I suspect that this is already something trivial, but I can't find the answer, probably because I don't know how to search the cryptographic primitive that refers to my problem.

Imagine the typical card trick from your favorite magician. He/She offers you one random card, and you take one card where the magician doesn't know which card is. After that, the trick consists in guessing the card, doing their things.

My question is... Is it possible to have a protocol that resembles the first part? It would be something like, user authenticates to the server, and the server sends one, and only one, card (or any other information segment), where it's guaranteed that the server that sent the card doesn't know which card was sent to that user.

Thanks in advance.

  • $\begingroup$ What if the user encrypts each card in the deck using a PRP and returns a shuffled deck? Then the server can perform an additional shuffle of the encrypted cards and return one card. The user can then decrypt the card. Disadvantage: the other cards are still encrypted. You could send the decryption key afterwards, but the server can then of course deduct which card is missing. Maybe you'd need a card identifier and card specific key? $\endgroup$ – Maarten Bodewes Feb 4 '20 at 14:02
  • $\begingroup$ Maarten, that solution is interesting, I didn't thought of that solution. But in that case, how does the server know, that the encrypted cards are actually encrypted cards, and not anything else, random numbers? The server also needs to return a valid response. $\endgroup$ – FairLight Feb 5 '20 at 11:17
  • $\begingroup$ Couldn't pedersen commitments allow the user to send a picked card without reveal which card it is? $\endgroup$ – VincBreaker Feb 5 '20 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.