a
reasonable thing to do if at least to alleviate concerns in the poker
community.
[snip]
II. Reply from Full Tilt Front Line Support
[snip]
Unfortunately, I do not have the appropriate information available to
properly address your concern regarding our Random Number Generator
verification. That said, I have forwarded a copy of your email to the
appropriate department who will address your concerns. You should
receive a reply from them in the near future.
[snip]
III. Reply from FTP Upper Management
[snip]
The random number generator used by Full Tilt Poker is very robust,
since it uses several redundant and independent sources of entropy. To
generate a 32-bit random number, 3 different 32-bit random numbers are
generated by independent systems and XOR'ed together. XORing a random
value against any other value yields a value just as random as either of
the preceding values. So even if two out of the three sources were
failing to generate sufficiently random values, the final XOR'ed value
will be random provided at least one of the three numbers is random.
This holds so long as the two values are uncorrelated -- if the values
are correlated, the randomness could be cancelled by the XOR operation,
so under this scheme it is critical that all the different values come
from independent sources.
In summary, we use two different pseudo-RNGs plus a physical source.
The three sources are (1) The ISAAC pseudo-rng, (2) the OpenSSL
pseudo-rng, and (3) a hardware rng that has a physical source of
entropy.
As for a third-party independent audit of our shuffling and dealing
processes, we are currently considering our options in that area and
hope to have a related announcement soon.
[snip]
*******************************************************
So, on an initial analysis, a few things are going on. First, Full Tilt is definitely taking the time to respond, rather than sending out the generic, "Everything is fine, and it's all fair and random" form letter. One line from the first email is rather crucial in explaining this new opennes:
[snip]
We do understand that there have been some security scandals associated
to some of our competitors.
[snip]
FTP really does *not* want any of the taint to stain them, so they're giving a peek behind the curtain, and they're even considering an audit. This is all good news.
Now, as to the question of their random number generator (RNG), I have a few comments. I'm surprised to hear they are using software-based pseudo-RNGs (pRNG). The main problem with pseudo-random is that it's *not* random. There was a poker site that went down in flames a few years back when groups of mathematically skilled players learned which algorithm was being used and were able to anticipate the deal.
Here's an article on pRNG's:
http://en.wikipedia.org/wiki/Pseudorand ... _generator
Now, do I think that all those donkeys are clever programmers who anticipate the deal? Not at all. However, pRNG, if it at all relies on inputs from a current state of conditions to generate the next state, may generate future states which do not differ sufficiently from present states to be equivalent to what chance alone might produce.
Ideally, if you insist on using a pRNG, the sequence of an entire deck would be predetermined by the algorithm before any cards hit the table. However, if due to bad programming or some sort of carelessness, future cards falling off the deck are connected in any way at all to the current situation, trends will begin to appear. If donks with a 30% chance to win based on a physical deck of cards begin to win 31% of the time (or more), over millions of hands, people will begin to notice that donks are winning tens of thousands of times more often than they should.
Because of this, most poker sites now rely entirely on sources of true randomness, such as global temperature variations between various weather stations. Truly random bits can only be generated from physical sources, not algorithms. FTP indicates that their third source of bits is a truly random source (but they didn't say what that was).
Now, the FTP representative did say that the three bit sources are combined using XOR (exclusive or, in common language "either tea or coffee or milk") functions to ensure randomness. However, if you have a single true source of randomness, you don't need to combine anything.
I'm now more anxious than ever to hear whether FTP will submit their shuffler to an independent audit. . .