Update 28 Jan 2019: We've reverted to using the original NIST Beacon protocol for the draw.
It has come to our attention that the public source of randomness used to draw the EffectiveAltruism.org donor lottery — the NIST Randomness Beacon — is not currently operating due to the ongoing US government shutdown. This means our regular method of drawing winning numbers is unavailable.
Methodology
There have been several alternative methods suggested for a good public source of randomness. After careful deliberation, we have chosen to use the Incorporated Research Institutions for Seismology (IRIS) list of earthquakes as a randomness source. The data includes a range of numbers that will be impossible to predict in advance, including the latitude, longitude, magnitude, and depth of the earthquake.
We will choose the first earthquake appearing on this list of large earthquakes with a timestamp immediately after the lottery draw date.
Specifically, we will:
- Take the numeric digits in order from the text-formatted response of the IRIS API for the relevant earthquake ID (example response)
- Calculate the SHA256 hash of the resulting string of digits
- Use the first 10 hexadecimal digits of the resulting SHA256 hash as the winning number
We will do the drawing at least 24 hours after the draw date to ensure that IRIS has had time to process incoming data.
There are two lotteries up for drawing ($100k and $500k), currently with draw times staggered by five minutes. In order to ensure there are two separate drawings, we will reset their draw timestamps to be identical, and then use the first two earthquake events appearing on the list after that timestamp as follows:
- First earthquake: $100k donor lottery (ID 63715163508812)
- Second earthquake: $500k donor lottery (ID 63715163508813)
Worked Example
Let’s assume that the donor lotteries in question closed at midnight on January 23, 2019. The two earthquake events immediately after this timestamp are 10998501 and 10998539 respectively.
- The ordered digits from the API response for the first earthquake are
1099850120190123013843145727667721002000743 - The SHA256 hash of these characters is
3914a0a9b27a061c620ee651f417c4d211b218c41c089c96c8b9ad567d8c - The first 10 hexadecimal characters of the hash are
3914a0a9b2, which is245159209394in decimal - Therefore
245159209394is the winning number for the first ($100k) lottery! - Repeating the process for the second number gives a winning number for the second ($500k) lottery of
df4ceccb88/959068294024
Reference implementation
The following bash script illustrates the process for generating the hashes:
#!/bin/bash
# Bash script for calculating the winning lottery number using earthquake
# data from IRIS (Incorporated Research Institutions for Seismology).
#
# Usage:
# ./draw_lottery_iris.sh iris_id
# e.g. ./draw_lottery_iris.sh 10998811
#
# The script works as follows:
# - get the request from the IRIS server for the relevant event
# - trim newlines from the response
# - strip the response to just the numeric digits
# - get the SHA256 hash of the digit string in binary
# - cast the binary hash to a hexdump (only keeping the first line)
# - truncate the hash to its first 10 characters
EVENT_ID=$1
curl -s "http://service.iris.edu/fdsnws/event/1/query?eventid=$EVENT_ID&format=text" \
| tr -d '\n' \
| awk '{gsub(/[^0-9]/,"")}1' \
| openssl dgst -sha256 -binary \
| xxd -p | head -n 1 \
| cut -c -10
Further info
To avoid any more late-breaking changes, we'll commit to using this protocol even in the event that the NIST beacon comes back online before the lottery draw date.
EDIT 28 Jan 2019: The NIST beacon has come back online. Notwithstanding the statement that we would stick with the above protocol, we've decided that it would be best to revert to the NIST Beacon as our source of randomness. That is, the drawing procedure will be as it originally was (as described in the donor lottery's methodology section).
If you have any more questions, please comment below.
Crossposted from the Centre For Effective Altruism blog
The draw should to have the following properties:
This is because, if we generated the number ourselves, or used a private third-party, there's no good guarantees against collusion. Entrants in the lottery could reasonably say 'how do I know that the draw is fair?', especially as the prize pool is large enough that it could incentivise cheating. The future precommitment is important because it guarantees that we can't secretly know the number, and the specific timing is important because it means that we can't just keep waiting for numbers to be generated until we see one that we like the look of.
The method proposed above means that anyone can see how we arrived at the final random number, because it takes a public number that we can't possibly influence, and then hashes it using SHA256, which is well-verified, deterministic (i.e. anyone can run it on their own computer and check our working) and distributes the possible answers uniformly (so everyone has an equal chance of winning).
Typical lottery drawings have these properties too: live broadcast, studio audience (i.e. they are publicly verifiable), balls being mixed and then picked out of a machine (i.e. an easy-to-inspect, uniformly-distributed source of randomness that, because it is public, cannot be gamed by the people running the lottery).
Earthquakes have the nice property that their incidence follows a rough power law distribution (so you know approximately how regularly they'll happen), but the specifics of the location, magnitude, depth or any other properties of any given future earthquake are entirely unpredictable. This means that we know that there will be a set of unpredictable (i.e. random) numbers generated by seismometers, but we (and anyone trying to game the lottery) have no way of knowing what they will be in advance.
(This is not actually that different to how your computer generates randomness — it uses small unpredictable events, like the very precise time between keystrokes, or tiny changes in mouse direction, to generate the entropy pool for generating random numbers locally. We're just using the same technique, but allowing people to see into the entropy pool).
Other plausible sources of randomness we considered included the block hash of the first block mined after the draw date on the Bitcoin blockchain, and the numbers of a particular Powerball drawing.