Physical Cryptography

Abstract

We recall a series of physical cryptography solutions and provide the reader with relevant security analyses. We mostly turn our attention to describing attack scenarios against schemes solving Yao’s millionaires’ problem, protocols for comparing information without revealing it and public key cryptosystems based on physical properties of systems.

Appendices

A Recreational Cryptographic Problems

The interest of the cryptographic community regarding various recreational cryptography problems has grown in time. We further recall a series of physical cryptographic solutions which appeared in the literature. Note that our list of recreational cryptographic problems is, by no means, extensive.

“Finding Waldo” Solution. The authors of [17] provide an insight on how to convince people about knowing Waldo’s location without revealing it. We initially assume that Alice and Bob have a large piece of cardboard¹⁸. As a first step, Alice cuts a Waldo shaped hole in the middle of the cardboard. To prove that she knows where Waldo is, Alice puts the shape precisely on top of Waldo while Bob is not looking and then calls Bob to check. Given the previous steps of the protocol, Bob learns nothing about the location of Waldo. Next, Alice must prove that she has the correct Waldo picture. Therefore, she must pull the book beneath the cardboard in front of Bob’s eyes without revealing information about the place from which she is pulling the book¹⁹.

“Ali Baba Cave” Solution. A well known story for explaining the intuition behind zero knowledge protocols is presented in [19]. The story is about a magical cave shaped like a ring with an entrance on one side as well as a magical door blocking the opposite side. We assume that Alice discovers the secret magical word that opens the door and wants to prove to Bob that she knows the secret without revealing it. Thus, they agree to label the left and right paths from the entrance head and tail. The protocol proceeds as follows. Bob waits outside the cave as Alice goes in. Then, Alice flips a coin to determine the path she follows. Note that Bob is not allowed to see which path she takes. Bob enters the cave, flips a coin and shouts the outcome. If Alice knows the magical word she opens the door, if necessary, and returns along the path chosen by Bob. If she lied about knowing it, then she has a $50\%$ chance of returning through the correct path (i.e. by guessing Bob’s outcome). If they repeat this protocol multiple times, the chance of Alice tricking Bob decreases. Thus, if Alice always exits through the right path, Bob can conclude that Alice really knows the secret word.

“Locked Boxes” Solution. A classical method for explaining symmetric encryption is through the use of “impenetrable” locked boxes (see [4, 5]). More precisely, Alice and Bob both have a copy of the key that opens a chest. To exchange messages, Alice simply puts her letter in the box, locks it and sends it to Bob. Since Bob has an identical copy of the key, he opens the chest and reads the letter. Another protocol that can be explained using locked boxes is Shamir’s three-pass protocol [14]. First, Alice puts her message in a box, locks it with her private padlock and sends it to Bob. Then, Bob places his private padlock on the box and sends it back to Alice. Once she receives the box, she removes her padlock and sends the box to Bob. Finally, Bob removes his padlock and reads Alice’s message. In order to popularize cryptography to non-specialized audiences, the authors of [4] used a toolbox or a loose chain to implement the previous physical example of Shamir’s protocol. The authors point out it is easy to prove²⁰ to audiences that a persistent code-breaker could always dismantle a padlock, or X-ray it, and hence crack the code (i.e. knowing the inside of the lock is isomorphic to knowing the key). Thus, we have to employ other techniques than the secrecy of the encryption method.

By relaxing the security requirements from an “impenetrable” box to a tamper-evident box (i.e. the receiver can detect if someone managed to open the box) the authors of [15, 16] devise a series of secure protocols.

Ciphers Based on a Deck of Cards. Schneier designed the “Solitaire” cipher [20] for the book “Cryptonomicon” [23]²¹. Solitaire was intended to be the first truly secure “pen and paper” cipher. It requires only a pack of cards both for encryption and decryption. A similar example is the “Mirdek” cipher [7].

“PEZ Dispenser” Solution. In [3] the authors present a solution for voting using a PEZ dispenser. Consider a group of kids wishing to vote between two candidates without revealing anything except the final outcome. Assume that they have a PEZ dispenser, which may be previously loaded with some publicly known sequence of red and yellow candies. The kids take turns. Each one decides how many candies to pop out of the dispenser according to his vote. Note that no other kid can see the number or the colors of these candies. Also, it is forbidden for the participants to weight the dispenser and, thus, deduce the number of remaining candies. When this process ends, the color of the candy on top has to correspond to the correct majority vote. The voting process is completed when one of the kids pops an additional candy and announces its color.

“Phonebook” Solution. Khovanova recalls on her blog [13] that, for explaining one-way functions, Micali used the following example of encryption. We start by assuming that Alice and Bob obtain the same edition of the white pages book for a particular town. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encrypted version of that letter. To decrypt the message Bob has to read through the whole book to find all the numbers. The decryption will take a lot more time than the encryption. Unfortunately, the technology changes and the example is not up to date anymore: reverse look-up is always possible in a digital world. Furthermore, regarding the security of the scheme, an $8^{\text {th}}$ grader said: “If I were Bob, I would just call all the phone numbers and ask their last names.” A similar example may be found in [4]. Such examples are very good for teaching one-way functions to non-mathematicians.

“Colors” Solution. The Diffie-Hellman protocol can be depicted using colors as further presented. An illustration using common paint may be found in [2]. The idea, first proposed by Simon Singh [22], relies on two properties of colors: it is easy to mix two colors and given a color that was obtained by mixing two other colors, it is difficult to reverse the process²². As a specific example, we may assume that yellow is a public color. Let us further consider that Alice’s secret color is blue and that Bob’s secret color is red . The parties wish to agree on a new shared secret color. In the first step, Alice sends green to Bob (i.e. the result of yellow mixed with blue ). Then, Bob sends orange to Alice (i.e. the result of yellow mixed with red ). By mixing the received color with the secret color, each party obtains the common secret brown (i.e. Alice mixes orange with her blue and Bob mixes green with red ).

Although insecure²³, the digital version of the above protocol is a good teaching tool e.g. when trying to explain beginners how to use colors in the case of programming languages used in web development.

B Physical Public Key Encryption

We further present a generic protocol based on the protocols described in [11]. Alice and Bob have access to a physical medium characterized by a parameter p(t), such that p(t) has two components $p = p_a(t) \circ p_b(t)$, where $\circ$ is a group law and $p_a(t)$, $p_b(t)$ can randomly be changed by varying t. In her private spaces U and V, Alice and Bob secretly vary $p_a(t)$ and, respectively, $p_b(t)$. Note that Eve only has access to p(t). First Alice and Bob randomly vary $p_a(t)$ and $p_b(t)$. When they agree to synchronize²⁴, Alice and Bob stabilize their parameters $p_a(t') = a$ and $p_b(t') = b$. Bob can measure $p(t') = a \circ b$ and deduce Alice’s value a. Similarly, Alice can compute b.

Example. We consider the setup from Sect. 2.3. Thus, the components that Alice and Bob vary are their corresponding speeds values a and b. Once the system is stabilized Bob can deduce a using the attack we described in Sect. 2.3, but Eve can only deduce $b-a$.