The Landscape of Computing Symmetric $n$-Variable Functions with $2n$ Cards

TL;DR

This work investigates card-based secure multi-party computation for symmetric $n$-variable Boolean functions, aiming for card-minimal protocols that use exactly $2n$ cards. It formalizes a classification via NPN-equivalence and surveys existing protocols across $n$ up to seven, identifying open problems. The main contribution is a new $2n$-card protocol for the $k$Mod3$ function that computes whether the sum of inputs is congruent to $k$ modulo $3$ for any $n\ge 3$, built from subprotocols for randomness, $\mathbb{Z}/3\mathbb{Z}$ encoding, and modular addition, with correctness and security proven via a KWH-tree. The results achieve card-minimality in this function family and place the work in the context of known $2n$-card protocols, highlighting remaining open classes for $n=4,5,6,7$ and offering a pathway toward broader card-minimal constructions. The work thus advances practical card-based secure MPC and provides concrete techniques for modular counting in distributed settings.

Abstract

Secure multi-party computation using a physical deck of cards, often called card-based cryptography, has been extensively studied during the past decade. Card-based protocols to compute various Boolean functions have been developed. As each input bit is typically encoded by two cards, computing an $n$-variable Boolean function requires at least $2n$ cards. We are interested in optimal protocols that use exactly $2n$ cards. In particular, we focus on symmetric functions. In this paper, we formulate the problem of developing $2n$-card protocols to compute $n$-variable symmetric Boolean functions by classifying all such functions into several NPN-equivalence classes. We then summarize existing protocols that can compute some representative functions from these classes, and also solve some open problems in the cases $n=4$, 5, 6, and 7. In particular, we develop a protocol to compute a function $k$Mod3, which determines whether the sum of all inputs is congruent to $k$ modulo 3 ($k \in \{0,1,2\}$).