Card-Based Cryptography Meets 3D Printer⋆Yuki Ito1 , Hayato Shikata1 , Takuo Suganuma1 , and Takaaki Mizuki1
Tohoku University, Sendai, Japanmizuki+lncs[atmark]tohoku.ac.jp

Abstract. Card-based protocols perform cryptographic functionalities, such as
secure computations, using a deck of cards. Basically, these protocols are supposed to be implemented by humans’ manipulating physical cards. This paper isthe ﬁrst attempt to make use of a 3D printer for better physical implementationsof card-based protocols: we have designed and fabricated a couple of physicaldevices using a 3D printer that are useful for humans to implement protocols.
The ﬁrst device we created is the “ﬁve-card-trick turner,” which can turn overﬁve cards simultaneously in an amusing manner; this operation appears in theﬁnal step of the ﬁve-card trick, which is the most famous card-based protocol.
The second device we created is a special card box for storing a pile of cards,
whose concept was proposed in 2015 but the device had not been created in reality thus far. The special boxes can be used for implementing complex shuﬄes
that seem diﬃcult to implement only by hand. Furthermore, we propose anotheruse of these special boxes so that we can eﬃciently perform secure computationsof symmetric functions.
Keywords: Card-based cryptography · 3D printer · Secure computation · Symmetric function

1 Introduction
The development of card-based cryptography, which performs cryptographic functionalities such as secure computations using a deck of cards, has continued in recent years(e.g. [7, 8]). Card-based cryptography is a very unconventional type of computation.
Numerous card-based cryptographic protocols have been developed (cf. [3,10,16]),and many of them are simple enough to be easily implemented by non-experts, including high school students. Such protocols are implemented by humans’ manipulating aphysical deck of cards (along with a table on which the cards are placed). This paper
begins with a description of the ﬁve-card trick [1] as a concrete example of a practicalcard-based protocol.
⋆

This paper appears in Proceedings of UCNC 2024. This version of the contribution has been
accepted for publication, after peer review but is not the Version of Record and does not reﬂect post-acceptance improvements, or any corrections. The Version of Record is available
online at: http://dx.doi.org/10.1007/978-3-031-63742-1_6. Use of this Accepted
Version is subject to the publisher s Accepted Manuscript terms of use: https://www.
springernature.com/gp/open-research/policies/accepted-manuscript-terms.

2

Y. Ito et al.

1.1 The Five-Card Trick
The ﬁve-card trick [1] is the ﬁrst card-based protocol in history; it performs a secure
two-input AND computation using ﬁve cards.
Suppose that Alice and Bob want to perform a secure AND computation. That is,
Alice and Bob holding private bits a ∈ {0, 1} and b ∈ {0, 1}, respectively, want to know
only the AND value a ∧ b. Using two cards ♣ r of diﬀerent colors, whose backs areboth ? , Alice secretly creates a commitment to her private bit a ∈ {0, 1}
? ?,
|{z}
a

which follows the following encoding rule:♣ r = 0,

♣ = 1.

r(1)

That is, the pair of face-down cards is a commitment to a, and its order is ♣ r whena = 0 and r ♣ when a = 1. Bob creates a commitment to b ∈ {0, 1} in the same way,
and another red card r is placed in the middle:? ? r ? ? .
|{z} |{z}abGiven such a sequence of ﬁve cards as input i , the ﬁve-card trick proceeds as follows.
1. The leftmost two cards are swapped so that the commitment to a is converted to its
negation a:? ? r ? ?
R@
? ? r ? ? .
|{z} |{z}ab2. Turn over the center r card:? ? r ? ? → ? ? ? ? ? .
|{z} |{z}|{z} |{z}
a

b

a

b

Note that a ∧ b = 1 if and only if the three cards in the middle are r r r .
3. Apply a random cut (denoted by the symbol ⟨·⟩):+*? ? ? ? ? .
A random cut is a cyclic shuﬄing operation, where the sequence of cards is shiftedby a random number. A random cut can be easily implemented in the real world by
the so-called Hindu cut [20].
iThe original paper [1] used ♠ instead of ♣ , and put ♠ in the middle. We place r in the
middle because three heart suits r r r may be more convincing when announcing a∧b = 1.

Card-Based Cryptography Meets 3D Printer3

4. Turn over all the ﬁve cards and obtain the value of a ∧ b as follows:♣ r r r ♣r r r ♣ ♣r r ♣ ♣ rr ♣ ♣ r r
♣ ♣ r r ra∧b=1

♣ r ♣ r♣ r ♣ r r
r ♣ r r ♣♣ r r ♣ r
r r ♣ r ♣a∧b=0.
rorThis AND protocol is very simple and can be easily implemented with ﬁve physicalcards by human hand, as shown in the picture in Fig. 1.

Fig. 1. An implementation of the ﬁnal step of the ﬁve-card trick

In this paper, we use a 3D printer to create a device, called the “ﬁve-card-trick
turner,” that turns over ﬁve cards at once in the ﬁnal step, as mentioned later.
1.2 Special Boxes for Implementing Complex Shuﬄes
In the computational model of card-based protocols [9], a “shuﬄe” is mathematicallydeﬁned, and the model includes “complex” shuﬄes which seem diﬃcult for humans to
implement only by hand. On the other hand, somewhat interestingly, it is known thatmaking use of such complex shuﬄes leads to protocols having a smaller number ofcards or shuﬄes (e.g. [6, 13, 19]). Furthermore, it was pointed out that some of suchcomplex shuﬄes could be implemented (in the real world) by using special card boxes
illustrated in Fig. 2a [12–14].
The main feature of this box is that several boxes can be stacked and piles of cards
stored in boxes can be combined into a single pile, as shown in Fig. 2b.
To the best of our knowledge, such a special card box had never been made in thereal world. Thus, we created such physical boxes using a 3D printer for the ﬁrst time.
1.3 Contribution of This Paper
As mentioned in Sects. 1.1 and 1.2, this paper reports that, using a 3D printer, we designed and created two physical devices useful for implementing card-based protocols:
the ﬁve-card-trick turner and the special card boxes for storing and combining piles.

4

Y. Ito et al.

(a) Special box whose lid and bottom can be slid. (b) Stack boxes and combine piles of cards.
Fig. 2. The special card boxes

Five-card-trick turner
We created a device for ﬂipping ﬁve cards simultaneously in an amusing mannerin the ﬁnal step of the ﬁve-card trick; we name it the ﬁve-card-trick turner, and ouractually created one is shown in Fig. 3. Due to the page limitation, we omit thedetails in this paper. As mentioned above, the ﬁve-card trick is very simple, and it
has attracted many lay-people such as high school students; thus, we expect that
this new device will further increase the appeal of the ﬁve-card trick.

(a) Flipping ﬁve face-down cards(b) Revealed ﬁve cards

Fig. 3. The ﬁve-card-trick turnerSpecial card boxes
As mentioned in Sect. 1.2, the special card boxes illustrated in Fig. 2 were considered to potentially implement complex shuﬄes (some of which could theoreticallyreduce the numbers of required cards or shuﬄes), but we had not seen any real
implementation. We then actually created special card boxes using a 3D printer, as
shown in Fig. 4.
As a demonstration, using the created boxes, we have actually executed the existingﬁve-copy protocol [13], which requires a complex shuﬄe, and conﬁrmed that the
protocol can be executed securely and reliably.
In addition, we propose a novel use of these special card boxes: we show that they
can be used for securely computing any symmetric function eﬃciently. Speciﬁcally,in terms of the number of times we make a pile of cards, the existing method [15]requires n2 /2 + 3n/2 − 2 times, whereas our method uses only 2n − 2 times. This
result is very interesting from both theoretical and practical perspectives.

Card-Based Cryptography Meets 3D Printer5

Fig. 4. Created special card boxes for complex shuﬄes

Let us emphasize that the main scientiﬁc contribution of this paper lies in revealing
how new physical devices can enable a novel and eﬃcient protocol.
1.4 Organization of This Paper
The rest of this paper is organized as follows. In Sect. 2, to be familiar with the computational model of card-based protocols, we show a pseudo-code for the ﬁve-card trick.
Next, in Sect. 3, we report on the creation of the special card boxes on a 3D printer andthe actual execution of the ﬁve-card copy protocol. Next, in Sect. 4, we show that the
special card boxes provide “sorting functionality,” (whereby we will construct an eﬃcient protocol for any symmetric function in Sect. 6). Next, in Sect. 5, we introduce theexisting protocol for symmetric functions. Then, in Sect. 6, we present our protocol forsymmetric functions based on the special card boxes. Finally, we conclude in Sect. 7.

2 Pseudo-Code for the Five-Card Trick
In this section, we give a formal description of the ﬁve-card trick introduced in Sect. 1.1
using a pseudo-code as shown in Pseudo-code 1. Remember that this protocol uses
ﬁve cards r r r ♣ ♣ and each input commitment is placed using two cards ♣ raccording to the encoding rule (1).
Here, (perm, (1 2)) means an action permuting a sequence of cards based on thecyclic permutation (1 2), and (turn, {3}) means to turn over the third card. The next
action(shuf, {id, (1 2 3 4 5), (1 2 3 4 5)2 , (1 2 3 4 5)3 , (1 2 3 4 5)4 })indicates a random cut: one of the ﬁve permutations is chosen uniformly at random andapplied, where (1 2 3 4 5) is a cyclic permutation and id denotes the identity. The next
action (turn, {1, 2, 3, 4, 5}) means that all ﬁve cards are turned over.

3 Special Card Boxes for Complex Shuﬄes
In card-based cryptography, complex shuﬄes have sometimes been used in protocol
construction, especially when designing protocols with extremely small numbers of

6

Y. Ito et al.

Pseudo-code 1. Five-card trick

Pseudo-code 2. Five-card copy

Input: ? ? r ? ?
|{z} |{z}Input: ? ? ♣ ♣ r
|{z}

a

b

(perm, (1 2))(turn, {3})(shuf, {id, (1 2 3 4 5), (1 2 3 4 5)2 ,(1 2 3 4 5)3 , (1 2 3 4 5)4 })(turn, {1, 2, 3, 4, 5})if rrr appears then(result, ”a ∧ b = 1”)
else(result, ”a ∧ b = 0”)
endif

a

(perm, (1 2 4 5 3))(shuf, {id, (1 4 2 5 3)})
(perm, (2 5 3))(turn, {5})if ♣ appears then(result, (1, 2), (3, 4))
else(perm, (1 2))(turn, {5})return to the beginning
endif

cards or shuﬄes. In this section, we report that, using a 3D printer, we actually createdspecial card boxes for implementing such complex shuﬄes.
3.1 Complex Shuﬄes by Special Card Boxes
A card-based protocol is formulated by an abstract machine [9]. Speciﬁcally, as seenin the pseudo-code of the ﬁve-card trick shown in Sect. 2, a protocol consists mainlyof a combination of three actions perm, turn, and shuf. Of these, shuf is said to be
the most important action, and a shuﬄe is formulated as (shuf, Π, F ) using a set of
permutations Π and a probability distribution F on it. That is, a permutation π ∈ Π ischosen according to the distribution F , and π is applied to the sequence of cards.
Thus, Π and F in a shuﬄe (shuf, Π, F ) in the computational model of card-based
protocols can be arbitrary. If F is a uniform distribution, the shuﬄe is said to be uniform
and is sometimes written as (shuf, Π) for short. If the set of permutations Π is closed,i.e., a subgroup of permutations, we say that the shuﬄe is closed.
A non-uniform or non-closed shuﬄe is often called a complex shuﬄe and is diﬃcult
for humans to implement. The ﬁrst concrete complex shuﬄe in the history of card-based
cryptography is (shuf, {id, (1 4 2 5 3)}). This is a shuﬄe in which the left two cards andthe remaining three cards in a sequence of ﬁve cards are considered as piles, and thetwo piles are swapped with a probability of 1/2:
 1 2 3 4 5
1 2 3 4 5
? ? ? ? ?
→
? ? ? ? ?
3 4 5 1 2

? ? ? ? ? .
This shuﬄe is uniform but not closed (because (1 4 2 5 3)2 , id), and is diﬃcult toimplement with human hands (e.g., if you make a pile of two cards and a pile of threecards by ﬁxing them with rubber bands and stir them together, the diﬀerence in theCard-Based Cryptography Meets 3D Printer7

number of cards will tell you whether the two piles have been switched or not). Thisshuﬄe was presented by Eddie Cheung, Christa Hawthorne, and Patrick Lee, students
in D. R. Stinson’s class CS 758: Cryptography / Network Security (Fall Semester, 2013)
project at the University of Waterloo.
Later in 2015, this shuﬄe was used to construct a ﬁve-card copy protocol [13],which makes two copied commitments from a given commitment (before this protocol,
the copy protocol using the fewest cards required six cards [11]). A pseudo-code of the
ﬁve-card copy protocol is shown in Pseudo-code 2, where (result, (1, 2), (3, 4)) indicatesthat the ﬁrst and second cards are a commitment to a, and so are the third and fourth.
The ﬁrst mention of how to physically implement the shuﬄe (shuf, {id, (1 4 2 5 3)})was made in the paper [13], and it was expected that it could actually be implemented
using two special card boxes like Fig. 2a in Sect. 1. Speciﬁcally, a pile of two cards anda pile of three cards are each placed in a box and switch them randomly:? ?

? ? ? .

Then, slide the top and bottom of the boxes to merge the two piles into a single pile, as
shown in Fig. 2b in Sect. 1. Although how to implement is shown in this way, to the bestof our knowledge, such a card box has never been physically created and implemented
in the real world.
In the paper [12], the conditions on special card boxes that must be satisﬁed arelisted on p. 1498. The following is a quote from that part, where this special box-shaped
equipment is referred to as a ‘case.’“..., we assume physical cases that satisfy the following properties.
1. It is possible to store a pile of cards in a case without changing its order.
2. It is possible to take out a pile of cards from a case without changing its
order.
3. It is possible to take out multiple piles without changing their orders by
opening multiple cases at the same time. No information leak will becaused by this action.
4. A number of cases that possibly contain piles of cards are indistinguishable
from one another, and we cannot obtain any information about the cards
inside.
Based on the above, we have designed a special card box, as will be described in
Sect. 3.2.
3.2 Design and Creation of Special Boxes
Basically, the special box was designed to meet the requirements described in Sect. 3.1.
In addition, design innovations were added to ease protocol execution. Speciﬁcally,
notches are included at the top and bottom of the stacked boxes to prevent dislodging
during operation. In addition, when sliding the bottom or lid of the stacked boxes, theother slides in tandem with it. The productions are shown in Fig. 4 in Sect. 1.
We added another useful feature: the ejector shown in Fig. 5, which helps securely
eject a pile of cards from boxes. If we ﬂip the card box to eject a pile of cards, then it

8

Y. Ito et al.

Fig. 5. Ejector device and support equipment

Fig. 6. Removing cards using the ejector

may lead to a partial view of the cards and protocol failure. Instead, by using the ejector,
cards can be securely ejected without the need to ﬂip the box. The process of ejecting
piles of cards using these devices is shown in Fig. 6.
3.3 Real Implementation of the Five-Card Copy Protocol
Fig. 7 shows an actual implementation of the complex shuﬄe (shuf, {id, (1 4 2 5 3)}).
Based on this, we have actually implemented the ﬁve-card copy protocol described in
Sect. 3.1. We think that this was the ﬁrst secure physical implementation of the ﬁve-card
copy protocol in history.

Fig. 7. Implementation of the complex shuﬄe with special boxes

4 Sorting Piles Secretly with Special Boxes
In this section, we consider another use of the special card box: we introduce a newmechanism for storing a card on top of each box whereby we can sort a sequence ofpiles secretly according to the order of some face-down cards.
4.1 Attaching Card on Top of Box
We consider attaching a face-down card to a special card box, as shown in Fig. 8. The
attached card could be ﬁxed with the box using a rubber band or something, but, using
a 3D printer, we introduced a new feature to realize this more easily.

Card-Based Cryptography Meets 3D PrinterFig. 8. Attach a card to the top of the box

9Fig. 9. Card housing mechanism

Speciﬁcally, we have created a card box with a mechanism for storing a card in the
top of the box, as shown in Fig. 9. The card storage mechanism is attached to the top
lid of the box, allowing a single card to be inserted. This structure improves preventing
card removal and other protocol errors when shuﬄing card boxes.
4.2 Example of Box Use
Here, we give a concrete example of making use of the feature of the special box explained in Sect. 4.1.
Given commitments to x1 , x2 ∈ {0, 1}? ? ? ?
|{z} |{z}x1x2along with r , we want to “sort” the commitment to x1 and the face-down r according
to the value of x2 while keeping the value of x2 secret. That is, we want the following
to be:
r

if x2 = 0 :? ? ? ,|{z}r

if x2 = 1 :? ? ? .
|{z}

x1

x1

This can be done as follows.
1. Open the tops of two special card boxes, insert the commitment to x1 and the facedown r card, and close the tops:r? ? ? →
|{z}

? ?

?

.

x1

2. Place the left card of the commitment to x2 on top of the left box (by the storage
mechanism) and the right card to the top of the right box:
?

?
.

10

Y. Ito et al.

3. Shuﬄe the two special boxes until they are no longer clear which is which:
*

?

?

+
.

4. Take out the cards at the tops of the boxes and turn them over; then, one is ♣ andthe other r. Stack the two boxes so that the r box is under the ♣ box, and pull out
the middle dividers to merge the two piles inside the boxes into a single pile.
This procedure accomplishes the above.
4.3 General Description
Here, we generalize the method mentioned in Sect. 4.2. That is, we now demonstratethat we can sort k piles (of possibly diﬀerent sizes) based on face-down numbered cards
ranging from 1 to k.
Assume that there are k piles of arbitrary sizes, and that we have k face-down numbered cards arranged by the numbers from 1 to k in a speciﬁc order.
1. Place each pile in a special box:
? ? ··· ?

? ? ··· ?

···? ? ··· ?

.

2. Place the face-down numbered card on top of each special box (without changing
the order):?
? ? ··· ?

?
? ? ··· ?

···?
? ? ··· ? .

3. Shuﬄe the k special boxes, take out the numbered cards, turn them over, and sortthe boxes in ascending order based on the revealed numbered cards:
1? ? ··· ?

2? ? ··· ?

···k? ? ··· ? .

4. All the special boxes are concatenated and the partitions are pulled out to obtain asorted sequence of cards:? ? ? ? ··· ? .
For piles of the same size, the sort sub-protocol proposed in [5] can be used, but forpiles of irregular sizes, the method described in this paper is eﬀective.
As seen later, our method above will provide an eﬃcient addition of commitments,
by which we can construct an eﬃcient protocol for any symmetric function. To compare
our protocol with the existing one, we ﬁrst introduce the existing protocol in Sect. 5,
followed by our protocol presented in Sect. 6.

Card-Based Cryptography Meets 3D Printer11

5 Secure Computation of Symmetric Function: Existing Method
Ruangwises and Itoh [15] proposed a generic protocol for any symmetric function f :{0, 1}n → R such that its range R can be an arbitrary set. In this section, we introduce
this existing protocol. Note that a function is said to be symmetric if it is invariant under
permutations of its variables.
5.1 Preliminaries
We ﬁrst introduce the pile-shifting shuﬄe [12, 18]. Suppose that there are k piles B1 ,· · · , Bk of the same size. Applying a pile-shifting shuﬄe to this results in
Bk
Bk+r
B1+r
B1
 z }|
z }|
{
{
z }|
{
z }|
{
? ? ··· ? ··· ? ? ··· ? → ? ? ··· ? ··· ? ? ··· ? ,where r ∈ {0, 1, · · · , k − 1} is random and if the subscript exceeds k, the value shallreturn to 1. The pile-shifting shuﬄe can be implemented by ﬁxing piles with envelopes,
rubber bands, or sleeves and applying the Hindu cut to them.
We next explain how to express a non-negative integer as a sequence of cards [15].
Let k ≥ 2; then, using k − 1 ♣ cards and a r card, we represent an integer i, 0 ≤ i ≤ k − 1,by placing r at the (i + 1)-th position:♣ ♣ ... r ... ♣ .
1

2

i+1

k

Hereinafter, such a sequence of face-down cards is denoted by Ekr (i). If we reverse thecolors, we denote the resulting sequence by Ek♣ (i).
5.2 Addition of Non-Negative Integers
Ruangwises and Itoh [15] proposed a method for performing addition, given two facedown sequences representing non-negative integers. (This method is based on the ideaof Shinagawa et al. [17].)
1. Given Ek♣ (a) and Ekr (b) representing two non-negative integers a, b, for the sake of
explanation, we name each card in each sequence as follows:Ek♣ (a) : ? ? · · · ? ,Ekr (b) : ? ? · · · ? .

x0 x1

y0 y1

xk−1

yk−1

2. Rearrange the cards as follows:
yk−1

yk−2

y0

? ?

? ? ··· ? ? .

x0

x1

xk−1

3. Apply a pile-shifting shuﬄe, where r is a random number: yk−1yk−2y0 
yk−1−ryk−2−r→? ? ? ? ··· ? ?
? ? ? ? ···
x0

x1

xk−1

x0+r

x1+r

y0−r

?
xk−1+r? .

12

Y. Ito et al.

4. Rearrange the cards as in the original:
Ek♣ (a − r) : ? ? · · · ? ,x0+r x1+r

Ekr (b + r) : ? ? · · · ?

xk−1+ry0−r y1−r.

yk−1−rHere, the random value r is subtracted from a and r is added to b.
5. Turn over the cards in Ekr (b + r), and the sequence of Ek♣ (a − r) is cyclically shiftedto the right by the revealed number s = b + r:
Ek♣ (a − r) : ?

?

x0+r

x1+r

···

?

→

Ek♣ (a + b) : ?

xk−1+r? ···x0+r−s x1+r−s?

.

xk−1+r−s

This allows a secure computation of (a − r) + (b + r) = a + b without leaking the valuesof a and b. That is, Ek♣ (a + b) is obtained.
Although the addition method has been explained for Ek♣ (a) and Ekr (b), it can also
be performed for other color combinations such as Ekr (a) and Ek♣ (b).
5.3 Secure Computation of Symmetric Function
Let f : {0, 1}n → R be a symmetric function. We want to construct a protocol that
outputs only the value of f (x1 , . . . , xn ), given n commitments to x1 , . . . , xn :? ? ? ? . . . ? ? → · · · → f (x1 , . . . , xn ) ,|{z} |{z} |{z}
x1

x2

xn

where each commitment follows the encoding rule (1).
Since f is symmetric, it is well known that the output value of f (x1 , . . . , xn ) deP
pends only on the sum ni=1xi . That is, there exists a function g : {0, 1, . . . , n} → {0, 1}Psuch that f (x1 , . . . , xn ) = g ni=1 xi . Therefore, if we want to calculate the symmetricPfunction f , we only need to ﬁnd the sum ni=1 xi .
r♣
(x1 + · · · + xn ) fromThus, it suﬃces to obtain a sequence En+1
(x1 + · · · + xn ) or En+1
the input commitments. Using the addition of non-negative integers described in Sect.
r(x1 + · · · + xn ) with two additional cards [15]. Although the
5.2, we can generate En+1
details are omitted, the value of f (x1 , . . . , xn ) can be obtained by dividing, shuﬄing, andturning over cards, based on the above function g [15].
Remember that when applying a pile-shifting shuﬄe, we have to make a pile ofcards using an envelope or something. During an execution of the existing protocol, thenumber of times making piles is n2 /2 + 3n/2 − 2. In practice, making a pile, i.e., ﬁxing a
number of cards using an envelope, is a time-consuming operation, and hence, we want
to reduce this repetition. To this end, the special card boxes will be used for reducing thenumber of times making piles in our proposed protocol presented in the next section.

6 Secure Computation of Symmetric Function: Our Method
In this section, making use of the special card boxes described in Sect. 4, we propose
a generic protocol for any symmetric function f : {0, 1}n → R. Our protocol uses only
one additional card and two special boxes; the number of piles made is 2n − 2.

Card-Based Cryptography Meets 3D Printer13

6.1 Adding Commitments with Special Boxes
As explained in Sect. 5.3, to securely compute a symmetric function, it suﬃces to obtain♣r
En+1(x1 + · · · + xn ) or En+1
(x1 + · · · + xn ). Therefore, we give only a procedure for♣generating the sum En+1 (x1 + · · · + xn ) from input commitments.
Note that a commitment to x1 can be regarded as E2♣ (x1 ) :? ? = ? ? .
|{z}
|{z}
x1

E2♣ (x1 )Note furthermore that placing a face-down r card to the right of it results in E3♣ (x1 ) :? ? r → ? ? ?,|{z}
| {z }
E3♣ (x1 )x1

and placing a face-down r card to the left results in E3♣ (x1 + 1) :r

? ? → ? ? ? .
|{z}| {z }
x1

E3♣ (x1 +1)

Therefore, notice that the example described in Sect. 4.2 is actually a procedure which
produces E3♣ (x1 + x2 ):? ? ? ? r → ··· → ? ? ? .
|{z} |{z}| {z }
x1

E3♣ (x1 +x2 )x2

We extend this idea; given n commitments along with one additional card, using♣
two special boxes, we obtain En+1
(x1 + · · · + xn ) as follows.
1. Add two commitments to x1 and x2 using the method described in Sect. 4.2, andobtain E3♣ (x1 + x2 ):? ? ? ? r → ? ? ? ♣ r .
|{z} |{z}| {z }x1

x2

E3♣ (x1 +x2 )2. Place E3♣ (x1 + x2 ) obtained in Step 1 in the left box and the r card in the right box,
place the commitment to x3 on tops of the boxes, and apply the addition in a similar
way:
?

?

? ? ?

?

♣ → ··· →? ? ? ? ♣ ♣ r .
| {z }
E4♣ (x1 +x2 +x3 )3. Repeat such an operation until xn is reached:? ? ? ? ♣ ♣ r| {z }
E4♣ (x1 +x2 +x3 )→ ··· →

→ ? ? ? ? ? ♣ ♣ ♣ r| {z }
E5♣ (x1 +x2 +x3 +x4 )? ? ··· ? ♣ ♣ ··· ♣ r .
| {z } | {z }♣ (x +x + ··· +x )
En+1
1
2
n
n−1 cards

14

Y. Ito et al.

This is our protocol.
The existing protocol [15] requires two additional cards, while our protocol uses
only one additional card, i.e., it reduces the number of cards by one by using two special
boxes.
Also, the number of times to make piles (namely, the number of times a pile isplaced in a sleeve or envelope) is n2 /2 + 3n/2 − 2 times in the existing protocol [15],while the number of times to make piles (namely, the number of times we place cards
in a special box) is 2n − 2 times. In terms of this, our protocol is very eﬃcientii .
Table. 1 summarizes their performances.
Table 1. The existing protocol and our protocol for symmetric functions# of cards# of making a pile

Ruangwises–Itoh [15]2n + 2n2 /2 + 3n/2 − 2Ours

2n + 12n − 27 Conclusion
In this paper, we reported that, using a 3D printer, we created the ﬁve-card-trick turner
and the special card boxes useful for implementing card-based protocols. We also proposed another use of the special card boxes so that we can eﬃciently perform securecomputations of symmetric functions. Speciﬁcally, our protocol needs only 2n−2 times
for making piles while the existing protocol needs n2 /2 + 3n/2 − 2 times.
In order for secure computations or other cryptographic technologies to be widelyused in society, it is necessary for a wide range of stakeholders to understand the meaning and signiﬁcance of these cryptographic functionalities [2]. We hope that card-based
cryptography and its implementation will help in this regard.

Acknowledgements
We thank the anonymous referees, whose comments have helped us improve the presentation of the paper. This work was supported in part by JSPS KAKENHI Grant
Numbers JP24K02938 and JP23H00479.

References
1. Boer, B.D.: More eﬃcient match-making and satisﬁability the ﬁve card trick. In: EUROCRYPT 1989. LNCS, vol. 434, pp. 208–217. Springer, Heidelberg (1990)
ii

Although making piles when applying a pile-shifting shuﬄe is a reasonable implementation,
it should be noted that this metric depends on implementations in a sense (cf. [4]).

Card-Based Cryptography Meets 3D Printer15

2. Hanaoka, G.: Towards user-friendly cryptography. In: Paradigms in Cryptology–Mycrypt2016. Malicious and Exploratory Cryptology. LNCS, vol. 10311, pp. 481–484. Springer,
Cham (2017)
3. Koch, A.: Cryptographic Protocols from Physical Assumptions. Ph.D. thesis, Karlsruhe Institute of Technology (2019)
4. Koch, A., Walzer, S.: Foundations for actively secure card-based cryptography. In: Fun with
Algorithms. LIPIcs, vol. 157, pp. 17:1–17:23. Schloss Dagstuhl, Dagstuhl, Germany (2020)
5. Koch, A., Walzer, S.: Private function evaluation with cards. New Gener. Comput. 40, 115–
147 (2022)
6. Koch, A., Walzer, S., Härtel, K.: Card-based cryptographic protocols using a minimal number of cards. In: Advances in Cryptology—ASIACRYPT 2015. LNCS, vol. 9452, pp. 783–
807. Springer, Berlin, Heidelberg (2015)
7. Mizuki, T.: Preface: Special issue on card-based cryptography. New Gener. Comput. 39, 1–2(2021)
8. Mizuki, T.: Preface: Special issue on card-based cryptography 2. New Gener. Comput. 40,
47–48 (2022)
9. Mizuki, T., Shizuya, H.: A formalization of card-based cryptographic protocols via abstract
machine. Int. J. Inf. Secur. 13(1), 15–23 (2014)
10. Mizuki, T., Shizuya, H.: Computational model of card-based cryptographic protocols and its
applications. IEICE Trans. Fundam. E100.A(1), 3–11 (2017)
11. Mizuki, T., Sone, H.: Six-card secure AND and four-card secure XOR. In: Frontiers in Algorithmics. LNCS, vol. 5598, pp. 358–369. Springer, Berlin, Heidelberg (2009)
12. Nishimura, A., Hayashi, Y., Mizuki, T., Sone, H.: Pile-shifting scramble for card-based protocols. IEICE Trans. Fundam. 101(9), 1494–1502 (2018)
13. Nishimura, A., Nishida, T., Hayashi, Y., Mizuki, T., Sone, H.: Five-card secure computations using unequal division shuﬄe. In: Theory and Practice of Natural Computing. LNCS,
vol. 9477, pp. 109–120. Springer, Cham (2015)
14. Nishimura, A., Nishida, T., Hayashi, Y., Mizuki, T., Sone, H.: Card-based protocols using
unequal division shuﬄes. Soft Comput. 22, 361–371 (2018)15. Ruangwises, S., Itoh, T.: Securely computing the n-variable equality function with 2n cards.
Theor. Comput. Sci. 887, 99–110 (2021)
16. Shinagawa, K.: On the Construction of Easy to Perform Card-Based Protocols. Ph.D. thesis,
Tokyo Institute of Technology (2020)
17. Shinagawa, K., Mizuki, T., N., J.S.C., Nuida, K., Kanayama, N., Nishide, T., Hanaoka, G.,
Okamoto, E.: Multi-party computation with small shuﬄe complexity using regular polygon
cards. In: Provable Security. LNCS, vol. 9451, pp. 127–146. Springer, Cham (2015)18. Shinagawa, K., Mizuki, T., Schuldt, J., Nuida, K., Kanayama, N., Nishide, T., Hanaoka,G., Okamoto, E.: Card-based protocols using regular polygon cards. IEICE Trans. Fundam.
E100.A(9), 1900–1909 (2017)19. Shinagawa, K., Nuida, K.: A single shuﬄe is enough for secure card-based computation of
any Boolean circuit. Discrete Applied Mathematics 289, 248–261 (2021)
20. Ueda, I., Nishimura, A., Hayashi, Y., Mizuki, T., Sone, H.: How to implement a random
bisection cut. In: Theory and Practice of Natural Computing. LNCS, vol. 10071, pp. 58–69.
Springer, Cham (2016)