Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have spent some time studying the "Mental Poker" protocol (sometimes called SRA), initially proposed by Shamir, Rivest, and Adleman --

Much of the current literature surrounding SRA deals with implementations, most of which seek to address specific problems like handling of the virtual card deck, player dropouts, and so on. I understand these to be protocol problems, not algorithmic problems or problems specific to the cryptosystem (algorithm + key generation and management). I'm interested in finding flaws or weaknesses within the cryptosystem.

So far I've noted:

  • Information leakage via quadratic residues / non-residues with a prime modulus (Legendre symbol)
  • Unpadded or poorly padded "plaintext" numerical values
  • Potentially novel approaches to the discrete logarithm problem (such as
  • Short key lengths (similar to RSA key-pair bit lengths)
  • Use of a composite modulus rather than a prime
  • Weak Pseudo-Random Number Generator

Assuming one can sufficiently address known performance issues (like Crepeau's 8-hour-long card deal), does SRA have additional known weaknesses or drawbacks? Would some RSA caveats apply here too?

I noted the answer to What is the theoretical and practical status of mental poker?. This was an excellent reply but I did not notice mention of specific publications such as Don Coppersmith's "Cheating at Mental Poker".

I appreciate your comments.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.