How a phone, a laptop and a relay produce one random value

Whenever one party chooses a random value, that party can try candidates until it likes the outcome. A ceremony removes the single choice: nobody picks the value, everybody contributes a piece of it, and the pieces are locked in before any of them is shown.

The same instinct behind dealing cards face down: the deal is only fair if nobody has seen another player's hand before betting. Commitments are the face down part, reveals are the showdown, and the next eight steps draw both.

Three participants on three different kinds of device each generate a fresh secret locally: s₁ on the phone, s₂ on the laptop, s₃ on the hardware signer. None of the three secrets leaves its device in this step, and none of the three participants can guess another's.

Different device classes matter for the trust argument. A hardware signer's secret is hard to extract even by its owner, a laptop's is as safe as its owner's hygiene, and a phone sits in between. Step 8 asks who these three are; for now they only need to be three, and mutually suspicious.

Each participant computes commitment = SHA-256(secret) and shows it as a QR code on its own screen. The commitment reveals nothing about the secret, but it binds the participant to it: once shown, the secret is fixed, and a later reveal that does not match the commitment is visible to everyone.

A hash function alone makes the commitment hiding, but not binding against a participant who computes commitments for several secrets and reveals whichever is convenient afterwards. Closing that gap needs the ceremony's choreography, and step 4 is where the choreography starts: an order is agreed before any secret moves.

A coordinator has to exist somewhere: the three devices are not on one network, and QR codes need collecting in an agreed order. The relay's entire diet is the three commitment hashes. It never holds a secret, cannot name any secret, and cannot change any commitment it has acknowledged.

This panel is the design boundary and the page's most important label. The relay is drawn as what a coordinator for this protocol could be, and never as an AINumbers service. Its trust burden is deliberately small: it orders messages and serves the list, and every value it touches is public the moment it arrives. If it disappears, participants can hold the ceremony again; nothing it saw helps it or anyone it reports to predict the joint value.

The relay publishes the full commitment list. Each participant now reveals its secret, and anyone can check each reveal against the commitment from step 3. The order is the protection: committing before anyone reveals removes the option to choose a secret after seeing someone else's.

Step 7 is named after what can still go wrong here, and the frank answer is: one thing. The choreography removes every advantage except position, and position is exactly what the last revealer holds. First, the value itself.

With all secrets revealed, the joint value is SHA-256(s₁ ‖ s₂ ‖ s₃). The computation needs no permission and no equipment beyond the transcript: every input is public, so every reader gets the same 256 bits. Illustrative and truncated here, as everywhere on this page.

Why one secret kept is enough: the joint hash is a function of all three secrets, and hash outputs cannot be worked backwards. If even one secret was drawn privately on its own device and never leaked before its reveal, the combined output is unpredictable to everyone outside that device, no matter what the other two did. Predictability would require predicting that one secret.

The last participant to reveal sees every other secret first, so it can compute the joint value before deciding whether to publish its own. If it dislikes the value, it can walk away and withhold the reveal. This is the one move a bad actor still has that the choreography cannot remove, and the ceremony answers it with cost rather than with impossibility.

Said plainly: the ceremony guarantees unpredictability while one participant keeps its secret. It does not guarantee that a round completes. What keeps the last revealer from aborting a second time is that its commitment is public and attributable, the failed round is public, and a participant that aborts whenever the value displeases it identifies itself as the saboteur over repeated ceremonies. Protocols in this family add economic stakes, where an abort forfeits a deposit, but a deposit is an application decision rather than a property of the hashing.

The ceremony is strongest when the participants have no common interest and cannot reach each other to collude. One selection design: participants are drawn by region and by authentication type, so the three secrets come from a phone in one region, a hardware signer in another and a laptop in a third, with no channel besides the relay.

This is the design that would matter if the joint value ever protected something of value: any single stranger who plays straight is enough, and a briber must find and corrupt a specific anonymous participant before the reveal window closes, in a region it may not operate in, on a device class it cannot easily extract. The randomness of the selection is itself part of the guarantee, which is why a ceremony's participant list is published with the same care as its output.

What the estate does today, what it does not, and where this design would sit if it were ever wanted.