Our secret number (seed)
Made when the lottery goes on sale; only its fingerprint (hash) is published. Changing the number later would change the fingerprint, so it cannot be swapped.
Published when sales open
Loading…
Every lottery winner comes from three things together. All three are public, so you do not have to trust us — you can recompute the winner yourself.
Made when the lottery goes on sale; only its fingerprint (hash) is published. Changing the number later would change the fingerprint, so it cannot be swapped.
Published when sales open
Every sold number is locked and the list's hash is published. No ticket can be added or removed after that. Anyone can download the list (numbers only).
Locked when sales close
A public random number from drand. Which round is used is announced in advance — but nobody can know that number before it comes out.
Comes out at the ceremony
The key point: when the list locks, the drand number does not exist yet. So at that moment nobody knows who will win, and afterwards nobody can change it.
drand is a public randomness service run together by more than a dozen organisations around the world — Cloudflare, the Swiss university EPFL, Protocol Labs, Kudelski Security, the University of Chile and others. Since 2020 it has published one numbered random value every 30 seconds, free for anyone.
Think of a safe with many keys: one secret key is split among the organisations, and a value only comes out when most of them sign together.
drand right now
…
A new number every 30 seconds, fetched by your browser straight from drand.
See it on drand.loveNo. The drand number only comes out after the list is locked, and nobody knows it before. Once the list is locked, the system itself blocks adding or removing tickets, cancelling and postponing.
A second lock. Even if every drand organisation colluded, they would not know our secret number, so they could not know the winner in advance. And our number was fixed when sales opened, so we cannot use it either.
The announced round's value is fixed in advance. When the network is back, exactly that value comes out — the ceremony waits for it and never switches to another number.
No. The system does not let staff accounts buy tickets.
winner = tickets[ unbiased( HMAC-SHA256( seed, "shosha-lottery-v1:" + lotteryId + ":" + R + ":" + drand + ":" + listHash ), N ) ]
tickets — the sold numbers at the lock, ascending (N of them); listHash = sha256 of the list. unbiased — rejection sampling over the digest's 32-bit chunks, so every ticket has exactly 1/N; the same method as the box rolls.
drand mainnet (chained BLS12-381), one round every 30 s; round R is the first one at or after the ceremony time.