A possible method for safe random number in lotteries

Question

In the case of the lottery a seed provided to the function that uses block hash can be used to remove the interference from all the parties (miners and house).

The seed is selected by the 'house' previous to the beginning of the lottery. The house encrypts it and provides a public key for it. When the block at which the lottery plays is reached, the house uses the seed (known only to the house until that point) and the blockhash to calculate the random number. The house publishes the private key allowing the seed word to be decrypted so that everyone who wishes can verify the process.

In this approach: The miners can influence the blockhash but not the seed. The house knows the seed but not the blockhash The ticket holders can verify the seed.

Other than that, the blockhash should work perfectly fine for random number generation in anything else.

Any objections to this?

Answer 1

There are two things to think about with this sort of approach:

1. Consider the Sybil attack where the miner and the "house" are the same entity (or otherwise colluding).
2. Consider the possibility of the "house" refusing to reveal the seed.

The latter can probably be taken care of via some deposit that's forfeited (and distributed to other participants?) if the seed isn't revealed, but be careful to think through how big the deposit has to be to protect against Sybil attacks where the "house" is also another type of participant (e.g. a bettor with a large wager).

This general approach is known as a commitment scheme, and the way I typically see it implemented in Ethereum is with hashing, not encryption. The "house" commits to a seed by publishing its hash to the smart contract. When it's time, the "house" then reveals the seed by publishing it to the smart contract, which can easily verify keccak256(seed) == commitment.