Combinatorial solutions providing improved security for the generalized Russian cards problem

Abstract

We present the first formal mathematical presentation of the generalized Russian cards problem, and provide rigorous security definitions that capture both basic and extended versions of weak and perfect security notions. In the generalized Russian cards problem, three players, Alice, Bob, and Cathy, are dealt a deck of n cards, each given a, b, and c cards, respectively. The goal is for Alice and Bob to learn each other's hands via public communication, without Cathy learning the fate of any particular card. The basic idea is that Alice announces a set of possible hands she might hold, and Bob, using knowledge of his own hand, should be able to learn Alice's cards from this announcement, but Cathy should not. Using a combinatorial approach, we are able to give a nice characterization of informative strategies (i.e., strategies allowing Bob to learn Alice's hand), having optimal communication complexity, namely the set of possible hands Alice announces must be equivalent to a large set of t − (n, a, 1)-designs, where t = a − c. We also provide some interesting necessary conditions for certain types of deals to be simultaneously informative and secure. That is, for deals satisfying c = a − d for some d ≥ 2, where b ≥ d − 1 and the strategy is assumed to satisfy a strong version of security (namely perfect (d − 1)-security), we show that a = d + 1 and hence c = 1. We also give a precise characterization of informative and perfectly (d − 1)-secure deals of the form (d + 1, b, 1) satisfying b ≥ d − 1 involving d − (n, d + 1, 1)-designs. * D. Stinson's research is supported by NSERC discovery grant • We distinguish between deterministic strategies, in which the hand H A held by Alice uniquely determines the index i that she will broadcast, and non-deterministic, possibly even biased announcement strategies. We are especially interested in strategies with uniform probability distributions, which we will refer to as equitable.n−a+c c different announcements. However, there are a total of n−a+c c announcements, so every announcement must contain a block that contains X ′ .An optimal (3, 3, 1)-strategy would have m = 5. From Theorem 2.4, the existence of such a strategy would be equivalent to a large set of five STS(7). As mentioned above, it is known that this large set does not exist. However, from Example 1.1, we obtain a (3, 3, 1)-strategy for Alice with m = 6 that is informative for Bob. Thus we have proven the following.Theorem 2.5. The minimum m such that there exists a (3, 3, 1)-strategy for Alice that is informative for Bob is m = 6.

A geometric protocol for cryptography with cards

“…Stronger notions of security are studied by Swanson and Stinson in [14]. There, a distinction is made between weak and perfect security; in perfectly secure protocols, Cath does not acquire any probabilistic information about the ownership of any specific card.…”

“…How much is too much depends on a parameter we shall usually call k and states that, given X ∈ D k , it is possible from Cath's perspective that X ⊆ A and also possible that X ⊆ A. This is the notion of weak k-security from [14]; we simply call it k-safety. π for (a, b, c) and A ∈ D a , an announcement A ∈ π(A) is k-safe if for every deal (A, B, C) and every nonempty set X with at most k elements such that X ∩ C = ∅ there is a deal 2 Our presentation follows that given in [14].…”

“…This is the notion of weak k-security from [14]; we simply call it k-safety. π for (a, b, c) and A ∈ D a , an announcement A ∈ π(A) is k-safe if for every deal (A, B, C) and every nonempty set X with at most k elements such that X ∩ C = ∅ there is a deal 2 Our presentation follows that given in [14]. Compare to [15,1], where informative for (A, B, C) is defined as follows: Given a deal (A, B, C), an announcement A containing A is informative for (A, B, C) if for any A ∈ A and any (A , B , C ), there is only one X ∈ A such that X ⊆ A ∪ C .…”

“…In such information-exchanging protocols between Alice and Bob, Cath typically acquires quite a bit of data, but not enough to be able to deduce any secrets. Many protocols have been proposed [1,2,14], and cryptography based on card deals is also investigated in other settings [5,11,12], yet it remains unknown exactly for which triples (a, b, c) the problem can be solved.…”

“…This geometric protocol solves the generalized Russian cards problem in many instances that were previously unsolved. Also, it employs a stronger notion of security than is often considered, which we call k-safety and is equivalent to weak k-security in [14].…”