RNG Certification vs. Cryptographic Proof: The Real Gap Between Two Kinds of “Fair”
Open the footer of almost any online poker or card platform and you will likely find an “RNG certified” badge. The badge has real value — but it is routinely misread as “this platform’s fairness has been certified.” This article draws the actual boundary of RNG certification, and measures the gap between it and cryptographic proof.
What RNG certification actually checks
A third-party lab reviews the platform’s random number generator statistically and at the implementation level, typically covering:
- Statistical randomness: output sequences pass a battery of statistical tests, with no detectable bias or periodicity
- Seeding and entropy: where seeds come from and how they are managed
- Shuffle implementation: the shuffling code uses randomness correctly, with no implementation bias
- The code version submitted: all of the above applies to the code as it existed at review time
These checks are professional and meaningful. The problem is what they do not cover.
Four links the certificate does not cover
- Deployment consistency: version A was audited — is version A what runs in production? Certification includes no continuous deployment verification
- The path after generation: between the deck order being generated and reaching players, could middleware, databases, or operations channels read or rewrite it?
- Access control: who can query “the full deck order of the current hand”? Certification does not audit internal privilege governance (see the superuser scandal history — the implicated sites were certified too)
- Player verifiability: in a dispute, can a player independently re-check? A certificate is a report, not a verification tool in players’ hands
In one sentence: RNG certification proves the dice are fair — but the entire pipeline between the dice being rolled and the result being shown still requires trusting the platform.
Which layers cryptographic proof fills in
Verifiable-fairness systems (like the mental poker protocol) replace trust with mathematics precisely where certification is blind:
- Deployment consistency → reproducible builds: anyone can compile the public source into an artifact identical to production
- Path after generation → multiparty encryption: the deck order travels under multiparty encryption; there is no post-generation plaintext to tamper with
- Access control → key dispersal: hole-card decryption material exists only on the receiving player’s device; there is no insider privilege to abuse
- Player verifiability → public verifiers: every hand can be independently re-verified by anyone
How to read a platform’s fairness claims correctly
When you see “certified fair,” ask four questions: What exactly was certified (the RNG, or the whole dealing pipeline)? How does the certified version map to the live version? How easily can a player obtain the full record of a disputed hand? Is there a verification tool independent of the platform? Platforms that can answer all four checkably are rare — which is exactly why Fair Poker publishes its complete verification materials: so that every one of those questions has a “check it yourself” answer.