How to generate a random number so server cannot cheat? Here is the protocol:


Bunch of players connected to server.
Server creates nonce and hashes it - send hash to clients as bit commitment.
Clients make nonces and send hashes to server as their bit commitment.
Unknown to clients one of the clients is the server itself. Server runs through candidate nonces from that client until IT wins game.
Server sends hashes of nonces to all clients. (Clients do not know each other's IP.)
Game is resolved and desired client wins.
Server sends all nonces to clients who verify them, none the wiser.


How do we prevent the server from cheating here, please?
One possibility is the sloth and unicorn approach of this paper.

The idea is essentially to use a slow (but quickly verifiable) hash.  If the sever publishes a commitment to all the shares within a few seconds of the start of the hash computation (which will start at a agreed-to time), and the hash can't be done in less than an hour, then the server can't select its own share to tilt the game in its favor.

The downside, of course, is this is relatively expensive; we're willing to assume that the server will be willing to devote an hour of computation.  For the point of the paper (trusted Elliptic Curve generation), that's reasonable (as you don't do that all often); for other uses, it might not be quite so realistic.