Five-Card AND Computations in Committed Format Using Only Uniform Cyclic Shuffles

Abstract

In card-based cryptography, designing AND protocols in committed format is a major research topic. The state-of-the-art AND protocol proposed by Koch, Walzer, and Härtel in ASIACRYPT 2015 uses only four cards, which is the minimum permissible number. The minimality of their protocol relies on somewhat complicated shuffles having non-uniform probabilities of possible outcomes. Restricting the allowed shuffles to uniform closed ones entails that, to the best of our knowledge, six cards are sufficient: the six-card AND protocol proposed by Mizuki and Sone in 2009 utilizes the random bisection cut, which is a uniform and cyclic (and hence, closed) shuffle. Thus, a question has arisen: “Can we improve upon this six-card protocol using only uniform closed shuffles?” In other words, the existence or otherwise of a five-card AND protocol in committed format using only uniform closed shuffles has been one of the most important open questions in this field. In this paper, we answer the question affirmatively by designing five-card committed-format AND protocols using only uniform cyclic shuffles. The shuffles that our protocols use are the random cut and random bisection cut, both of which are uniform cyclic shuffles and can be easily implemented by humans.

Card-Based Cryptographic Protocols with Malicious Players Using Private Operations

“…den Boer [2] first showed a five-card protocol to securely calculate logical AND of two inputs. Since then, many protocols have been proposed to realize primitives to calculate any logical functions [14,18,24,37,42,48,49,62,63] and specific computations such as a specific class of logical functions [1,7,13,19,23,25,31,33,43,46,54,58,61,68], universal computation such as Turing machines [6,16], millionaires' problem [27,40,47], voting [32,41,44,69,70], random permutation [8,10,11,39], grouping [9], ranking [66], lottery [64], proof of knowledge of a puzzle solution [3, 5, 12, 21, 26, 28, 29, 50-53, 55-57, 59], and so on. This paper considers calculations of logical functions and a copy operation under the malicious model since any logical function can be realized with a combination of these calculations.…”

“…Section 5 concludes the paper. The difference from the conference version [22] is as follows: (1) We updated all protocols to clarify the procedure to detect malicious actions. (2) We added a new protocol to calculate any n-variable Boolean functions.…”

Graph Automorphism Shuffles from Pile-Scramble Shuffles

“…Indeed, most card-based protocols are constructed with these shuffles only 1 (cf. protocols with RCs only [2,6,7,12,15,17,22,23,32,34,35,40,41,44,48,52], protocols with RBCs only [27-29, 31, 36-38, 45], protocols with PSSs only [3,10,14,33,39,42,43,46], protocols with RCs and RBCs only [1,16,24,51], protocols with RCs and PSSs only [4,8,18,49,50], and protocols with RBCs and PSSs only [11,13,26,47]). With this background, it is essential to study further what can be done by these shuffles.…”