Additional Constructions to Solve the Generalized Russian Cards Problem using Combinatorial Designs

Abstract

In the generalized Russian cards problem, we have a card deck X of n cards and three participants, Alice, Bob, and Cathy, dealt a, b, and c cards, respectively. Once the cards are dealt, Alice and Bob wish to privately communicate their hands to each other via public announcements, without the advantage of a shared secret or public key infrastructure. Cathy, for her part, should remain ignorant of all * Much of this work appears in the PhD thesis of the first author [28]. but her own cards after Alice and Bob have made their announcements. Notions for Cathy's ignorance in the literature range from Cathy not learning the fate of any individual card with certainty (weak 1-security) to not gaining any probabilistic advantage in guessing the fate of some set of δ cards (perfect δ-security). As we demonstrate in this work, the generalized Russian cards problem has close ties to the field of combinatorial designs, on which we rely heavily, particularly for perfect security notions. Our main result establishes an equivalence between perfectly δ-secure strategies and (c + δ)-designs on n points with block size a, when announcements are chosen uniformly at random from the set of possible announcements. We also provide construction methods and example solutions, including a construction that yields perfect 1-security against Cathy when c = 2. Drawing on our equivalence results, we are able to use a known combinatorial design to construct a strategy with a = 8, b = 13, and c = 3 that is perfectly 2-secure. Finally, we consider a variant of the problem that yields solutions that are easy to construct and optimal with respect to both the number of announcements and level of security achieved. Moreover, this is the first method obtaining weak δ-security that allows Alice to hold an arbitrary number of cards and Cathy to hold a set of c = ⌊ a−δ 2 ⌋ cards. Alternatively, the construction yields solutions for arbitrary δ, c and any a ≥ δ + 2c.

Perfectly secure data aggregation via shifted projections

“…But it may be the case that Eve has a very high probability of guessing correctly who holds c. To this end, [13] introduced the stronger notion of perfect safety, where Eve's perceived probability that an agent holds c does not change after executing the protocol. Perfectly safe solutions for a wider number of cases were later reported in [12], and [8] proposed an approximate notion which led to 'almost-perfectly' safe solutions.…”

“…Let us begin by presenting a solution for a distribution of type (12,2,2). This means that Alice draws twelve cards from a deck of sixteen, while Bob and Cath each draw two cards.…”

A case study in almost-perfect security for unconditionally secure communication

“…There, a distinction is made between weak and perfect security; in perfectly secure solutions, Cath does not acquire any probabilistic information about the ownership of any specific card. All of the above solutions provide weak security in this sense, but Swanson and Stinson show how designs may be used to achieve perfect security, an idea further developed in [11].…”

“…In [11,12], the authors present examples of perfectly secure strategies when Cath has at most 3 cards. Due to the rigidity needed to ensure this level of security, it is not clear whether perfectly secure strategies can be constructed when Cath holds more cards.…”

“…In particular, we will fix ε = 0.05, and use our bounds to find several explicit tuples for which the geometric strategy is ε-safe. It is interesting to compare this to [11], where many choices of parameters for which the protocol is perfectly safe are exhibited. All of the tuples presented there have c ≤ 3, and the authors discuss the difficulty of finding perfectly safe strategies for larger c. As we shall see this becomes substantially simpler if we weaken our requirements to (e.g.)…”