Mental poker is the common name for a set of cryptographic problems that concerns playing a fair game over distance without the need for a trusted third party. The term is also applied to the theories surrounding these problems and their possible solutions. The name comes from the card game poker which is one of the games to which this kind of problem applies. Similar problems described as two party games are Blum's flipping a coin over a distance, Yao's Millionaires' Problem, and Rabin's oblivious transfer. The problem can be described thus: "How can one allow only authorized actors to have access to certain information while not using a trusted arbiter?" (Eliminating the trusted third-party avoids the problem of trying to determine whether the third party can be trusted or not, and may also reduce the resources required.) In poker, this could translate to: "How can we make sure no player is stacking the deck or peeking at other players' cards when we are shuffling the deck ourselves?". In a physical card game, this would be relatively simple if the players were sitting face to face and observing each other, at least if the possibility of conventional cheating can be ruled out. However, if the players are not sitting at the same location but instead are at widely separate locations and pass the entire deck between them (using the postal mail, for instance), this suddenly becomes very difficult. And for electronic card games, such as online poker, where the mechanics of the game are hidden from the user, this is impossible unless the method used is such that it cannot allow any party to cheat by manipulating or inappropriately observing the electronic "deck". Several protocols for doing this have been suggested, the first by Adi Shamir, Ron Rivest and Len Adleman (the creators of the RSA-encryption protocol). This protocol was the first example of two parties conducting secure computation rather than secure message transmission, employing cryptography; later on due to leaking partial information in the original protocol, this led to the definition of semantic security by Shafi Goldwasser and Silvio Micali. The concept of multi-player mental poker was introduced in Moti Yung's 1984 book Cryptoprotocols. The area has later evolved into what is known as secure multi-party computation protocols (for two parties, and multi parties as well).
Shuffling cards using commutative encryption One possible algorithm for shuffling cards without the use of a trusted third party is to use a commutative encryption scheme. A commutative scheme means that if some data is encrypted more than once, the order in which one decrypts this data will not matter. Example: Alice has a plaintext message. She encrypts this, producing a garbled ciphertext which she gives then to Bob. Bob encrypts the ciphertext again, using the same scheme as Alice but with another key. When decrypting this double encrypted message, if the encryption scheme is commutative, it will not matter who decrypts first.
The algorithm An algorithm for shuffling cards using commutative encryption would be as follows:
Alice and Bob agree on a certain "deck" of cards. In practice, this means they agree on a set of numbers or other data such that each element of the set represents a card. Alice picks an encryption key A and uses this to encrypt each card of the deck. Alice shuffles the cards. Alice passes the encrypted and shuffled deck to Bob. With the encryption in place, Bob cannot know which card is which. Bob picks an encryption key B and uses this to encrypt each card of the encrypted and shuffled deck. Bob shuffles the deck. Bob passes the double encrypted and shuffled deck back to Alice. Alice decrypts each card using her key A. This still leaves Bob's encryption in place though so she cannot know which card is which. Alice picks one encryption key for each card (A1, A2, etc.) and encrypts them individually. Alice passes the deck to Bob. Bob decrypts each card using his key B. This still leaves Alice's individual encryption in place though so he cannot know which card is which. Bob picks one encryption key for each card (B1, B2, etc.) and encrypts them individually. Bob passes the deck back to Alice. Alice publishes the deck for everyone playing (in this case only Alice and Bob, see below on expansion though). The deck is now shuffled. This algorithm may be expanded for an arbitrary number of players. Players Carol, Dave and so forth need only repeat steps 2-4 and 8-10. During the game, Alice and Bob will pick cards from the deck, identified in which order they are placed in the shuffled deck. When either player wants to see their cards, they will request the corresponding keys from the other player. That player, upon checking that the requesting player is indeed entitled to look at the cards, passes the individual keys for those cards to the other player. The check is to ensure that the player does not try to request keys for cards that do not belong to that player. Example: Alice has picked cards 1 to 5 in the shuffled deck. Bob has picked cards 6 to 10. Bob requests to look at his allotted cards. Alice agrees that Bob is entitled to look at cards 6 to 10 and gives him her individual card keys A6 to A10. Bob decrypts his cards by using both Alice's keys and his own for these cards, B6 to B10. Bob can now see the cards. Alice cannot know which cards Bob has because she does not have access to Bob's keys B6 to B10 which are required to decrypt the cards.
Weakness The encryption scheme used must be secure against known-plaintext attacks: Bob must not be able to determine Alice's original key A (or enough of it to allow him to decrypt any cards he does not hold) based on his knowledge of the unencrypted values of the cards he has drawn. This rules out some obvious commutative encryption schemes, such as simply XORing each card with the key. (Using a separate key for each card even in the initial exchange, which would otherwise make this scheme secure, doesn't work since the cards are shuffled before they're returned.) Depending on the deck agreed upon, this algorithm may be weak. When encrypting data, certain properties of this data may be preserved from the plaintext to the ciphertext. This may be used to "tag" certain cards. Therefore, the parties must agree on a deck where no cards have properties that are preserved during encryption.
… excerpt ends here. Continue reading the full article.
