A zero-knowledge Poker protocol that achieves
confidentiality of the players’ strategy or How to achieve
an electronic Poker face
Claude Cre´peau
De´partement d’informatique et de recherche ope´rationnelle
Universite´ de Montre´al
C.P. 6128 succursale "A", Montre´al
Que´bec, Canada, H3C 3J7
1. Introduction
Many attempts have been previously made to achieve a protocol that would allow
people to play mental poker [SRA, GM1, BF, FM, Yu, Cr] (I would rather say elec-
tronic poker). But no solution has ever come close to reality with respect to poker
strategy. Poker players usually claim that luck has nothing to do with their gains. In
fact, poker is a very strategic game. Often, an inexperienced player will loose a lot of
money when playing against an experienced player, only because the former cannot
hide so easily his emotions. The experienced player can easily know whether his
opponent has a good hand or not.
Electronic poker is an ideal medium to hide one’s emotions. But, unfortunately,
every protocol proposed thus far ruins this perfect poker face since their security is
based on the fact that all hands are revealed at the end of the game. This means that
the strategy of the players is known to all his opponents. In particular, if one bluffs
with a bad hand in the hope that all his opponents will give up, he still has to reveal
his hand at the end, in order to participate in the verification part of the protocol.
Moreover, when a player opens his hand, he does not want his opponents to learn the
moment at which each of his cards was drawn, since this would give them some infor-
mation about his strategy.
This paper proposes a new poker protocol that allows players to keep secret their
strategy. This protocol is an extension of the one given by Cre´peau in [Cr]. The secu-
rity will not be based on the knowledge of the entire deck of card at the end of the
game, but rather on some independent information linked to the entries of the deck.
This protocol achieves every constraints of a real poker game. It is the first complete
solution to the mental poker problem. It achieves all the necessary conditions sug-
gested in [Cr]:

- 2 -
• Uniqueness of cards
• Uniform random distribution of cards
• Absence of trusted third party
• Cheating detection with a very high probability
• Complete confidentiality of cards
• Minimal effect of coalitions
• Complete confidentiality of strategy
2. Review of the protocol in [Cr]
Suppose that P 1,P 2,...,PN want to play poker. Assume a correspondance between
the standard deck of cards and the set {1,2,...,52}. Each Pi will pick a permutation pii
of {1,2,...,52} and keep it secret. The shuffled deck will be piN . . . pi2pi1, i.e.: the func-
tional composition of these permutations. Define DECK ={1,2,...,52}.
To get a card, player Pi picks a value k in DECK that nobody else has picked
before, and will get his card by computing piN . . . pi2pi1(k ). But since the permutations
are kept secret, he will have to use a special trick in order to get this value. To do so,
he may use the Hiding-Revealing protocol proposed in [Cr]. This will allow Pi to get
the values pi1(k ),pi2pi1(k ) up to piN . . . pi2pi1(k ) from his opponents. If everybody was
getting their cards this way, all would be fine. But somebody could cheat by comput-
ing piN . . . pi2pi1(k′ ) for some k′ ∈DECK not owned by him. This way, he may learn
cards which are in the hand of another player or still in the deck. But getting cards
that someone else has already is very bad. Obviously, we cannot tolerate this. Unfor-
tunately the protocol of [Cr] solves this problem by asking every player to disclose
and prove their pii at the end of the game, thus revealing every hands, including those
of players that would not open their hands at the end of a "physical" Poker game.
How can Pi prove that he is getting a card nobody else has (without revealing
this card)? This is the main question addressed (and solved) in this paper.
3. A first idea
To achieve this, we will first change the way by which we check that a player has
been reading the entries he claims in his opponents’ permutations. The main idea is to
add distinct random information to each of the secret values in pi1,pi2,..., piN . This
information will be long enough to be hard to guess. When a player reads an entry in
the permutation of another player, he will have to read the additional information
linked to it. These values will later be publicly revealed by the players, and they all
should be different if nobody is cheating.
Let s be a security parameter to be choosen by the players. Pi choses τi ,j ,
1≤ j ≤i −1, some arrays of size 52 of distinct bit strings of length s . For k ∈DECK ,