Thimbly's trust rests on two zero-knowledge proofs. A zero-knowledge proof lets one side convince the other that a statement is true while revealing nothing else. Both of Thimbly's proofs — πA and πB — are built from one idea: a proof of OR.
An OR-proof establishes “at least one of these N statements is true” — without revealing which. The trick: you genuinely prove the single statement you hold a secret for, and for the others you produce proofs that look every bit as convincing but are simulated. A shared challenge ties them into one bundle, so the verifier is convinced the disjunction holds yet can't tell the real branch from the fakes.
That “hidden which” is the whole point. It lets each side prove they're playing honestly without giving away the one secret — the guess, or the winning thimble — that would spoil the game.
You pick one of the N thimbles. πB is your OR-proof that your claim is correctly built from exactly one real thimble — a single, genuine guess, not a fake or a hedge across several. Because it's an OR over all N, which thimble you chose stays secret. That matters twice: the dealer can't see your guess and adapt to it, and your choice stays private.
The dealer hides the ball under one thimble and encodes the payout so the key that decides the outcome is forced onto the chain when the pot is paid. πA is her OR-proof that exactly one thimble is the genuine winner, honestly encoded — she hasn't rigged it so you can't win, and she can't collect without publishing that deciding key. Again it's an OR over all N, so which thimble wins stays hidden until the reveal — otherwise there'd be no game.
This is the plain-language version. The exact constructions — the algebraic relation behind πA, and the sigma-protocol machinery underneath both — are in the protocol paper and the source.
← Back to Thimbly