Private Function Evaluation with Cards

Abstract Card-based protocols allow to evaluate an arbitrary fixed Boolean function $$f$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>f</mml:mi> </mml:math> on a hidden input to obtain a hidden output, without the executer learning anything about either of the two (e.g., [12]). We explore the case where $$f$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>f</mml:mi> </mml:math> implements a universal function, i.e., $$f$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>f</mml:mi> </mml:math> is given the encoding $$\langle P \rangle$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mo>⟨</mml:mo> <mml:mi>P</mml:mi> <mml:mo>⟩</mml:mo> </mml:mrow> </mml:math> of a program $$P$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>P</mml:mi> </mml:math> and an input $$x$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>x</mml:mi> </mml:math> and computes $$f(\langle P \rangle , x) = P(x)$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>f</mml:mi> <mml:mo>(</mml:mo> <mml:mo>⟨</mml:mo> <mml:mi>P</mml:mi> <mml:mo>⟩</mml:mo> <mml:mo>,</mml:mo> <mml:mi>x</mml:mi> <mml:mo>)</mml:mo> <mml:mo>=</mml:mo> <mml:mi>P</mml:mi> <mml:mo>(</mml:mo> <mml:mi>x</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:math> . More concretely, we consider universal circuits, Turing machines, RAM machines, and branching programs, giving secure and conceptually simple card-based protocols in each case. We argue that card-based cryptography can be performed in a setting that is only very weakly interactive, which we call the “surveillance” model. Here, when Alice executes a protocol on the cards, the only task of Bob is to watch that Alice does not illegitimately turn over cards and that she shuffles in a way that nobody knows anything about the total permutation applied to the cards. We believe that because of this very limited interaction, our results can be called program obfuscation . As a tool, we develop a useful sub-protocol $${{\mathrm{\mathsf {sort}}}}_{\varPi }{X} {\uparrow } Y$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msub> <mml:mi>sort</mml:mi> <mml:mi>Π</mml:mi> </mml:msub> <mml:mi>X</mml:mi> <mml:mo>↑</mml:mo> <mml:mi>Y</mml:mi> </mml:mrow> </mml:math> that couples the two equal-length sequences $$X, Y$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>X</mml:mi> <mml:mo>,</mml:mo> <mml:mi>Y</mml:mi> </mml:mrow> </mml:math> and jointly and obliviously permutes them with the permutation $$\pi \in \varPi$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>π</mml:mi> <mml:mo>∈</mml:mo> <mml:mi>Π</mml:mi> </mml:mrow> </mml:math> that lexicographically minimizes $${\pi }(X)$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>π</mml:mi> <mml:mo>(</mml:mo> <mml:mi>X</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:math> . We argue that this generalizes ideas present in many existing card-based protocols. In fact, AND, XOR, bit copy [37], coupled rotation shuffles [30] and the “permutation division” protocol of [22] can all be expressed as “coupled sort protocols”.