Post on 22-Jan-2018
How to Play Distant Poker with CheatersUsing Number Theory
Kelly Bresnahan
November 13, 2015
Table Of Contents
1 Flipping a Coin Over the Phone
IntroductionProcedureHow the Fair Coin Toss Procedure Guarantees FairnessDrawbacks to the Scheme
2 Distant Poker
Aspects of a Fair GameAnalogy of the Distant Poker SchemeProcedureHow to Cheat
Flipping a Coin Over the Phone: Introduction
It is difficult to perform a fair coin toss over the phone.For example,
”Alice is living in Anchorage and Bob is living in Baltimore. Afriend, not realizing that they are no longer together, leavesthem a car in his will. Bob phones Alice and says he’ll flip acoin. Alice chooses ”Tails” but Bob says ”Sorry, it was Heads.”So Bob gets the car.”
Is Bob telling the truth?
Introduction
We need a way for Alice to keep her choice a secret, while stillhaving to commit to that choice.
We also need a way for Bob to prove he is, or is not the winner
Fair Coin Toss Procedure
i) Alice chooses two large primes p and q such that p and qare congruent to 3 modulo 4. She then defines n = pq,sending n to Bob while keeping p and q secret.
ii) Bob chooses a random number x and computes
y ≡ x2 (mod n)
By definition y is a quadratic residue modulo n, therefore
x ≡ ±yp+14 (mod p)
andx ≡ ±y
q+14 (mod q)
Fair Coin Toss Procedure
i) Alice chooses two large primes p and q such that p and qare congruent to 3 modulo 4. She then defines n = pq,sending n to Bob while keeping p and q secret.
ii) Bob chooses a random number x and computes
y ≡ x2 (mod n)
By definition y is a quadratic residue modulo n, therefore
x ≡ ±yp+14 (mod p)
andx ≡ ±y
q+14 (mod q)
Fair Coin Toss Procedure
i) Alice chooses two large primes p and q such that p and qare congruent to 3 modulo 4. She then defines n = pq,sending n to Bob while keeping p and q secret.
ii) Bob chooses a random number x and computes
y ≡ x2 (mod n)
By definition y is a quadratic residue modulo n, therefore
x ≡ ±yp+14 (mod p)
andx ≡ ±y
q+14 (mod q)
Fair Coin Toss Procedure (cont)
iii) Bob keeps x secret and send y to Alice
iv) Alice finds ±a and ±b such that
x ≡ ±a (mod n) or x ≡ ±b (mod n)
Alice computes c ≡ yp+14 (mod p) and d ≡ y
q+14 (mod q)
Therefore x ≡ ±c (mod p) and x ≡ ±d (mod q)
Alice uses the Chinese Remainder Theorem to find the foursolutions:x ≡ ±a (mod n) or x ≡ ±b (mod n)
Fair Coin Toss Procedure (cont)
iii) Bob keeps x secret and send y to Alice
iv) Alice finds ±a and ±b such that
x ≡ ±a (mod n) or x ≡ ±b (mod n)
Alice computes c ≡ yp+14 (mod p) and d ≡ y
q+14 (mod q)
Therefore x ≡ ±c (mod p) and x ≡ ±d (mod q)
Alice uses the Chinese Remainder Theorem to find the foursolutions:x ≡ ±a (mod n) or x ≡ ±b (mod n)
Fair Coin Toss Procedure (cont)
iii) Bob keeps x secret and send y to Alice
iv) Alice finds ±a and ±b such that
x ≡ ±a (mod n) or x ≡ ±b (mod n)
Alice computes c ≡ yp+14 (mod p) and d ≡ y
q+14 (mod q)
Therefore x ≡ ±c (mod p) and x ≡ ±d (mod q)
Alice uses the Chinese Remainder Theorem to find the foursolutions:x ≡ ±a (mod n) or x ≡ ±b (mod n)
Fair Coin Toss Procedure (cont)
iii) Bob keeps x secret and send y to Alice
iv) Alice finds ±a and ±b such that
x ≡ ±a (mod n) or x ≡ ±b (mod n)
Alice computes c ≡ yp+14 (mod p) and d ≡ y
q+14 (mod q)
Therefore x ≡ ±c (mod p) and x ≡ ±d (mod q)
Alice uses the Chinese Remainder Theorem to find the foursolutions:x ≡ ±a (mod n) or x ≡ ±b (mod n)
Fair Coin Toss Procedure (cont)
iii) Bob keeps x secret and send y to Alice
iv) Alice finds ±a and ±b such that
x ≡ ±a (mod n) or x ≡ ±b (mod n)
Alice computes c ≡ yp+14 (mod p) and d ≡ y
q+14 (mod q)
Therefore x ≡ ±c (mod p) and x ≡ ±d (mod q)
Alice uses the Chinese Remainder Theorem to find the foursolutions:x ≡ ±a (mod n) or x ≡ ±b (mod n)
Fair Coin Toss Procedure (cont)
v) Alice chooses one solution at random, say ±b.
This is the flip.
vi) Alice send her choice to Bob
If ±b ≡ x (mod n), then Alice winsIf ±b 6≡ x (mod n), then Bob wins
Fair Coin Toss Procedure (cont)
v) Alice chooses one solution at random, say ±b.
This is the flip.
vi) Alice send her choice to Bob
If ±b ≡ x (mod n), then Alice winsIf ±b 6≡ x (mod n), then Bob wins
How Does this Prevent Cheating?
How can Bob prove he is the winner?
If Alice guesses b, but x = ±a (mod n), then Bob canfactor n.
- Computing gcd(x − b, n) will give a nontrivial factor of n.
If Bob cannot factor n, then he loses.
How Does this Prevent Cheating?
How can Bob prove he is the winner?
If Alice guesses b, but x = ±a (mod n), then Bob canfactor n.
- Computing gcd(x − b, n) will give a nontrivial factor of n.
If Bob cannot factor n, then he loses.
How Does this Prevent Cheating?
How can Bob prove he is the winner?
If Alice guesses b, but x = ±a (mod n), then Bob canfactor n.
- Computing gcd(x − b, n) will give a nontrivial factor of n.
If Bob cannot factor n, then he loses.
How Does this Prevent Cheating?
How can Bob prove he is the winner?
If Alice guesses b, but x = ±a (mod n), then Bob canfactor n.
- Computing gcd(x − b, n) will give a nontrivial factor of n.
If Bob cannot factor n, then he loses.
How Does this Prevent Cheating?
Can Alice cheat by sending a random integer b′ in place of ±aor ±b?
No, because Bob can always check to see that(b′)2 6≡ x (mod n)
How Does this Prevent Cheating?
Can Alice cheat by sending a random integer b′ in place of ±aor ±b?
No, because Bob can always check to see that(b′)2 6≡ x (mod n)
How Does this Prevent Cheating?
Can Alice cheat by sending Bob n = pqr , where p, q, and r arethree distinct primes?
She can, but this will actually reduce her chances ofwinning from 50% to 25% since there are now 8 squareroots of y
How Does this Prevent Cheating?
Can Alice cheat by sending Bob n = pqr , where p, q, and r arethree distinct primes?
She can, but this will actually reduce her chances ofwinning from 50% to 25% since there are now 8 squareroots of y
How Does this Prevent Cheating?
Can Bob purposefully lose?
Yes! Bob can always claim his value of x was exactly whatAlice sent him. Alice has no way of verifying this.
How Does this Prevent Cheating?
Can Bob purposefully lose?
Yes! Bob can always claim his value of x was exactly whatAlice sent him. Alice has no way of verifying this.
Distant Poker: Introduction
We have to assume that Alice and Bob are not trustful. Wewant to ensure that,
1 Alice is able to read her cards without Bob seeing them
2 Bob deals the cards out fairly
3 All cards are being used.
Analogy to Distant Poker Scheme
Bob takes 52 identical boxes, puts a card in each box, and putsa lock on each one of them. Then Alice puts her locks onBob’s boxes, so that each box has two locks.
This is akin to leaving the cards face down.
In addition, neither player is able to see the cards without theother person’s consent.
Analogy to Distant Poker Scheme
Bob takes 52 identical boxes, puts a card in each box, and putsa lock on each one of them. Then Alice puts her locks onBob’s boxes, so that each box has two locks.
This is akin to leaving the cards face down.
In addition, neither player is able to see the cards without theother person’s consent.
Analogy to Distant Poker Scheme
Bob takes 52 identical boxes, puts a card in each box, and putsa lock on each one of them. Then Alice puts her locks onBob’s boxes, so that each box has two locks.
This is akin to leaving the cards face down.
In addition, neither player is able to see the cards without theother person’s consent.
Procedure: Initialization
i) Alice and Bob agree on a large prime, p
ii) Alice picks a secret integer α such that gcd(α, p − 1) = 1
iii) Bob chooses a secret integer β such that gcd(β, p− 1) = 1
iv) Alice computes α′ such that αα′ = 1 (mod p − 1)
v) Bob computes β′ such that ββ′ = 1 (mod p − 1)
Procedure: Initialization
i) Alice and Bob agree on a large prime, p
ii) Alice picks a secret integer α such that gcd(α, p − 1) = 1
iii) Bob chooses a secret integer β such that gcd(β, p− 1) = 1
iv) Alice computes α′ such that αα′ = 1 (mod p − 1)
v) Bob computes β′ such that ββ′ = 1 (mod p − 1)
Procedure: Initialization
i) Alice and Bob agree on a large prime, p
ii) Alice picks a secret integer α such that gcd(α, p − 1) = 1
iii) Bob chooses a secret integer β such that gcd(β, p− 1) = 1
iv) Alice computes α′ such that αα′ = 1 (mod p − 1)
v) Bob computes β′ such that ββ′ = 1 (mod p − 1)
Note
We ask for this so we can use Fermat’s theorem(ap−1 ≡ 1 (mod p))
Procedure: Dealing
vi) Each card is changed into a distinct integer ci (mod p) viasome scheme
vii) Bob computes bi ≡ cβi (mod p) for 1 ≤ i ≤ 52
viii) Bob randomly permutes (i.e. shuffles) the numbers andsends them to Alice
ix) Alice chooses five cards bi1 , bi2 , bi3 , bi4 , andbi5 andcomputes
bαij (mod p)
for 1 ≤ j ≤ 5(This is analogous to Alice encrypting, or locking her cardsso Bob can’t see them.)
Procedure: Dealing
vi) Each card is changed into a distinct integer ci (mod p) viasome scheme
vii) Bob computes bi ≡ cβi (mod p) for 1 ≤ i ≤ 52
viii) Bob randomly permutes (i.e. shuffles) the numbers andsends them to Alice
ix) Alice chooses five cards bi1 , bi2 , bi3 , bi4 , andbi5 andcomputes
bαij (mod p)
for 1 ≤ j ≤ 5(This is analogous to Alice encrypting, or locking her cardsso Bob can’t see them.)
Procedure: Dealing
vi) Each card is changed into a distinct integer ci (mod p) viasome scheme
vii) Bob computes bi ≡ cβi (mod p) for 1 ≤ i ≤ 52
viii) Bob randomly permutes (i.e. shuffles) the numbers andsends them to Alice
ix) Alice chooses five cards bi1 , bi2 , bi3 , bi4 , andbi5 andcomputes
bαij (mod p)
for 1 ≤ j ≤ 5(This is analogous to Alice encrypting, or locking her cardsso Bob can’t see them.)
Procedure: Dealing
vi) Each card is changed into a distinct integer ci (mod p) viasome scheme
vii) Bob computes bi ≡ cβi (mod p) for 1 ≤ i ≤ 52
viii) Bob randomly permutes (i.e. shuffles) the numbers andsends them to Alice
ix) Alice chooses five cards bi1 , bi2 , bi3 , bi4 , andbi5 andcomputes
bαij (mod p)
for 1 ≤ j ≤ 5(This is analogous to Alice encrypting, or locking her cardsso Bob can’t see them.)
Procedure: Dealing
x) Alice sends her cards to Bob to take his locks off, i.e. tocompute
(bij)β′ = ((cβij )β
′)α = (cij)
α (mod p)
xi) Alice computes (cαij )α′
(mod p) = cij to unlock her cardsand get her hand
xii) Alice chooses 5 more numbers, bi , and sends them to Bob.This is his hand.
xiii) Bob raises his hand to β′ (mod p) to get his hand.
Procedure: Dealing
x) Alice sends her cards to Bob to take his locks off, i.e. tocompute
(bij)β′ = ((cβij )β
′)α = (cij)
α (mod p)
xi) Alice computes (cαij )α′
(mod p) = cij to unlock her cardsand get her hand
xii) Alice chooses 5 more numbers, bi , and sends them to Bob.This is his hand.
xiii) Bob raises his hand to β′ (mod p) to get his hand.
Procedure: Dealing
x) Alice sends her cards to Bob to take his locks off, i.e. tocompute
(bij)β′ = ((cβij )β
′)α = (cij)
α (mod p)
xi) Alice computes (cαij )α′
(mod p) = cij to unlock her cardsand get her hand
xii) Alice chooses 5 more numbers, bi , and sends them to Bob.This is his hand.
xiii) Bob raises his hand to β′ (mod p) to get his hand.
Procedure: Dealing
x) Alice sends her cards to Bob to take his locks off, i.e. tocompute
(bij)β′ = ((cβij )β
′)α = (cij)
α (mod p)
xi) Alice computes (cαij )α′
(mod p) = cij to unlock her cardsand get her hand
xii) Alice chooses 5 more numbers, bi , and sends them to Bob.This is his hand.
xiii) Bob raises his hand to β′ (mod p) to get his hand.
Procedure: Dealing
xiv) Alice now locks the remaining cards by raising each card toα (mod p).This ensures that neither Bob, nor Alice, can look at theremaining cards without the other’s consent.
Exchanging Cards
What if Alice wants to discard and pick up three new cards?
Alice takes her cards she wants to replace, ci and raisesthem to α (mod p)
She sends them to Bob, who computes cαβi (mod p)
Alice chooses three new cards and sends them to Bob,who raises them to β′
Alice raises her three new cards to α′ to unlock them.
Exchanging Cards
What if Alice wants to discard and pick up three new cards?
Alice takes her cards she wants to replace, ci and raisesthem to α (mod p)
She sends them to Bob, who computes cαβi (mod p)
Alice chooses three new cards and sends them to Bob,who raises them to β′
Alice raises her three new cards to α′ to unlock them.
Exchanging Cards
What if Alice wants to discard and pick up three new cards?
Alice takes her cards she wants to replace, ci and raisesthem to α (mod p)
She sends them to Bob, who computes cαβi (mod p)
Alice chooses three new cards and sends them to Bob,who raises them to β′
Alice raises her three new cards to α′ to unlock them.
Exchanging Cards
What if Alice wants to discard and pick up three new cards?
Alice takes her cards she wants to replace, ci and raisesthem to α (mod p)
She sends them to Bob, who computes cαβi (mod p)
Alice chooses three new cards and sends them to Bob,who raises them to β′
Alice raises her three new cards to α′ to unlock them.
Exchanging Cards
What if Alice wants to discard and pick up three new cards?
Alice takes her cards she wants to replace, ci and raisesthem to α (mod p)
She sends them to Bob, who computes cαβi (mod p)
Alice chooses three new cards and sends them to Bob,who raises them to β′
Alice raises her three new cards to α′ to unlock them.
Cheating
Can Alice deduce Bob’s cards, or vice versa?
Probably not, as Alice would need to solve several discretelog problems which are generally assumed to be difficultwhen p is large.
But no game of poker would be complete without thepossibility of cheating.
Quadratic Residues
Definition: Quadratic Residue Modulo pAn integer r (mod p) is a quadratic residue modulo p if theequation
r = x2 (mod p)
has a solution.
n is a nonresidue if n = x2 (mod p) has no solutions.
Quadratic Residues
Definition: Quadratic Residue Modulo pAn integer r (mod p) is a quadratic residue modulo p if theequation
r = x2 (mod p)
has a solution.
n is a nonresidue if n = x2 (mod p) has no solutions.
Quadratic Residues
There is an easy way to tell whether or not an integerz 6≡ 0 (mod p) is a quadratic residue:
zp−12 ≡
{+1 (mod p) if z is a qudratic residue modulo p−1 (mod p) if z is a nonresidue modulo p
Quadratic Residues
Theorem: If c is a quadratic residue modulo p if and only ifcα, cβ, and cα
βare also quadratic residues.
Proof: Since gcd(α, p − 1) = gcd(β, p − 1) = 1, then α and βare odd, hence(
cβ) p−1
2=
(c
p−12
)β= (±1)β = ±1 (mod p)
Quadratic Residues
Theorem: If c is a quadratic residue modulo p if and only ifcα, cβ, and cα
βare also quadratic residues.
Proof: Since gcd(α, p − 1) = gcd(β, p − 1) = 1, then α and βare odd, hence(
cβ) p−1
2=
(c
p−12
)β= (±1)β = ±1 (mod p)
Cheating
Now all the cards in the deck fall into two sets: quadraticresiudes, R, and nonresidues N
Bob can more easily predict Alice’s cards
Alice can choose Bob’s hand so that they are all R’s, sohis hand is chosen from 26 cards instead of 52
Alice can choose p such that only the Ace, King, Queen,Jack, and Ten of Spades are quadratic residues.
She may now choose the five residues, i.e. the royal flushfor herself to win the game
Cheating
Now all the cards in the deck fall into two sets: quadraticresiudes, R, and nonresidues N
Bob can more easily predict Alice’s cards
Alice can choose Bob’s hand so that they are all R’s, sohis hand is chosen from 26 cards instead of 52
Alice can choose p such that only the Ace, King, Queen,Jack, and Ten of Spades are quadratic residues.
She may now choose the five residues, i.e. the royal flushfor herself to win the game
Cheating
Now all the cards in the deck fall into two sets: quadraticresiudes, R, and nonresidues N
Bob can more easily predict Alice’s cards
Alice can choose Bob’s hand so that they are all R’s, sohis hand is chosen from 26 cards instead of 52
Alice can choose p such that only the Ace, King, Queen,Jack, and Ten of Spades are quadratic residues.
She may now choose the five residues, i.e. the royal flushfor herself to win the game
Questions