Single-Shuffle Full-Open Card-Based Protocols for Any Function

TL;DR

The paper resolves a long-standing question by proving that every function $f:in^n oin$ admits a single-shuffle full-open protocol in card-based secure computation, establishing two constructive approaches. One builds SSFO protocols from general Private Simultaneous Messages (PSM), yielding a general construction with card complexity $c2^{r+1}$, and the other leverages additive PSM to dramatically reduce the card count, achieving $O(n^2)$ cards for $ extsf{AND}_n$ and $O(n^2 2^n)$ cards for arbitrary $f$, at the cost of more intricate shuffles. The work further introduces partial-opening variants that reveal only a subset of cards to ease shuffle requirements while preserving privacy. By formalizing a bidirectional connection between SSFO and PSM, the authors relate card complexity to PSM's randomness and communication complexities, enabling principled trade-offs and improved scalability for a broad class of functions. These results significantly expand the practicality and applicability of card-based secure computation and illuminate new connections between cryptographic primitives and physical implementations.

Abstract

A card-based secure computation protocol is a method for $n$ parties to compute a function $f$ on their private inputs $(x_1,\ldots,x_n)$ using physical playing cards, in such a way that the suits of revealed cards leak no information beyond the value of $f(x_1,\ldots,x_n)$. A \textit{single-shuffle full-open} protocol is a minimal model of card-based secure computation in which, after the parties place face-down cards representing their inputs, a single shuffle operation is performed and then all cards are opened to derive the output. Despite the simplicity of this model, the class of functions known to admit single-shuffle full-open protocols has been limited to a few small examples. In this work, we prove for the first time that every function admits a single-shuffle full-open protocol. We present two constructions that offer a trade-off between the number of cards and the complexity of the shuffle operation. These feasibility results are derived from a novel connection between single-shuffle full-open protocols and a cryptographic primitive known as \textit{Private Simultaneous Messages} protocols, which has rarely been studied in the context of card-based cryptography. We also present variants of single-shuffle protocols in which only a subset of cards are revealed. These protocols reduce the complexity of the shuffle operation compared to existing protocols in the same setting.

Figures (5)

• Figure 1: A single-shuffle full-open protocol based on a PSM protocol
• Figure 2: A card-based protocol for multiplying inputs by $u\sample U$
• Figure 3: A card-based protocol for adding random additive shares of zeros to inputs
• Figure 4: A single-shuffle full-open protocol based on an additive PSM protocol
• Figure 5: A single-shuffle full-open protocol based on a single-shuffle full-open protocol for $\mathsf{AND}_n$

Theorems & Definitions (29)

• Definition 3.1
• Definition 3.2
• Proposition 3.3: Beimel et al. BKN18
• Proposition 3.4: Ishai Ish13
• Proposition 3.5: Shinagawa et al. SESN23
• Theorem 4.1
• proof
• Theorem 4.2
• Lemma 4.3
• proof