Card-based Secure Ranking Computations?
Ken Takashima1 , Yuta Abe1 , Tatsuya Sasaki1 , Daiki Miyahara1,4 ,Kazumasa Shinagawa2,4 , Takaaki Mizuki3 , and Hideaki Sone3
1

Graduate School of Information Sciences, Tohoku University,
6–3–09 Aramaki-Aza-Aoba, Aoba-ku, Sendai, 980–8578, Japan
2
Graduate School of Information Sciences and Engineerings, Tokyo Institute ofTechnology, 2–12–1 Ookayama, Megro, Tokyo 152–8552, Japan
3
Cyberscience Center, Tohoku University,
6–3 Aramaki-Aza-Aoba, Aoba-ku, Sendai, 980–8578, Japan
4
National Institute of Advanced Industrial Science and Technology,
2–4–7, Aomi, Koto-ku, Tokyo, 135–0064, Japan

Abstract. Consider a group of people who want to know the “rich list”
among them, namely the ranking in terms of their total assets, without
revealing any information about the actual value of their assets. Thiscan be achieved by a “secure ranking computation,” which was first considered by Jiang and Gong (CT-RSA 2006); they constructed a secureranking computation protocol based on a public-key cryptosystem. In
this paper, instead of using a public-key cryptosystem, we use a deck ofphysical cards to provide secure ranking computation protocols. Therefore, our card-based protocols do not rely on computers, and they aresimple and easy for humans to implement. Specifically, we design four
protocols considering tradeoffs between the number of cards and thenumber of shuffles required to execute protocols. We also present a guideto choose an appropriate protocol according to the number of people
participating in the protocol and the size of the input range.
Key words: Card-based protocols, Secure ranking computation, Secure
multiparty computations, Millionaire problem, Deck of cards

1

Introduction

Assume that there are n players P1 , . . . , Pn such that each player Pi , 1 ≤ i ≤ n,holds xi dollars with 1 ≤ xi ≤ m. They want to know the “rich list” (r1 , . . . , rn )among them, namely the ranking in terms of their total assets, without revealing
any information about the actual values of x1 , . . . , xn . More formally, they want
to securely compute the ranking function rk : {1, 2, . . . , m}n → {1, 2, . . . , n}ndefined as
rk : (x1 , . . . , xn ) 7→ (r1 , . . . , rn )such that ri = 1 + {xj | xj > xi , 1 ≤ j ≤ n} for every i, 1 ≤ i ≤ n,?

This paper appears in Proceedings of COCOA 2019. The final authenticated version
is available online at https://doi.org/10.1007/978-3-030-36412-0_37.

2

K. Takashima et al.

where |X| denotes the cardinality of a set X. For example,
rk(3, 1, 3, 5) = (2, 4, 2, 1),
which means that P4 is the richest, P2 is the poorest, and both P1 and P3
are tied; all the players want to know only the ranking list (2, 4, 2, 1) without
revealing the amounts of their individual money (3, 1, 3, 5).
This is a secure ranking computation problem, which was first consideredby Jiang and Gong [5]. They constructed a secure ranking computation protocol based on a public-key cryptosystem. That is, their protocol allows P1 · · · , Pn
whose secret properties are (x1 , . . . , xn ) to know only the ranking rk(x1 , . . . , xn ) =(r1 , . . . , rn ) without revealing any information about the inputs (x1 , . . . , xn ).
Note that this falls into the category of secure multiparty computations (MPCs) [12].
1.1Card-based Protocols

It is well known that MPCs can be conducted by using a deck of physical cards(such as ♣ ♣ ♥ · · · ), and such a research area is called card-based cryptography(e.g. [1, 7]). The goal of this paper is to construct efficient card-based protocols
for solving the secure ranking computation problem. Compared to the use of apublic-key cryptosystem, there are certain advantages in using a deck of cards;
their computation, correctness, and secrecy are easier to understand.
As elementary card-based computations, efficient NOT, AND, OR, XOR,
and COPY protocols have been proposed [2, 8]. Therefore, for any n-variable
function f , we can construct a card-based protocol that securely computes f
by combining these elementary protocols. Thus, if one created a logical circuit
representing the ranking function rk, then one could construct a card-based
protocol securely computing rk. However, such a circuit would be huge andcomplicated, and hence, the resulting protocol would no longer be practical.
While generic constructions as above tend to be impractical, a protocol specialized for a specific problem is usually more efficient. For example, consider the
millionaire problem [12]: Two players, Alice and Bob, want to know who is richer.
Indeed, efficient card-based millionaire protocols were proposed [3,6,9]. The goalof this paper is to design specialized card-based protocols that efficiently solve
the ranking computation problem.
One may notice that the secure ranking computation can be realized byrepeatedly executing a millionaire protocol. However, our proposed protocols
perform the secure ranking computation more efficiently than by repeating theexisting millionaire protocol, as seen later.
We use a deck of four types of cards: black cards ♣ , red cards ♥ , a joker
Jo , and number cards 1 , 2 , . . . , m , which satisfy the following properties:
1. Cards with the same symbol on their faces cannot be distinguished fromeach other.
2. All cards have identical backs ? , and the pattern of backs is verticallyasymmetric so that we can distinguish between a face-down card that isright-side up ? and one that is upside down ¿ .

Card-based Secure Ranking Computations

3

We call black cards, red cards, and the joker as color cards.
1.2

Contribution

In this study, we propose four secure ranking computation protocols using a
deck of cards. The protocols are named as follows: two-phase, one-phase, shuffleefficient, and card-efficient protocols. Table 1 summarizes their performance.
The two-phase protocol and the one-phase protocol are not finite-runtime, butthey are expected finite-runtime protocols that use an expected finite number ofshuffles, i.e., they are Las Vegas algorithms. By contrast, both the shuffle-efficient
protocol and the card-efficient protocol are finite-runtime; they terminate with afinite number of shuffles. More details along with the organization of this paper
are as follows.
Table 1. The performance of our proposed protocols.

Protocolfinite-runtime? # of color cards # of num. cards

two-phasenon(2m + 1)

0

one-phasenon(m + 1)0(Expected) # of shuffles
Pk
k + 2 + (m − k + 1) i=1 1i (= S)Pm−k≤ S + 1 + (m + 1) i=1 1i

shuffle-efficientyes(n + k)(m + 1)

m+1

k+3

card-efficientyesn(m + 1)m+1

3k + 1In Section 2, we review fundamental shuffling operations in card-based cryptography.
In Section 3.1, we propose the two-phase protocol. The first phase of thisprotocol computes the “equality” of input (x1 , . . . , xn ), i.e., it reveals the quotientset {1, . . . , n}/{(i, j) | xi = xj }; each equivalent class corresponds to a group of
players who have the same amount of money. We often use k to denotek = m − |{1, . . . , n}/{(i, j) | xi = xj }|throughout this paper (including Table 1); in other words, k is the number ofamounts of money that nobody has. Making the use of k, the second phase of thisprotocol outputs rk(x1 , . . . , xn ). Note that knowing the ranking rk(x1 , . . . , xn )implies learning the “equality,” and hence, revealing such a quotient set will notleak any information beyond the ranking.
While the two-phase protocol mentioned above has two phases, we propose
the one-phase protocol in Section 3.2. That is, we get rid of the “equality check”
phase so that the number of required cards is n(m + 1), which is the smallest
among all the proposed protocols.
Remember that both the two-phase and one-phase protocols are not finiteruntime. In Section 4, we focus our attention on constructing finite-runtime

4

K. Takashima et al.

protocols that always terminate with a fixed number of shuffles. We first propose the finite-runtime shuffle-efficient protocol, which uses only k + 3 shuffles
although it requires a relatively large number of cards. We can modify this protocol to reduce the number of required cards by increasing the number of shuffles.
Carrying this technique further, we next propose the finite-runtime card-efficient
protocol.
In Section 5, we compare the two finite-runtime protocols with the existing millionaire protocol and discuss which protocol is appropriate in practicalsituations.
In Section 6, we summarize this paper and mention future work.

2

Preliminaries

In this section, we review three types of shuffles that are often used in cardbased protocols. As seen later, we can conceal input values by applying a shuffle
operation to a sequence of face-down cards.
2.1

Random Cut

Consider a sequence of ` face-down cards ? ? · · · ? denoted by (c1 , c2 , . . . , c` ).
A random cut randomly and cyclically shifts a sequence of cards. Applying arandom cut to the sequence (c1 , c2 , . . . , c` ) results in (c1+r , c2+r , . . . , c`+r ), wherer is uniformly randomly generated from Z/`Z and is unknown to everyone. Notethat a random cut can be implemented securely by human hands [11].
2.2

Pile-Scramble Shuffle

Consider a pile of face-down cards ? . Assume that we have ` such piles? ? · · · ? , all of whose sizes are the same; we denote it by (p1 , p2 , . . . , p` ).
A pile-scramble shuffle [4] is a shuffle operation for such a sequence of piles. Applying a pile-scramble shuffle to the sequence (p1 , p2 , . . . , p` ) results in (pπ−1 (1) ,pπ−1 (2) , . . . , pπ−1 (`) ), where π ∈ S` is a uniformly distributed random permutation and S` is the symmetric group of degree `. We can easily implement apile-scramble shuffle by making piles with rubber bands or envelopes.
Alternatively, we can reduce the implementation of a pile-scramble shuffle torandom cuts. We make a sequence of piles by using upside down cards as follows:¿ ? ··· ? ¿ ? ··· ? ··· ¿ ? ··· ? .
|{z } | {z}| {z }
p1

p2

plThen, after applying a random cut to it, we take out the first pile, which is
randomly chosen from ` piles. Next, do the same operation for the remaining` − 1 piles. Repeating this ` − 1 times in total, we have a randomly permuted
sequence of ` piles.

Card-based Secure Ranking Computations

2.3

5

Pile-Shifting Shuffle

A pile-shifting shuffle [10] cyclically and randomly shifts a sequence of piles. Applying a pile-shifting shuffle to (p1 , p2 , . . . , p` ) results in (p1+r , p2+r , . . . , p`+r ),where r is uniformly randomly generated from Z/`Z and is unknown to everyone.
Similar to the implementation of a pile-scramble shuffle based on upside
down cards, as discussed in Section 2.2, we can implement a pile-shifting shuffle
by applying a random cut once.

3

Simple Protocols

In this section, we propose two simple protocols. The first is the fundamental
one, which has two phases. The second is obtained by removing one phase fromthe two-phase protocol. The numbers of cards and shuffles required to executethe two protocols were shown in Table 1; note that there is a tradeoff.

3.1

Proposal of Two-phase Protocol

This simple ranking protocol consists of two phases, namely, the Check-equality
phase and the Create-ranking phase, after the setup.
Setup. Each player Pi holds one red card ♥ and m − 1 black cards ♣ s, andplaces a sequence of m cards face down, denoted by αi , that encodes their private
value xi ∈ {1, . . . , m}, as follows:
αi

?

?

♣

♣

···

?

?

?

♣

♥

♣

|{z}

|{z}

1-st

··· ? .
♣|{z}

xi -thm-thThat is, Pi puts ♥ at the xi -th position and ♣ s at the remaining positions
with their faces down. Likewise, each player Pi makes the following sequence ofcards βi :
βi

?

?

♥

♥

|{z}
1-st

···

?

?

?

♥

♣

♥

|{z}
xi -th··· ? .
♥

|{z}
m-th

Check-equality phase. In this phase, we reveal the “equality” of the inputs(x1 , . . . , xn ). Formally speaking, we want to know the quotient set {1, . . . , n}/{(i, j) |xi = xj }. Note that, as mentioned before, knowing rk(x1 , . . . , xn ) implies learning the quotient set, and hence, revealing the equality does not leak any information beyond the ranking.

6

K. Takashima et al.

1. Take the i-th (i = 1, . . . , m) cards from all players’ input sequences α1 , . . . , αn(while keeping the order unchanged) to make a pile pi of size n:
α1

?

? ···

?

α2
..
.

?
..
.

? ···
..
.

?
..
.

αn ?

? ···

?

↓

↓

↓

(1)

?
? ··· ? .
|{z} |{z}
|{z}
p1

p2

pm

Note that if the j-th and `-th cards of the pile pi (for some j, `) are red:
1

pi

j

2

`

m

? ? ··· ? ··· ? ··· ? ,
♣

♣

♥

♥

♣

then both Pj and P` hold i dollars, i.e., xj = x` = i, and hence, they aretied.
2. Apply a pile-scramble shuffle to (p1 , p2 , . . . , pm ).
3. Reveal all the piles (pπ−1 (1) , pπ−1 (2) , . . . , pπ−1 (m) ). Then, two types of piles
should appear: a pile consisting of only ♣ s (which we call an empty pile) ora pile containing ♥ s (which we call a non-empty pile).
If a non-empty pile contains ♥ s at j-th and `-th positions for some j, `, wehave xj = x` , but we cannot know the actual value of xj = x` . Therefore,
each non-empty pile tells us an equivalent class, and hence, all the non-empty
piles reveal the equality, namely {1, . . . , n}/{(i, j) | xi = xj }.
Create-ranking phase. Let k be the number of empty piles, i.e., k = m −|{1, . . . , n}/{(i, j) | xi = xj }|.
1. Every player Pi adds a face-down jokeri to the last of βi :βi?

? ··· ?

?

? ··· ?

♥

♥

♣

♥

|{z}
1-st

♥

|{z}
xi -th

♥

? .
|{z}

(2)

Jo

m+1-st2. Create a sequence (p1 , p2 , . . . , pm+1 ) in the same way as in (1) in Section 3.1.
3. Repeat the following until k empty pilesii are removed.
(a) Apply a pile-shifting shuffle to the sequence.
(b) Choose (any) one pile and reveal all the cards of the pile.
– If it is an empty pile, remove it from the sequence.
iii

Jo can be substituted by ♣ ; we use Jo for the purpose of easy understanding.
An empty pile consists of only ♥ (and a joker) here.

Card-based Secure Ranking Computations

7– If it is not an empty pile, turn over all the face-up cards and return
the pile to the sequence.
4. Apply a pile-shifting shuffle to the sequence.
5. Reveal all the remaining piles. Then, we obtain the ranking by cyclicallyshifting the revealed piles so that the pile consisting of only jokers is at theend of the sequence.
3.2

Proposal of One-phase Protocol

In this subsection, we construct a protocol without relying on checking equality.
Recall that in the Create-ranking phase of the two-phase protocol, we remove
a pile if it is an empty pile. If it is not an empty pile, it goes back to the sequence.
Notice that each non-empty pile is unique and contains information on players
having the same amount of money, namely the corresponding equivalent class.
Therefore, even if we do not know the “equality” in advance, we can find all
empty piles by searching them until all piles are revealed. Players can memorize
revealed piles so that they can determine when they finish.
Thus, we can skip the Check-equality phase, and our one-phase protocol
proceeds as follows.
Setup. Pi creates a sequence of cards βi in the same way as in (2) in Section 3.1.
Create-ranking phase.
1. Create (p1 , p2 , . . . , pm+1 ) in the same way as in (1) in Section 3.1.
2. Repeat the following until all m + 1 piles are revealed.
(a) Apply a pile-shifting shuffle to the sequence.
(b) Reveal (any) one pile.
– If it is an empty pile, remove it from the sequence.
– If it is not an empty pile, memorize it, turn over all the face-up cards,
and return the pile to the sequence.
3. Apply a pile-shifting shuffle to the sequence.
4. Reveal all the remaining piles. We obtain the ranking by shifting the sequenceof piles based on the pile consisting of only jokers.

4

Finite-runtime Protocols

The two proposed protocols in the previous section are not finite-runtime (because we have to repeat the shuffle until all empty piles are found). In this section,
we solicit finite-runtime protocols that perform the secure ranking computation
with a fixed number of shuffles. Specifically, we design two protocols considering
the tradeoff between the number of cards and the number of shuffles. First, we
propose the finite-runtime shuffle-efficient protocol specialized for reducing thenumber of shuffles. Next, we introduce a technique for reducing the number ofcards, and propose the finite-runtime card-efficient protocol.

8

4.1

K. Takashima et al.

Proposal of Shuffle-efficient Protocol

In this protocol, we first find all empty piles at once, add markers to them, andsearch the empty piles with the help of the markers.
1. Pi creates a sequence of cards βi in the same way as in (2) in Section 3.1.
2. Create (p1 , p2 , . . . , pm+1 ) in the same way as in (1) in Section 3.1.
3. For every j, 1 ≤ j ≤ m + 1, add a number card j to the top of the pile pj sothat we have a new pile p0 j of size n + 1.
4. Apply a pile-scramble shuffle to the sequence of piles:
?
|{z}

···
?
|{z}

p0 π−1 (1) p0 π−1 (2)
1

.

?
|{z}

p0 π−1 (m+1)

1

15. Reveal all the cards except for the number cards. Now, we find all the empty
piles (whose positions are randomly permuted). Let k be the number of
empty piles.
6. For each found empty pile, add a marker which consists of m ♣ s and one ♥being placed on the piles so that the red card ♥ indicates the empty pile, as
follows:
marker ?
··· ?
?
♣

♥

?

?
|{z}

♣

···

? .

empty pile

One marker indicates one empty pile, and hence, we stack k markers on thesequence of piles. We denote the resulting sequence by (p00 1 , p00 2 , . . . , p00 m+1 ).
7. Apply a pile-scramble shuffle to the sequence of piles:
?
|{z}

?
|{z}

2

2

p00 π−1 (1) p00 π−1 (2)

···

?
|{z}

.

p00 π−1 (m+1)
2

8. Reveal only the number cards, each of which is the (k + 1)-st card from the
top of the corresponding pile, and rearrange the order of the piles so thatthe number cards are in ascending order; remove all the number cards:?
? ··· ? .
|{z} |{z}|{z}p000 1 p000 2

p000 m+1

9. We remove all empty piles without anyone getting to know the “distance”
between any pair of non-empty piles: Repeat the following until k empty
piles are removed.
(a) Apply a pile-shifting shuffle to the sequence.
(b) Reveal one marker and remove the corresponding empty pile.
10. Apply a pile-shifting shuffle to the sequence.
11. Reveal all the remaining piles. We obtain the ranking by shifting the sequenceof piles based on the pile consisting of only jokers.

Card-based Secure Ranking Computations

4.2

9

Proposal of Card-efficient Protocol

In the finite-runtime shuffle-efficient protocol presented in Section 4.1, we use
k markers, i.e., we use k(m + 1) cards as markers. We consider a method of
reducing the number of cards used for these markers. If we arrange only one
marker in Step 6 of the finite-runtime shuffle-efficient protocol, we can computethe ranking by repeating the process from Step 3 to Step 9 k times. Then, thenumber of cards used for markers can be reduced from k(m + 1) to m + 1.
However, the number of required shuffles increases from k + 3 to 3k + 1.
By extending this idea further, no marker is needed. We construct a finiteruntime card-efficient protocol that does not rely on markers. The procedure isshown below.
1. Pi creates a sequence of cards βi in the same way as in (2) in Section 3.1.
2. Create (p1 , p2 , . . . , pm+1 ) in the same way as in (1) in Section 3.1.
3. Repeat the following until k empty piles are removed (while repeating, thenumber of piles is decreasing from m + 1 to m + 1 − k):(a) Apply a random cut to a sequence consisting of number cards:? ? ··· ? → ?
1

m+1

2

? ···

? .
m+1+r

1+r 2+r(b) For each pile pj , add the number card j + r to the pile so that we havea new pile p0 j .
(c) Apply a pile-scramble shuffle to the sequence of piles:
?
|{z}

···
?
|{z}

p0 π−1 (1) p0 π−1 (2)
1

1

?
|{z}

p0 π−1 (m+1).

1(d) Reveal all the cards except for the number cards.
(e) Remove one empty pile along with the number card. Note that because
the removed number card does not indicate the position of the pile (because of the random permutation π1 ), information on the input is notleaked.
(f) Turn all the cards face-down and apply a pile-scramble shuffle to thesequence of piles:
···
?
?
?
|{z}
|{z}
|{z}
.
0
0
p −1 −1
p −1 −1
p −1 −1
π
π
(1))
π
π
(2))
π
π
(m+1))
(
(
(
1
2
1
2
1
2
0

(g) Reveal only the number cards, each of which is the top of the corresponding pile, and rearrange the order of the piles so that the number
cards are in ascending order. Remove all the number cards.
4. Apply a pile-shifting shuffle to the sequence of piles.
5. Reveal all the remaining piles. We obtain the ranking by shifting the sequenceof piles based on the pile consisting of only jokers.

105

K. Takashima et al.

Discussion

In this section, we discuss comparison of protocols and real use cases.
Comparing Protocols. We compare the two finite-runtime protocols (presented in Section 4) with the repetition of the existing millionaire protocol [6]in terms of the number of cards and shuffles, and the input range m. We fix thenumber of players at n = 5, the number of color cards at 52, and the number of
number cards at 10.
Figure 1 shows the number of shuffles required to execute the three protocols.
One can confirm that our protocols use fewer shuffles compared to the case of
repeating the millionaire protocol.

16

14

Number of shuffles

12

10

8

6

4

2

0

4

5

6

7

8

Number of digits in the ammounts m
Millionaire protocol
Finite-runtime shuffle-efficient protocol (average)
Finite-runtime card-effcient protocol (average)

Fig. 1. Number of required shuffles (n = 5).

Use Case. Next, we discuss how our protocols can be used. To reduce thenumber of cards, it is reasonable to compare digits in the amounts instead of

Card-based Secure Ranking Computations

11

direct amounts of money. For example, if the amount of money that any player
holds is between 10 and 10y+1 − 1 for some y ∈ N, we can set the input range
to {1, . . . , y}.
Assume that the number of players is n = 5 and the number of digits inthe amounts is m = 6. For example, if a player Pi holds more than 103 dollars
and less than 104 dollars, she sets to xi = 3, if she holds 106 dollars, she sets
to xi = 6, and so on. In this case, 42 cards are required to execute our cardefficient protocol. The breakdown is as follows: 10 ♣ s, 25 ♥ s, and 7 number
cards. Assume that, for instance, the number of empty piles is k = 3, and thenumber of required shuffles is 10. Both the numbers of cards and shuffles arewithin a feasible range in practice.
If there are two or more players at the same rank, it is possible to compare
the amounts of money between the players in finer units. If there are three ormore players to compare, using our finite-runtime shuffle-efficient protocol or
finite-runtime card-efficient protocol is efficient; if there are only two players,
using the existing millionaire protocol would be a good choice.

6

Conclusion

In this paper, we first proposed card-based secure ranking computation protocols. While our two simple protocols are Las Vegas algorithms, our shuffleefficient protocol and card-efficient protocol always terminate with a finite number of shuffles. Future work will be to devise a protocol that works with a standard deck of playing cards. Finding lower bounds on the number of shuffles fora secure ranking computation protocol is also interesting.
Acknowledgement. This work was supported by JSPS KAKENHI Grant
Numbers JP17K00001, JP17J01169, and JP19J21153. We would like to thankthe anonymous reviewers for their fruitful comments.

References
1. den Boer, B.: More efficient match-making and satisfiability the five card trick. In:
Quisquater, J.J., Vandewalle, J. (eds.) Advances in Cryptology — EUROCRYPT’89. Lecture Notes in Computer Science, vol. 434, pp. 208–217. Springer, Berlin,
Heidelberg (1990)
2. Crépeau, C., Kilian, J.: Discreet solitary games. In: Stinson, D.R. (ed.) Advancesin Cryptology — CRYPTO’ 93. Lecture Notes in Computer Science, vol. 773, pp.
319–330. Springer, Berlin, Heidelberg (1994)
3. Hibiki Ono, Y.M.: Efficient card-based cryptographic protocols for the millionaires’problem using private input operations. In: 2018 13th Asia Joint Conference on
Information Security (AsiaJCIS). pp. 23–28. IEEE (2018)
4. Ishikawa, R., Chida, E., Mizuki, T.: Efficient card-based protocols for generating ahidden random permutation without fixed points. In: Calude, C.S., Dinneen, M.J.
(eds.) Unconventional Computation and Natural Computation. Lecture Notes in
Computer Science, vol. 9252, pp. 215–226. Springer, Cham (2015)

12

K. Takashima et al.

5. Jiang, S., Gong, G.: A round and communication efficient secure ranking protocol.
In: Pointcheval, D. (ed.) Topics in Cryptology – CT-RSA 2006. Lecture Notes in
Computer Science, vol. 3860, pp. 350–364. Springer, Berlin, Heidelberg (2006)
6. Miyahara, D., Hayashi, Y., Mizuki, T., Sone, H.: Practical and easy-to-understandcard-based implementation of Yao’s millionaire protocol. In: Donghyun, K.,
Alexander, Z., Uma, R.N. (eds.) Combinatorial Optimization and Applications.
Lecture Notes in Computer Science, vol. 11346, pp. 246–261. Springer, Cham(2018)
7. Mizuki, T., Shizuya, H.: Computational model of card-based cryptographic
protocols and its applications. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences E100.A(1), 3–11 (2017).
https://doi.org/10.1587/transfun.E100.A.3
8. Mizuki, T., Sone, H.: Six-card secure AND and four-card secure XOR. In: Deng, X.,
Hopcroft, J.E., Xue, J. (eds.) Frontiers in Algorithmics. Lecture Notes in Computer
Science, vol. 5598, pp. 358–369. Springer, Berlin, Heidelberg (2009)
9. Nakai, T., Tokushige, Y., Misawa, Y., Iwamoto, M., Ohta, K.: Efficient card-based
cryptographic protocols for millionaires’ problem utilizing private permutations. In:
Foresti, S., Persiano, G. (eds.) Cryptology and Network Security. Lecture Notes in
Computer Science, vol. 10052, pp. 500–517. Springer, Cham (2016)
10. Nishimura, A., Hayashi, Y., Mizuki, T., Sone, H.: Pile-shifting scramble
for card-based protocols. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences E101.A(9), 1494–1502 (2018).
https://doi.org/10.1587/transfun.E101.A.1494
11. Ueda, I., Nishimura, A., Hayashi, Y., Mizuki, T., Sone, H.: How to implementa random bisection cut. In: Martín-Vide, C., Mizuki, T., Vega-Rodríguez, M.A.
(eds.) Theory and Practice of Natural Computing. Lecture Notes in Computer
Science, vol. 10071, pp. 58–69. Springer, Cham (2016)12. Yao, A.C.: Protocols for secure computations. In: Proceedings of the
23rd Annual Symposium on Foundations of Computer Science. pp. 160–
164. FOCS ’82, IEEE Computer Society, Washington, DC, USA (1982).
https://doi.org/10.1109/SFCS.1982.88,
http://dx.doi.org/10.1109/SFCS.
1982.88