Inside drand: the internet’s public dice

The problem a beacon solves

Per-player schemes like commit-reveal answer a private question: was my round honest? But some events need one draw that many parties must all trust at once — a lottery, a shared crash round, a leader election in a distributed system. Whoever generates that draw holds power over everyone else, and “trust our server” does not scale past one skeptic.

The beacon answer: make the generator a committee designed so that no member, and no small group of members, can predict or bend the output — then publish every draw for the world to verify. Randomness stops being a service someone provides and becomes a utility everyone shares, like time signals.

How a round works

1. At setup, the members run a distributed key generation: a group public key is created, and each node receives only a *share* of the corresponding private key. The full private key never exists anywhere.
2. Each round, every node signs the round number with its share, producing a partial signature.
3. Any threshold of partial signatures — say, a majority — combines into the group’s single BLS signature for the round. Fewer than the threshold produces nothing at all.
4. That signature is the round’s randomness. BLS signatures are deterministic: for a given round there is exactly one valid value, so nobody chooses it — yet it is unpredictable until enough members cooperate, because predicting it equals forging the group’s signature.
5. Anyone, anywhere, verifies the value against the group public key and the round number. Verification is a signature check — no trust, no account, no permission.

The elegance is worth pausing on: the scheme has no random choices in it. The unpredictability comes entirely from the secrecy of key shares, and the fairness from determinism — one round, one possible value, provable by all. Rounds chain at a fixed cadence, timestamped and archived, so history is as checkable as the present.

Who runs it, who uses it

drand is operated by the League of Entropy, founded in 2019 by a mix of infrastructure companies, universities and research labs — the membership evolves, which is rather the point: the design assumes no permanent trusted operator, only that a threshold of independent institutions won’t collude. The best-known consumer is Filecoin, which draws its leader-election randomness from drand every epoch; lotteries, games and research systems tap the same feed.

For gambling, the fit is specific: beacons shine where many players share one draw — a raffle, a tournament seeding, a communal round. They are a poor fit for solo instant games: a fixed public cadence cannot price a player clicking five rolls a second, and a public value offers no per-player binding the way a client seed does. That is why our originals run commit-reveal per player, and why the four-scheme comparison treats beacons and seed pairs as complements, not rivals.