Mental Poker: The Cryptography of Dealing Fair Cards Without a Dealer

In 1979, two cryptographers (later Turing Award winners) posed a playful question: can two people who don’t trust each other play a fair game of poker over the telephone? No dealer, no referee, no way to see each other — yet nobody must be able to peek or swap cards. Their answer became the “mental poker” protocol — the ancestor of every verifiable dealing system in use today.

The padlock analogy: the core idea in three minutes

Picture a deck where every card goes into a box. The key gadget is a special kind of padlock: one box can carry several locks at once, and they can be removed in any order (mathematicians call this commutative encryption).

• You encrypt: put each of the 52 cards in a box, snap your lock on every box, shuffle the boxes, hand them over
• They encrypt: unable to see inside (your locks are on), they add their own lock to every box and shuffle again
• At this point: every box carries two locks and the order has been scrambled by both of you — neither person knows, or could have chosen, the final order
• Dealing: for the box dealt to you, the other player removes *their* lock (from that box only), then you remove yours — you alone see the card
• Showdown: both sides hand over the keys for the relevant boxes, and anyone can open and check

Cheating finds no foothold: to peek early you lack the other player’s key; to swap a card you’d have to break their lock; to lie about history, every step has been recorded.

From 1979 to today: three things got stronger

The original protocol was a theoretical construction. Its practical arrival owes to three advances:

• Stronger primitives: modern elliptic-curve cryptography makes “commutative locks” both secure and fast — milliseconds in a phone browser
• Commitments and hash chains: every step is sealed before it executes, and hash-chained records turn an entire hand into one verifiable evidence chain
• The browser as a crypto terminal: every modern browser ships secure randomness and cryptography interfaces — everyone now carries their own vault

Fair Poker’s implementation choices

Fair Poker engineers this academic protocol into a playable product: the browser of every seated player encrypts and shuffles the deck in turn; per-card decryption keys go only to the card’s recipient; the relay server transports only signed ciphertext (see can poker sites see your cards?); and the complete transcript of every hand can be re-verified by hand with the public verifier.

Common questions

• Is it fast enough? Multi-party encryption and shuffling of 52 cards is sub-second on modern devices; the bottleneck is usually the network, not computation
• What if someone disconnects? The protocol needs multiple parties, so disconnect recovery is genuinely hard engineering — which is why Fair Poker invests heavily in reconnection and state recovery
• Does it stop collusion? No. Mental poker eradicates dealing-layer cheating; players conspiring off-table is a different problem domain — see the collusion deep-dive