Fortuna: A Game-theoretic Protocol to Generate Secret Randomness on the Blockchain

In this work, we consider the problem of decentralized generation of secret random numbers. This is similar to classical random number generation (RNG) on the blockchain, except that the final result should only be known to a particular client. More formally a client, Cassie, requests a secret random number r, kickstarting a decentralized RNG in which anyone on the network can contribute to the creation of r. As in traditional RNG, r should be unpredictable and tamper-proof. However, unlike traditional RNG, r is not publicized and in the end only Cassie will know its value. Additionally, if/when she chooses, Cassie can reveal r and provide a proof that it was indeed produced by our protocol.One of the main applications of secret RNG is to provide efficient and verifiable randomness for online gambling. If Cassie operates a casino, she can request a single secret number each day and use it as a seed for a pseudo-random number generator that determines all betting outcomes. At the end of the day, she can prove that this seed was generated through a decentralized and tamper-proof process, demonstrating that the results were fair and not manipulated.Both RNG and secret RNG have been widely studied in the literature. Existing protocols often allow anyone on the network to contribute an input and then aggregate all inputs together, e.g. using xor, to generate r. This ensures that as long as at least one participant is honest and samples their share from the uniform distribution, r is also uniformly-distributed. While having at least one honest participant has now become a standard assumption in this area, there are no game-theoretic incentives for honesty. In all previous secret RNG protocols, a participant can simply contribute a default value, such as zero, as their input and still receive the same rewards as an honest participant who submits uniform random shares.In this work, we integrate a game-theoretic reward framework into our secret RNG protocol, ensuring that the only equilibrium of the game is when all participants submit uniformly random shares. Thus, honesty is not just assumed but also incentivized.