I am making an online poker server in NodeJS. Currently, the state of the game is being sent to each client. So using debugging tools a client can see all the other player's card IDs. I would like to send the game state but modify it so that player card ID's are represented in ciphertext.

What kind of encryption protocol/scheme/library can I use to encrypt a player's cards so that the client can only read their own cards until a card is revealed to everybody in which case the card ID will then be sent in plaintext?

For example, a player's hand might be ['Ah', 'Kh'] which represents he is holding the Ace of Hearts and King of Hearts. Instead it should probably be encrypted to something like ['xxxxxxxx', 'xxxxxxxx'] unless the client is able to decrypt the hand.


Always assume that the client is compromised. Never trust the state on the client. Never send to the client any information that it has no business seeing.

Encrypting is pointless. If the client can somehow decrypt the state of other hands, assume the client will do it. If it cannot decrypt it, you could as well not send it.

Keep the game state on the server, and give every client only the server's view of the client's hand and the public game state, for display purposes only. The client can send you the move it makes, you update the state on the server, and send it back.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.