In the generalized Russian cards problem, we have a card deck @math of @math cards and three participants, Alice, Bob, and Cathy, dealt @math , @math , and @math cards, respectively. Once the cards are dealt, Alice and Bob wish to privately communicate their hands to each other via public announcements, without the advantage of a shared secret or public key infrastructure. Cathy should remain ignorant of all but her own cards after Alice and Bob have made their announcements. Notions for Cathy's ignorance in the literature range from Cathy not learning the fate of any individual card with certainty (weak @math -security) to not gaining any probabilistic advantage in guessing the fate of some set of @math cards (perfect @math -security). As we demonstrate, the generalized Russian cards problem has close ties to the field of combinatorial designs, on which we rely heavily, particularly for perfect security notions. Our main result establishes an equivalence between perfectly @math -secure strategies and @math -designs on @math points with block size @math , when announcements are chosen uniformly at random from the set of possible announcements. We also provide construction methods and example solutions, including a construction that yields perfect @math -security against Cathy when @math . We leverage a known combinatorial design to construct a strategy with @math , @math , and @math that is perfectly @math -secure. Finally, we consider a variant of the problem that yields solutions that are easy to construct and optimal with respect to both the number of announcements and level of security achieved. Moreover, this is the first method obtaining weak @math -security that allows Alice to hold an arbitrary number of cards and Cathy to hold a set of @math cards. Alternatively, the construction yields solutions for arbitrary @math , @math and any @math .
Many useful results concerning parameter bounds and announcement sizes for weak 1-security, some of which we use in this paper, are given by @cite_24 . @cite_9 @cite_15 and Cord ' o n- @cite_5 discuss protocols for card deals of a particular form that achieve weak 1-security, using card sums modulo an appropriate parameter for announcements. @cite_16 is the only work of which we are aware that treats security notions stronger than weak 1-security, other than work by Swanson and Stinson @cite_25 and subsequent work by Cord ' o n- @cite_3 .
@cite_9 @cite_3 @cite_24 @cite_5 @cite_15 @cite_16 @cite_25
230082676 2010404638 165070137 1608583290 1643493712 2141368734
Given an interpreted system, we investigate ways for two agents to communicate secrets by public announcements. For card deals, the problem to keep all of your cards a secret (i) can be distinguished from the problem to keep some of your cards a secret (ii). For (i): we characterize a novel class of protocols consisting of two announcements, for the case where two agents both hold n cards and the third agent a single card; the communicating agents announce the sum of their cards modulo 2n + 1. For (ii): we show that the problem to keep at least one of your cards a secret is equivalent to the problem to keep your local state (hand of cards) a secret; we provide a large class of card deals for which exchange of secrets is possible; and we give an example for which there is no protocol of less than three announcements. In the generalized Russian cards problem, the three players Alice, Bob and Cath draw @math a , b and @math c cards, respectively, from a deck of @math a + b + c cards. Players only know their own cards and what the deck of cards is. Alice and Bob are then required to communicate their hand of cards to each other by way of public messages. For a natural number @math k , the communication is said to be @math k -safe if Cath does not learn whether or not Alice holds any given set of at most @math k cards that are not Cath's, a notion originally introduced as weak @math k -security by Swanson and Stinson. An elegant solution by Atkinson views the cards as points in a finite projective plane. We propose a general solution in the spirit of Atkinson's, although based on finite vector spaces rather than projective planes, and call it the geometric protocol'. Given arbitrary @math c , k > 0 , this protocol gives an informative and @math k -safe solution to the generalized Russian cards problem for infinitely many values of @math ( a , b , c ) with @math b = O ( a c ) . This improves on the collection of parameters for which solutions are known. In particular, it is the first solution which guarantees @math k -safety when Cath has more than one card. Two parties A and B select a cards and b cards from a known deck and a third party C receives the remaining c cards. We consider methods whereby A can, in a single message, publicly inform B of her hand without C learning any card held by A or by B. Conditions on a, b, c are given for the existence of an appropriate message. Consider three players Alice, Bob and Cath who hold a, b and c cards, respectively, from a deck of d = a+b+c cards. The cards are all different and players only know their own cards. Suppose Alice and Bob wish to communicate their cards to each other without Cath learning whether Alice or Bob holds a specific card. Considering the cards as consecutive natural numbers 0, 1, . . . , we investigate general conditions for when Alice or Bob can safely announce the sum of the cards they hold modulo an appropriately chosen integer. We demonstrate that this holds whenever a, b > 2 and c = 1. Because Cath holds a single card, this also implies that Alice and Bob will learn the card deal from the other player’s announcement. Public key cryptography bases its security on mathematical problems that are computationally hard to solve. There are also cryptographic protocols wherein discovering the secret is not too complex given the current state of technology, but logically impossible. One approach involves the use of a random deck of cards for such protocols. The messages in the protocol consist of announcements made by the two players attempting to exchange a secret. In that approach one may require that these two players can communicate their holding of cards to each other without the remaining players (eavesdroppers) learning a single card in these holdings. In past work we described combinatorial axioms to achieve that. The eavesdroppers may still be able to make an educated guess about individual card occurrence (card ownership). In this work we focus on overcoming such bias. From the perspective of cryptography there are two ways to do that: either use protocols that produce announcements that are unbiased for card occurrence, or use protocols that ensure that there is no relation between patterns in the announcement, such as card occurrence, and the actual holding. We focus on the first. We devise an additional requirement for the announcement in order to eliminate the possibility of making educated guesses. To that effect we propose an additional combinatorial axiom CA4, and we give a method to design announcements that meet this requirement. Additionally, we present unbiased protocols for incidental cases. We present the first formal mathematical presentation of the generalized Russian cards problem, and provide rigorous security definitions that capture both basic and extended versions of weak and perfect security notions. In the generalized Russian cards problem, three players, Alice, Bob, and Cathy, are dealt a deck of @math cards, each given @math , @math , and @math cards, respectively. The goal is for Alice and Bob to learn each other's hands via public communication, without Cathy learning the fate of any particular card. The basic idea is that Alice announces a set of possible hands she might hold, and Bob, using knowledge of his own hand, should be able to learn Alice's cards from this announcement, but Cathy should not. Using a combinatorial approach, we are able to give a nice characterization of informative strategies (i.e., strategies allowing Bob to learn Alice's hand), having optimal communication complexity, namely the set of possible hands Alice announces must be equivalent to a large set of @math -designs, where @math . We also provide some interesting necessary conditions for certain types of deals to be simultaneously informative and secure. That is, for deals satisfying @math for some @math , where @math and the strategy is assumed to satisfy a strong version of security (namely perfect @math -security), we show that @math and hence @math . We also give a precise characterization of informative and perfectly @math -secure deals of the form @math satisfying @math involving @math -designs.