flipping coins

1
flipping coins

• over the telephone
• and other games

2
If Alice and Bob are on the phone

• and make a decision by flipping a coin,
• whats to keep the person with the coin from just
  asserting their preference, instead of reporting
  the actual result?

3

• Alice chooses two large prime numbers, p and q,
  both congruent to 3 mod 4. She keeps p and q
  secret but sends the product npq to Bob.
• Alice uses her knowledge of p and q to compute
  square roots of y mod n. There are four of them
  a, and b. One of them is x, but she doesnt
  know which. So she chooses one at random and
  sends it to Bob.
• Alice sends b to Bob.

• Bob chooses a secret x and computes yx2 mod n.
  He sends y to Alice.
• that was the flip
• If bx, then Bob tells Alice she wins. If b?x,
  then Bob wins.

4
Why should this be safe?

• If xa, (so Bob wins) then Bob can use his
  knowledge of all four square roots of y to factor
  n. He can prove he has won by telling Alice p
  and q.
• But if xb, then Bob should not be able to
  factor n and produce p and q. (Factoring is hard,
  thats why RSA is secure.)
• if xa, gcd(x-b,n) gives a non trivial factor
  of n.

5
And what keeps Alice honest?

• If Alice tried to send some random number rather
  than a square root of y?
• Bob can verify...
• that the square her number
• is congruent to y...
• And what if Alice sneaks in a third factor?
• Bob can ask her for..
• her factors and verify them.

6
Poker over the telephone
7
Bob and Alice agree on a large prime p.

• Alice chooses secret ? with gcd(?, p-1)1 and
  computes ?-1mod p-1.

• Bob chooses secret ? with gcd(?, p-1)1 and
  computes ? -1 mod p-1.

These values are good for one hand only.
The 52 cards are each assigned different numbers
mod p by some prearranged scheme.
8
a scheme
20051404
1030504
172105051404
1109140704
1001031104
9

• Alice chooses five of these, bi1,bi2,,bi5.
• Alice calculates bij? for her five cards, and
  sends them to Bob.
• Alice applies the power ?-1 to the five values
  this reveals her five card hand.
• Alice then sends five other bi values to Bob.

• Bob computes
• bici?mod p,
• and sends them all to Alice.
• Bob applies the power ?-1 to the five values he
  receives from Alice, and returns them.
• Who applies the power ?-1 to reveal his five card
  hand.

Dealing additional cards can continue in this
fashion. Betting is done as usual.
10
using number theory to cheat at telephone poker

• A number r mod p is a quadratic residue if there
  are solutions to the congruence x2r mod p. For
  a nonresidue n, there are no solutions to the
  congruence x2n mod p. The values 1,2,,p-1 are
  divided equally among the residues and
  nonresidues.
• It is easy to determine whether a number z is a
  residue or a nonresidue

11
And recall that since ? and ? were chosen
relatively prime to (p-1), they are both odd. A
card c is encrypted by Bob as bc?.
The encrypted card has the same residuosity as
the nonencrypted card. This would appear to give
Bob an advantage.
12
But if Alice knows some number theory, too, she
can also use this information about residues and
non residues to her advantage. She, after all,
deals the five cards to Bob, and can choose to
send him all residues or all nonresidues in any
combination that suits her need. She could even
suggest a prime where, for the encoding scheme
for cards, the high cards all fall in one group
or the other! Will Bob notice, after a few
hands, that he has been receiving only
nonresidues in his hand? Will Alice and Bob
continue to play together?