I have a betting type site where I publish a number (between 0-100) that is encrypted. Then after a period of time, I would review what the number is and prove it with a key to decrypt the encrypted number to prove that I’m not cheating. I also want it to be easily verifiable by an average user.
What encryption algorithm/technique/package should I use?
I’m no expert on cryptography. There seems to be so many options out there and I’m not sure what to use.
python friendly is a plus.
3
Use AES.. see Comparison of DES, Triple DES, AES, blowfish encryption for data for details..
As for ease of use.. refer you users to a Site Like: http://www.everpassword.com/aes-encryptor
You shouldn’t use a cipher at all, but rather a cryptographic hash. If you state that the string hashed is a random 45-character alphanumeric string (with case), followed by a colon, followed by the number: e.g.
cxsFiEUK93Pl3e6bR1i40u7EyJgXQXf0JSejsuIQDcoGL:70
and that the hash is SHA-256, that’s enough for people who know what SHA-256 is to verify it. It’s long enough that no-one will realistically be able to brute force it.
You also need to ensure that your random number source is good, and that’s harder.
3
Conceivably this is a better question for the Stack Exchange Security site, but…
The fact that you have encrypted the number doesn’t prove you aren’t cheating. It just proves you encrypted the number. The question you are asking is called, probably among other things, Mental Poker. The idea is that every party needs to perform some random step and encrypt it.
I included the reference because it can get you started, but for a single random number one might do:
- Alice picks a random number A from 0 to 99 and encrypts it.
- Bob does the same for number B.
- The “real” random number is (A+B) mod 100. This can be verified when both parties reveal their private keys.
You can use any single-key encryption for this simple scheme. You will have to generate lots of keys so they must be created using cryptographically strong key generation.
This scheme isn’t computationally cheap.
You can probably do better for a specific algorithm, but hopefully this answer can get you started. I don’t think any secure scheme will be all that cheap, but it isn’t clear how many of these numbers you need.