Can a deck of cards be used as a practical source of cryptographic randomness? This is not a duplicate of Entropy measurement from shuffled cards, as this concerns use of cards as a cryptographic entropy source, rather than calculating entropy from some number of cards.


The Solitaire cipher from Cryptonomicon makes use of a deck of cards to encipher messages. However, it is considered insecure, and is likely impractical for actual cryptographic uses.

However, a deck of cards does have a large amount of entropy, and unlike electronically generated randomness, the randomness of a properly shuffled deck is nearly infalliable*. The entropy of a deck of cards is $\log_2(52!)$, or 225.58 bits, which approaches the Landauer limit and is well beyond anything we will ever be able to brute force. On the other hand, the order of a deck of cards is not a stream of bits, and is not easy to quickly process with a computer (a specialized deck reader and shuffler machine will be needed.)

My question is: How can random bits be extracted from a shuffled deck of cards?   Does this have any practical value at all?

So far, I've come up with the following procedure:


  -OCR the deck, producing a string like JH3CAS0D... to represent "Jack of Hearts, 3 of Clubs, Ace of Spades, 10 of Diamonds... and so on".
  
  -Take the SHA-512 hash of this string. For the sake of the example, I came up with:
  bfda311f6e9f6ad06825c9dc07fbbffb98ff86556a8e6fd7ac835b58f0c5eee04155db4e63f748a6c2b0b7c15e558b0e6c7e8222760283869904a2e485ef2d04
  
  -Take the SHA-512 hash of the last 256 bits of the first hash, and append that to the first hash.
  
  -Repeat step 3 as many times as needed to create an infinite stream.


*Barring cases such as improper shuffling or shuffling a default/stacked/known deck only once.
You're asking about a composition of two things:


Choosing a key—or perhaps passphrase—uniformly among $52!$ possibilities by shuffling a deck.  Although the key is not a uniform random bit string, it is uniform random in another space.
Expanding the key $k$ into a large effectively uniform random pad by computing $x_0 = \operatorname{SHA512}(k)$, $x_1 = \operatorname{SHA512}(\operatorname{trunc}(x_0))$, $x_2 = \operatorname{SHA512}(\operatorname{trunc}(x_1))$, etc., and returning $x_0 \mathbin\| x_1 \mathbin\| x_2 \mathbin\| \cdots$.


In the random process of part (1), if you do a good job shuffling then it's a reasonable way to choose a key from a weird space.

But in the deterministic procedure of part (2), it's trivially breakable—i.e., the procedure is not a good pseudorandom generator—because given $x_0$, or any $x_i$, I can perfectly predict the entire remainder of the output.

However, there's other possibilities:


$\operatorname{SHA512}(k \mathbin\| 0) \mathbin\| \operatorname{SHA512}(k \mathbin\| 1) \mathbin\| \operatorname{SHA512}(k \mathbin\| 2) \mathbin\| \cdots$, where the numbers $0, 1, 2, \dots$ are uniquely encoded in fixed width.
$\operatorname{AES}_{k'}(0) \mathbin\| \operatorname{AES}_{k'}(1) \mathbin\| \operatorname{AES}_{k'}(2) \mathbin\| \cdots$, where $k' = \operatorname{SHA512}(k)$.
In general, you could feed a hash $H(k)$ of $k$ to any pseudorandom generator $G$ to get an arbitrarily long effectively uniform random pad, where $H$ is a random oracle or reasonable to model as such like SHA512.  $G$ can be AES in CTR mode, or can be a Keccak duplex, or anything else that has PRG security.




For practical use, the standard way to do things is:


Use a random process—like shuffling a deck of cards and transcribing the order—to arrive at a secret string; the process need not have uniform distribution as long as it has high min-entropy.
Use a standard key derivation function—like HKDF-SHA256—to convert the maybe-nonuniform but high-min-entropy secret string input, together with an optional salt that is unique per user, into a family of effectively uniform keys, labeled by their purpose so that you can use the same secret string input for multiple cryptosystems.
Use standard cryptosystems—like X25519, AES-GCM, HMAC-SHA256—with the resulting keys confident that they are effectively uniformly distributed, in accordance with the security contracts of the cryptosystems.