Practical and Easy-to-Understand Card-Based Implementation of Yao’s Millionaire Protocol

Abstract

Yao’s millionaire protocol enables Alice and Bob to know whether or not Bob is richer than Alice by using a public-key cryptosystem without revealing the actual amounts of their properties. In this paper, we present a simple and practical implementation of Yao’s millionaire protocol using a deck of playing cards; we straightforwardly implement the idea behind Yao’s millionaire protocol so that even non-experts can easily understand its correctness and secrecy. Our implementation is based partially on the previous card-based scheme proposed by Nakai, Tokushige, Misawa, Iwamoto, and Ohta; their scheme admits players’ private actions on a sequence of cards called Private Permutation (PP), implying that a malicious player could make an active attack (for example, he/she could exchange some of the cards stealthily when doing such a private action). In contrast, our implementation relies on a familiar shuffling operation called a random cut, and hence, it can be conducted completely publicly so as to avoid any active attack.

Appendices

A The Six-Card and Protocol

In 2009, Mizuki and Sone [13] invented the following six-card AND protocol, which securely outputs a commitment to $x\wedge y$ from the commitments to x and y (and two additional cards).

• 1. Place input commitments and additional cards of black and red, and then turn over the two cards in the center:

  

• 2. Rearrange the sequence:

  

• 3. Apply a random bisection cut, which means bisecting the sequence and switching the two halves randomly:

  

  After applying this shuffling operation, the six-card sequence results in either the same sequence as the original one or a sequence whose left and right halves are switched; each case occurs with a probability of 1/2.

• 4. Rearrange the sequence:

  

  After this rearranging operation, the six-card sequence will be as follows:

  

• 5. Reveal the first two cards. Then, a commitment to $x\wedge y$ can be obtained as:

  

  Note that we can reuse the two revealed two cards, and moreover, the other two cards not being a commitment to $x\wedge y$ can be reused by revealing them after shuffling.

As mentioned above, we can obtain a commitment to $x\wedge y$ (keeping its value secret). It is well known that in the literature [20], a random bisection cut can be implemented by humans securely so that nobody knows the resulting card sequence.

An OR protocol can be obtained in a similar way.

B The Six-Card COPY Protocol

The following six-card COPY protocol proposed by Mizuki and Sone [13] produces two commitments to x from a commitment to x and four additional cards.

• 1. Place an input commitment and black and red additional cards, and then turn over the additional cards:

  

• 2. Rearrange the sequence:

  

• 3. Apply a random bisection cut:

  

• 4. Rearrange the sequence:

  

• 5. Reveal the first two cards. Then, two commitments to x can be obtained as follows (two revealed cards can be reused in the next protocol):

  

  In the latter case, we can easily get two commitments to x (from commitments to $\bar{x}$) by using the NOT protocol (swapping the two cards of each commitment).