Private Function Evaluation with Cards

Abstract

Card-based protocols allow to evaluate an arbitrary fixed Boolean function $$f$$ f on a hidden input to obtain a hidden output, without the executer learning anything about either of the two (e.g., [12]). We explore the case where $$f$$ f implements a universal function, i.e., $$f$$ f is given the encoding $$\langle P \rangle$$ ⟨ P ⟩ of a program $$P$$ P and an input $$x$$ x and computes $$f(\langle P \rangle , x) = P(x)$$ f ( ⟨ P ⟩ , x ) = P ( x ) . More concretely, we consider universal circuits, Turing machines, RAM machines, and branching programs, giving secure and conceptually simple card-based protocols in each case. We argue that card-based cryptography can be performed in a setting that is only very weakly interactive, which we call the “surveillance” model. Here, when Alice executes a protocol on the cards, the only task of Bob is to watch that Alice does not illegitimately turn over cards and that she shuffles in a way that nobody knows anything about the total permutation applied to the cards. We believe that because of this very limited interaction, our results can be called program obfuscation. As a tool, we develop a useful sub-protocol $${{\mathrm{\mathsf {sort}}}}_{\varPi }{X} {\uparrow } Y$$ sort Π X ↑ Y that couples the two equal-length sequences $$X, Y$$ X , Y and jointly and obliviously permutes them with the permutation $$\pi \in \varPi$$ π ∈ Π that lexicographically minimizes $${\pi }(X)$$ π ( X ) . We argue that this generalizes ideas present in many existing card-based protocols. In fact, AND, XOR, bit copy [37], coupled rotation shuffles [30] and the “permutation division” protocol of [22] can all be expressed as “coupled sort protocols”.

Graph Automorphism Shuffles from Pile-Scramble Shuffles

“…Indeed, most card-based protocols are constructed with these shuffles only 1 (cf. protocols with RCs only [2,6,7,12,15,17,22,23,32,34,35,40,41,44,48,52], protocols with RBCs only [27-29, 31, 36-38, 45], protocols with PSSs only [3,10,14,33,39,42,43,46], protocols with RCs and RBCs only [1,16,24,51], protocols with RCs and PSSs only [4,8,18,49,50], and protocols with RBCs and PSSs only [11,13,26,47]). With this background, it is essential to study further what can be done by these shuffles.…”