If you're building a casino slot game destined for any regulated market — Ontario, the UK, Malta, or beyond — your Random Number Generator (RNG) is the single most scrutinized component of your entire system. Getting GLI-11 certification on the first submission isn't luck; it's the result of understanding exactly what test labs expect before you write a single line of RNG code.
At True North Devs, we've achieved first-pass GLI certification on 23 consecutive slot submissions. In this article, our CTO walks through the architecture decisions that make that possible.
What Is GLI-11?
GLI-11 is Gaming Laboratories International's standard for electronic gaming devices, specifically covering the RNG requirements for casino-style games. It defines statistical tests, seed requirements, cycle length minimums, and entropy sourcing rules that your RNG must pass before a game can go live in a certified jurisdiction.
In Canada, AGCO (Alcohol and Gaming Commission of Ontario) requires GLI-approved RNG testing for any slot operating in the Ontario iGaming market. KAHNAWAKE has similar requirements. For studios targeting multiple markets, building your RNG to GLI-11 from day one saves enormous re-certification cost later.
The Four Pillars of a Compliant RNG
1. Entropy Source
Your RNG must be seeded from a source of genuine entropy — not a pseudorandom seed. Acceptable sources include:
- Hardware Security Modules (HSMs) with certified entropy generation
-
OS-level cryptographic entropy pools (
crypto.getRandomValues()in browser environments) - Physical hardware RNG chips for server-side implementations
- Combination of multiple entropy sources (recommended for highest assurance level)
What to avoid: Math.random() in
JavaScript, time-based seeds, or any deterministic source. These
will fail the GLI statistical battery immediately.
2. Algorithm Selection
The most commonly accepted algorithms for GLI-certified slot RNGs are:
- Fortuna CSPRNG — our preferred choice for browser-based slots
- AES-CTR mode — excellent for high-throughput server-side RNG
- ChaCha20 — increasingly accepted by test labs, excellent performance profile
- Mersenne Twister — widely accepted but older; ensure you're using a seeded variant
3. Cycle Length
GLI-11 requires that the RNG cycle (the period before values repeat) must be statistically appropriate for the game type. For video slots, a minimum cycle of 2^32 unique values is typically required. Modern CSPRNGs like Fortuna and AES-CTR have effectively infinite cycles, which simplifies compliance considerably.
4. Statistical Test Battery
Your RNG output will be run through the NIST SP 800-22 statistical test suite (or equivalent). This includes:
- Frequency (monobit) test
- Block frequency test
- Runs test
- Longest run of ones test
- Binary matrix rank test
- Discrete Fourier transform test
- Serial test
- Approximate entropy test
We run this battery internally before submitting to any test lab. Failing a lab submission is expensive — typically $8,000–$15,000 CAD per round — so self-testing is non-negotiable.
Architecture Pattern We Use
For our HTML5 slots, we implement a two-layer RNG architecture:
Layer 1 (Server-Side): An HSM-backed AES-CTR RNG generates the "game outcome" — the full spin result including all reel positions, bonus triggers, and feature outcomes. This result is cryptographically signed and sent to the client.
Layer 2 (Client-Side): The browser receives the signed outcome and renders the animation. The client never generates outcomes — it only presents them. This architecture eliminates any possibility of client-side manipulation.
"The test lab isn't your adversary — they're the last line of defence between your game and a fraudulent actor. Design your RNG to withstand scrutiny, not to pass a checklist." — Priya Nair, CTO, True North Devs
Common Mistakes That Cause Certification Failures
- Using the same seed across multiple game instances
- Reseeding too infrequently (should reseed after every N outputs)
- Logging RNG output in a way that makes outcomes predictable
- Not documenting the RNG architecture in the technical submission package
- Using a shared RNG instance across multiple concurrent players
Conclusion
Building a GLI-certified RNG is entirely achievable with the right architecture choices made early. Use a CSPRNG with genuine entropy, implement server-side outcome generation, and run the NIST battery internally before any lab submission. If you're unsure about any aspect of your RNG design, we offer a standalone math and RNG review service — reach out to discuss.