Towards Verifying Physical Assumption in Card-Based Cryptography

Abstract

Card-based cryptography realizes cryptographic tasks, such as secure computation, with a deck of physical cards. The primary research subjects for card-based cryptography are theoretical studies that, for example, propose efficient protocols regarding the number of required cards and procedures. However, almost all prior studies are based on the ideal physical assumption that the backs of all cards are indistinguishable without verification. This study addresses this assumption from a physical perspective to improve the security of card-based cryptography. In the first attempt, we assume a strong attacker who uses ink and a high-performance camera to distinguish the backs of the cards. We experimented with them and confirmed that such an attacker could identify the inked area of the back by analyzing an image captured by the camera. Based on our study, one can address another approach, such as using invisible oil and smartphone cameras to verify the physical assumption. This study is a seminal work that addresses this physical assumption. In addition to the verification, we study secret information that such a strong attacker can obtain during the execution of card-based protocols.

A Theoretical Considerations for Attacks

In Sect. 4, we confirmed that attacks using ink and the hyperspectral camera are possible. This appendix selects the five-card trick [3] and MS-AND [15] as examples and clarifies that such an attack leaks information about input values.

1.1 A.1 How to Execute the Protocol

The basic setup is described in Sect. 1. We use two colored cards: and . A player uses these two cards to encode Boolean values as follows:

When two face-down cards represent a bit $x\in \{0,1\}$ based on this encoding, we call these cards a commitment to x and denote it as follows:

In the five-card trick and MS-AND, Alice and Bob place commitments to $a,b\in \{0,1\}$ on the table, respectively, and use additional cards to obtain only the value of $a\wedge b$.

The five-card trick uses an additional card . First, the commitment to $\overline{a}$ and b are lined up⁵. The additional face-down card is then placed between the two commitments. Note that the three consecutive cards in the middle are reds if and only if $a=b=1$. Subsequently, a cyclic shuffling operation called random cut is performed to randomize the order, and all five cards are finally turned over. Here, we have $a\wedge b=1$ if the three reds are consecutive apart from the cyclic shift; otherwise, $a\wedge b=0$ as follows:

In the MS-AND, we place an additional commitment to 0 between the two commitments as follows:

First, the second card from the left and the two cards in the middle are swapped. Second, a shuffling operation called a random bisection cut is applied to the sequence; that is, the left and right halves are swapped randomly. The second and third cards are then replaced with the fourth card. Finally, the first two cards are revealed, and a commitment to $a\wedge b$ can be obtained as follows:

1.2 A.2 Information Obtained from This Attack

Recall that the assumed attacker can identify the inked card. Because every player privately manipulates its commitment before starting a protocol, we consider an attacker who secretly inks their own commitment. Let us consider information that the attacker can gain in the two protocols presented previously.

In the five-card trick [3], if both players input commitments to 1, they can quickly determine that the other’s input is 1 from the output value. Consider whether information about the other’s input can be obtained if the attacker inputs a commitment to 0. We focus on the sequence of cards after shuffling, namely, the following five sequences:

If one knows the position of one’s commitment, the value of the other’s commitment can be derived because all the cards are revealed. In summary, if we know which card we have placed, we can always obtain the value of the other’s input in the five-card trick.

In the MS-AND [15], however, we found that information gained by an attacker depends on their position. First, we consider the case where Alice is an attacker. Assume that Alice inputs a commitment to 0 and always knows the location of her . Here, if we denote by all the cards other than her when obtaining the output commitment, the sequence is as follows:

However, to obtain the output commitment, we reveal the two cards on the left. Thus, even if Alice knows the location of her commitment, she obtains no information about Bob’s input.

However, Bob can obtain Alice’s input value under the same conditions because the sequence when obtaining the output commitment is as follows:

To obtain the output commitment, the two cards on the left are revealed, which represent a or $\overline{a}$. Knowing the position of Bob’s , he can determine whether the two cards represent a or $\overline{a}$. If his is in the fourth and the first two revealed cards are , the two cards represent $\overline{a}$ and Bob has $a=1$. Thus, Bob can obtain Alice’s input, which holds even if the card to be marked is .

It is interesting to discuss why such asymmetry arises, that is, the attack effectiveness changes depending on the protocols, and to elucidate the condition for such asymmetry. In the case of the MS-AND [15], the reason is clear because the two revealed cards before obtaining the output commitment is either a commitment to a or $\overline{a}$ because of the shuffle applied previously. Thus, Alice gains no information even if her commitment is marked by her. However, this property is specific to the MS-AND, and a card-based protocol often reveals one of the attacker’s commitment, the other’s commitment, and additional cards (e.g., [1, 17]); hence, the condition for such asymmetry is not trivial. To discover this, we need to study many card-based protocols, classifying cards possibly revealed in a protocol and clarifying whether an attacker can gain information about the other’s input value; we will leave this in our future work.

1.3 A.3 Discussion

We discuss whether this attack is realistic. Although our study revealed that the inked areas could be identified as indicated in Sect. 3, this attack is limited because it uses a high-cost camera of over $10,000. We plan to investigate the use of cameras in smartphones because they are widely available. In addition, conducting this attack during the execution of protocols is impossible without another player noticing because a halogen lamp must be prepared in this attack. This attack will be feasible at the end of the protocol. That is, an attacker remembers the order of the sequence of cards at the end and then conducts this attack without the other players watching it. One might think that this attack is infeasible because all cards are completely shuffled at the end of any card-based protocol to prevent leakage of information. However, no card-based protocol shuffles face-up cards at the end because they simply indicate either the output value, such as the five-card trick [3] or the following action, such as the MS-AND [15] (cf, [22]). Thus, this attack implies a new insight that all cards, including face-up cards, should be shuffled after the end of any card-based protocol.

Based on the experimental results, countermeasures against this attack include making the backs black and white, which have a unique reflection ratio and making the mesh of the backs finer. To physically prevent ink from adhering to the cards, the cards can be covered with sleeves.