flipping coinsflipping coins

over the telephoneover the telephone

and other gamesand other games

If Alice and Bob are on the phoneIf Alice and Bob are on the phone

and make a decision by flipping a coin, and make a decision by flipping a coin,

what’s to keep the person with the coin what’s to keep the person with the coin from just asserting their preference, from just asserting their preference, instead of reporting the actual result?instead of reporting the actual result?

Alice chooses two large prime Alice chooses two large prime numbers, p and q, both numbers, p and q, both congruent to 3 mod 4. She congruent to 3 mod 4. She keeps p and q secret but keeps p and q secret but sends the product n=pq to sends the product n=pq to Bob.Bob.

Alice uses her knowledge of p Alice uses her knowledge of p and q to compute square roots and q to compute square roots of y mod n. There are four of of y mod n. There are four of them: them: ++a, and a, and ++b. One of b. One of them is x, but she doesn’t them is x, but she doesn’t know which. So she chooses know which. So she chooses one at random and sends it to one at random and sends it to Bob.Bob.

Alice sends b to Bob.Alice sends b to Bob.

Bob chooses a secret x and Bob chooses a secret x and computes y=xcomputes y=x22 mod n. He mod n. He sends y to Alice.sends y to Alice.

that was the “flip”

If b=If b=++x, then Bob tells Alice x, then Bob tells Alice she wins. If bshe wins. If b++x, then Bob x, then Bob wins.wins.

Why should this be safe?Why should this be safe?

If x=If x=++a, (so Bob wins) then Bob can use a, (so Bob wins) then Bob can use his knowledge of all four square roots of y his knowledge of all four square roots of y to factor n.* He can prove he has won by to factor n.* He can prove he has won by telling Alice p and q.telling Alice p and q.

But if x=But if x=++b, then Bob should not be able to b, then Bob should not be able to factor n and produce p and q. (Factoring is factor n and produce p and q. (Factoring is hard, that’s why RSA is secure.)hard, that’s why RSA is secure.)

*if x=*if x=++a, gcd(x-b,n) gives a non trivial factor of n.a, gcd(x-b,n) gives a non trivial factor of n.

And what keeps Alice honest?And what keeps Alice honest?

If Alice tried to send some random number If Alice tried to send some random number rather than a square root of y?rather than a square root of y?

Bob can verifyBob can verify….………….. that the square her number that the square her number is congruent to yis congruent to y….………..

And what if Alice sneaks in a third factor?And what if Alice sneaks in a third factor?Bob can ask her forBob can ask her for……….. her factors and verify them.her factors and verify them.

Poker over the telephonePoker over the telephone

Alice chooses secret Alice chooses secret with gcd(with gcd(, p-1)=1 and , p-1)=1 and computes computes -1-1mod p-1.mod p-1.

Bob chooses secret Bob chooses secret with gcd(with gcd(, p-1)=1 and , p-1)=1 and computes computes -1-1 mod p-1. mod p-1.

Bob and Alice agree on a large prime p.

These values are good for one hand only.

The 52 cards are each assigned

different numbers mod p

by some prearranged scheme.

a schemea scheme

1030504

1109140704

172105051404

1001031104

20051404

Alice chooses five of these, bAlice chooses five of these, bi1i1,b,bi2i2,,

…,b…,bi5i5..

Alice calculates bAlice calculates bijij for her five for her five

cards, and sends them to Bob.cards, and sends them to Bob.

Alice applies the power Alice applies the power -1-1 to the to the five values; this reveals her five values; this reveals her five card hand.five card hand.

Alice then sends five other bAlice then sends five other b ii

values to Bob.values to Bob.

Bob computesBob computes

bbii=c=ciimod p, mod p,

and sends them all to Alice.and sends them all to Alice.

Bob applies the power Bob applies the power -1-1 to the to the five values he receives from five values he receives from Alice, and returns them.Alice, and returns them.

Who applies the power Who applies the power -1-1 to to reveal his five card hand.reveal his five card hand.

Dealing additional cards can continue in this fashion. Betting is done as usual.

using number theory to cheat at using number theory to cheat at telephone pokertelephone poker

A number r mod p is a A number r mod p is a quadratic residuequadratic residue if there if there are solutions to the congruence xare solutions to the congruence x22=r mod p. =r mod p. For a For a nonresidue nonresidue n, there are n, there are no no solutions to solutions to the congruence xthe congruence x22=n mod p. The values 1,2,=n mod p. The values 1,2,…,p-1 are divided equally among the residues …,p-1 are divided equally among the residues and nonresidues.and nonresidues.

It is easy to determine whether a number z is a It is easy to determine whether a number z is a residue or a nonresidue:residue or a nonresidue:

nonresiduequadraticaiszifp

residuequadraticaiszifpzp

mod1

mod12

1

And recall that since and were chosen relatively prime to (p-1), they are both odd. A card c is encrypted by Bob as b=c.

pcccppp

mod21

21

21

The encrypted card has the same residuosity as the nonencrypted card.

This would appear to give Bob an advantage.

But if Alice knows some number theory, too, she can also use this information about residues and non residues to her advantage. She, after all, deals the five cards to Bob, and can choose to send him all residues or all nonresidues in any combination that suits her need.

She could even suggest a prime where, for the encoding scheme for cards, the high cards all fall in one group or the other!

Will Bob notice, after a few hands, that he has been receiving only nonresidues in his hand?

Will Alice and Bob continue to play together?