Distant Poker with Cheaters Presentation

How to Play Distant Poker with CheatersUsing Number Theory

Kelly Bresnahan

November 13, 2015

Table Of Contents

1 Flipping a Coin Over the Phone

IntroductionProcedureHow the Fair Coin Toss Procedure Guarantees FairnessDrawbacks to the Scheme

2 Distant Poker

Aspects of a Fair GameAnalogy of the Distant Poker SchemeProcedureHow to Cheat

Flipping a Coin Over the Phone: Introduction

It is difficult to perform a fair coin toss over the phone.For example,

”Alice is living in Anchorage and Bob is living in Baltimore. Afriend, not realizing that they are no longer together, leavesthem a car in his will. Bob phones Alice and says he’ll flip acoin. Alice chooses ”Tails” but Bob says ”Sorry, it was Heads.”So Bob gets the car.”

Is Bob telling the truth?

Introduction

We need a way for Alice to keep her choice a secret, while stillhaving to commit to that choice.

We also need a way for Bob to prove he is, or is not the winner

Fair Coin Toss Procedure

i) Alice chooses two large primes p and q such that p and qare congruent to 3 modulo 4. She then defines n = pq,sending n to Bob while keeping p and q secret.

ii) Bob chooses a random number x and computes

y ≡ x2 (mod n)

By definition y is a quadratic residue modulo n, therefore

x ≡ ±yp+14 (mod p)

andx ≡ ±y

q+14 (mod q)

y ≡ x2 (mod n)

x ≡ ±yp+14 (mod p)

andx ≡ ±y

q+14 (mod q)

y ≡ x2 (mod n)

x ≡ ±yp+14 (mod p)

andx ≡ ±y

q+14 (mod q)

Fair Coin Toss Procedure (cont)

iii) Bob keeps x secret and send y to Alice

iv) Alice finds ±a and ±b such that

x ≡ ±a (mod n) or x ≡ ±b (mod n)

Alice computes c ≡ yp+14 (mod p) and d ≡ y

q+14 (mod q)

Therefore x ≡ ±c (mod p) and x ≡ ±d (mod q)

Alice uses the Chinese Remainder Theorem to find the foursolutions:x ≡ ±a (mod n) or x ≡ ±b (mod n)

q+14 (mod q)

v) Alice chooses one solution at random, say ±b.

This is the flip.

vi) Alice send her choice to Bob

If ±b ≡ x (mod n), then Alice winsIf ±b 6≡ x (mod n), then Bob wins

v) Alice chooses one solution at random, say ±b.

This is the flip.

vi) Alice send her choice to Bob

If ±b ≡ x (mod n), then Alice winsIf ±b 6≡ x (mod n), then Bob wins

How Does this Prevent Cheating?

How can Bob prove he is the winner?

If Alice guesses b, but x = ±a (mod n), then Bob canfactor n.

- Computing gcd(x − b, n) will give a nontrivial factor of n.

If Bob cannot factor n, then he loses.

Can Alice cheat by sending a random integer b′ in place of ±aor ±b?

No, because Bob can always check to see that(b′)2 6≡ x (mod n)

Can Alice cheat by sending a random integer b′ in place of ±aor ±b?

No, because Bob can always check to see that(b′)2 6≡ x (mod n)

Can Alice cheat by sending Bob n = pqr , where p, q, and r arethree distinct primes?

She can, but this will actually reduce her chances ofwinning from 50% to 25% since there are now 8 squareroots of y

Can Alice cheat by sending Bob n = pqr , where p, q, and r arethree distinct primes?

She can, but this will actually reduce her chances ofwinning from 50% to 25% since there are now 8 squareroots of y

Can Bob purposefully lose?

Yes! Bob can always claim his value of x was exactly whatAlice sent him. Alice has no way of verifying this.

Can Bob purposefully lose?

Yes! Bob can always claim his value of x was exactly whatAlice sent him. Alice has no way of verifying this.

Distant Poker: Introduction

We have to assume that Alice and Bob are not trustful. Wewant to ensure that,

1 Alice is able to read her cards without Bob seeing them

2 Bob deals the cards out fairly

3 All cards are being used.

Analogy to Distant Poker Scheme

Bob takes 52 identical boxes, puts a card in each box, and putsa lock on each one of them. Then Alice puts her locks onBob’s boxes, so that each box has two locks.

This is akin to leaving the cards face down.

In addition, neither player is able to see the cards without theother person’s consent.

Procedure: Initialization

i) Alice and Bob agree on a large prime, p

ii) Alice picks a secret integer α such that gcd(α, p − 1) = 1

iii) Bob chooses a secret integer β such that gcd(β, p− 1) = 1

iv) Alice computes α′ such that αα′ = 1 (mod p − 1)

v) Bob computes β′ such that ββ′ = 1 (mod p − 1)

We ask for this so we can use Fermat’s theorem(ap−1 ≡ 1 (mod p))

Procedure: Dealing

vi) Each card is changed into a distinct integer ci (mod p) viasome scheme

vii) Bob computes bi ≡ cβi (mod p) for 1 ≤ i ≤ 52

viii) Bob randomly permutes (i.e. shuffles) the numbers andsends them to Alice

ix) Alice chooses five cards bi1 , bi2 , bi3 , bi4 , andbi5 andcomputes

bαij (mod p)

for 1 ≤ j ≤ 5(This is analogous to Alice encrypting, or locking her cardsso Bob can’t see them.)

Procedure: Dealing

bαij (mod p)

Procedure: Dealing

bαij (mod p)

Procedure: Dealing

bαij (mod p)

Procedure: Dealing

x) Alice sends her cards to Bob to take his locks off, i.e. tocompute

(bij)β′ = ((cβij )β

′)α = (cij)

α (mod p)

xi) Alice computes (cαij )α′

(mod p) = cij to unlock her cardsand get her hand

xii) Alice chooses 5 more numbers, bi , and sends them to Bob.This is his hand.

xiii) Bob raises his hand to β′ (mod p) to get his hand.

Procedure: Dealing

′)α = (cij)

α (mod p)

Procedure: Dealing

′)α = (cij)

α (mod p)

Procedure: Dealing

′)α = (cij)

α (mod p)

Procedure: Dealing

xiv) Alice now locks the remaining cards by raising each card toα (mod p).This ensures that neither Bob, nor Alice, can look at theremaining cards without the other’s consent.

Exchanging Cards

What if Alice wants to discard and pick up three new cards?

Alice takes her cards she wants to replace, ci and raisesthem to α (mod p)

She sends them to Bob, who computes cαβi (mod p)

Alice chooses three new cards and sends them to Bob,who raises them to β′

Alice raises her three new cards to α′ to unlock them.

Exchanging Cards

Cheating

Can Alice deduce Bob’s cards, or vice versa?

Probably not, as Alice would need to solve several discretelog problems which are generally assumed to be difficultwhen p is large.

But no game of poker would be complete without thepossibility of cheating.

Quadratic Residues

Definition: Quadratic Residue Modulo pAn integer r (mod p) is a quadratic residue modulo p if theequation

r = x2 (mod p)

has a solution.

n is a nonresidue if n = x2 (mod p) has no solutions.

Quadratic Residues

Definition: Quadratic Residue Modulo pAn integer r (mod p) is a quadratic residue modulo p if theequation

r = x2 (mod p)

has a solution.

n is a nonresidue if n = x2 (mod p) has no solutions.

Quadratic Residues

There is an easy way to tell whether or not an integerz 6≡ 0 (mod p) is a quadratic residue:

zp−12 ≡

{+1 (mod p) if z is a qudratic residue modulo p−1 (mod p) if z is a nonresidue modulo p

Quadratic Residues

Theorem: If c is a quadratic residue modulo p if and only ifcα, cβ, and cα

βare also quadratic residues.

Proof: Since gcd(α, p − 1) = gcd(β, p − 1) = 1, then α and βare odd, hence(

cβ) p−1

p−12

)β= (±1)β = ±1 (mod p)

Quadratic Residues

Theorem: If c is a quadratic residue modulo p if and only ifcα, cβ, and cα

βare also quadratic residues.

Proof: Since gcd(α, p − 1) = gcd(β, p − 1) = 1, then α and βare odd, hence(

cβ) p−1

p−12

)β= (±1)β = ±1 (mod p)

Cheating

Now all the cards in the deck fall into two sets: quadraticresiudes, R, and nonresidues N

Bob can more easily predict Alice’s cards

Alice can choose Bob’s hand so that they are all R’s, sohis hand is chosen from 26 cards instead of 52

Alice can choose p such that only the Ace, King, Queen,Jack, and Ten of Spades are quadratic residues.

She may now choose the five residues, i.e. the royal flushfor herself to win the game

Cheating

Questions

Distant Poker with Cheaters Presentation

Documents

Transcript of Distant Poker with Cheaters Presentation