Efficient Card-Based Majority Voting Protocols

Card-based cryptography is a variety of secure multiparty computation (MPC). Recently, a new technique called private operations was introduced because the protocol can be implemented with fewer cards than that by using the conventional technique called the shuffle. For example, Nakai et al. showed that if the private operations are available, secure computations of AND and OR operations for two inputs can be realized simultaneously by using four cards, and the protocol is applied to a four-card majority voting protocol with three inputs. This paper shows that only three cards are sufficient to construct a majority voting protocol with three inputs. Specifically, we propose two constructions of three-input majority voting protocols. One is a protocol assuming that players can announce their output, and the other is not allowed. Compared to Nakai et al.’s protocol, the protocol with the announcement is realized without any additional private operations and communications. On the other hand, the second construction requires two more private operations and communications because it removes the assumption on the announcement from the first construction. More importantly, the idea of the second protocol can be extended to an n-input majority voting protocol with n cards, which is the main result of this paper.


Background
Secure multiparty computation (MPC), introduced by Yao [12], allows players, each with input, to compute a function without revealing any information about their inputs other than what leaked from the output. MPC is usually realized using a computer, but den Boer showed that MPC of AND operation could be realized using five cards without using a computer [1]. Such MPC using physical cards like playing cards is called card-based cryptography.
Most of the existing works of card-based cryptography, e.g., [2,6], rely on a technique called a shuffle. In using the shuffle, we assume that cards are permuted in public repeatedly until all players cannot follow their order, for providing security. Note that the randomness in shuffles is assumed to be unknown to all players, including those who shuffle the deck of cards. Furthermore, since all shuffles are executed in public, a player who performs the shuffle cannot cheat. The shuffle is a technique involving such physical assumptions.
Instead of shuffles, Nakai et al. [8] and Marcedone et al. [4] independently introduced private permutations (or private operations), which are operations that a player permutes cards behind the player's back to conceal the operation from the other players. Private operations allow players to use private randomness and capture local computation in (ordinary) secure multiparty computation. However, instead of removing the physical assumptions on shuffles, private operations are vulnerable to malicious behavior in the private area. Hence, in this paper, we assume that card-based cryptography with private operations is executed under the semi-honest model, i.e., a model in which every player always follows a protocol. 1 Although we have to assume the semi-honest model, private operations are useful because they make existing protocols simpler and more efficient. Hence, several cardbased cryptographic protocols have been developed recently. For instance, the AND operation can be realized with only two or three cards (depending on the physical assumptions, e.g., players are allowed to announce their outputs) by using private operations [4], whereas the most efficient AND protocol using shuffles needs four cards (and relatively complicated procedures) [2]. The XOR and OR operations using private operations can be realized with two and three cards, respectively [7]. Furthermore, Nakai et al. [7] proposed a protocol that simultaneously computes AND and OR with four cards (called the AND/OR protocol) and showed that it could be used to construct a secure three-input majority voting protocol, which is a secure multiparty computation protocol that takes binary inputs from three players and outputs the result of majority voting. 2 In the above protocols using private operations, formats of inputs and outputs are not always consistent. The protocols that have the same format of inputs and outputs are called commitment. Usually, a binary input is represented by a commitment using a pair of cards such as 0 → ♣ ♥ and 1 → ♥ ♣ unless an upside-down card is used. In any protocol with the commitment format, two cards are necessary for each input, so at least four cards are necessary for computing a function with two inputs. 3 We note that when a binary input is represented by a commitment using a card such as 0 → ♣ and 1 → ♥, four cards are still needed to represent all possible inputs x ∈ {0, 1} 2 . This is a disadvantage of the protocols with committed formats, but it has an advantage that such protocols are easy to be combined securely.

Our Contributions
Proposal of majority voting protocols In this paper, we show that three cards are sufficient to construct a three-input majority voting protocol by using private operations. Specifically, we first construct a protocol that simultaneously computes logical AND, XOR, and NOR operations (for two binary inputs), called an AND/XOR/NOR protocol, using only three cards.
We then show a three-input majority voting protocol (Protocol 3: MAJ 3 wA) using our three-card AND/XOR/NOR protocol, whereas a three-input majority voting protocol is built on the AND/OR protocol by Nakai et al. [7]. The core idea of this construction is to allow players to announce their outputs to realize the OR operation based on the NOR operation. Namely, a player who gets the result of the NOR operation can announce the result of OR (not NOR), e.g., a player negates the value of NOR in the player's mind and tells the negated result (the value of OR) to other players by voice. However, such an announcement is not desirable since additional cards or assumptions are required compared to the case where announcements are not used. Fortunately, it is possible to remove the announcement without increasing the number of cards at the cost of two additional private operations. We propose such a protocol (Protocol 4: MAJ 3 ). Furthermore, we can extend the three-input majority voting protocol (MAJ 3 ) to n-input majority voting protocols using n cards (gMAJ n ) shown in Protocols 6 and 7. Based on the observations of MAJ 3 , we assume some of the procedures of an n-input majority voting protocol. As a result, we can construct gMAJ n by combining cyclic shifts of cards' sequences.
Efficiency comparisons The proposed protocols in this paper is more efficient than the previous ones. We compare our protocols with those of Nakai et al. [7] in the case of n = 3, and with those of Ono and Manabe [10] for general n.  #Priv. ops., #Comm., and #Cards mean the number of private operations, communications, and cards, respectively  Table 2 shows a comparison among Ono and Manabe's protocols [10] and proposed protocols gMAJ n (Protocols 6 and 7). Note that two Ono and Manabe's protocols can compute any logical function with n inputs, including n-input majority voting. Compared with the two Ono and Manabe's protocols, the number of cards and private operations are lower in gMAJ n . Regarding the number of communications, the second protocol of Ono and Manabe's protocol is much more efficient than gMAJ n . However, it requires an exponential number of cards.
Differences from the conference version This paper is the full version of [11]. In this paper, [11] is extended by newly proposing gMAJ n , n-input majority voting protocol, in Sect. 4 and Appendix A. In Sect. 4, the case where n is odd is mainly described. Since the case where n is even is almost the same as the case where n is odd, the details of the case where n is even are described in Appendix A.

Organization
The rest of this paper is organized as follows: in Sect. 2, we define notations, majority voting, and a left cyclic shift. Two three-input majority voting protocols are proposed in Sect. 3. The first one is the protocol with the announcement, and the second one is modified so that all operations are executed by cards only. Section 4 is devoted to extending the modified three-input majority voting protocol to an n-input majority voting protocol. We conclude this paper in Sect. 5. The details on the n-input majority voting protocol for even n, omitted in Sect. 4 due to similarities with the case of odd n, are given in Appendix A.

Notations
We use two kinds of cards such as ♣ and ♥ , where we assume that the cards with the same suit are indistinguishable. We also assume that all cards are indistinguishable if they are turned over, and they are denoted by ? . For simplicity, we omit the frame of cards hereafter, i.e., ♣, ♥, and ? are used instead of using ♣ , ♥ , and ? , respectively.
There are two models of card operations: a shuffle model and a private operation model. We adopt the latter model. According to [7,8], we design the proposed protocols based on the following operations of cards: -Permutation Permutation of face-down cards in public.
-Turn over Face-down or open cards.
-Private operation 4 Operations privately executed by a player, and their result is kept secret to the other players. -Announcement Operations which make some information public. The information to be announced can be computed privately by the announcer, but that cannot be represented by the cards running the protocol.
Private operations are assumed to be executed easily, for instance, behind the player's back. See [4,8] for details.

Majority Voting with Three Inputs
For three binary inputs a, b, c ∈ {0, 1}, we define the majority voting for three inputs by: which is also represented as [7]

Majority Voting with n-Inputs
For n binary inputs x 0 , x 1 , . . . , x n−1 ∈ {0, 1}, we define the threshold function for n inputs by: The ordinary majority voting is the case where t = n/2 .

Left Cyclic Shift
Suppose that there exists a sequence of n cards, which is represented by Note that numbers are written in order to specify the order of the cards. Then, a left cyclic shift over the n cards is defined as an operation such that the leftmost card of the sequence moves to the rightmost position of the sequence. The following shows the sequence of cards before and after a left cyclic shift of 5 cards. A left cyclic shift can also be performed over a part of the card sequence. For example, if we perform a left cyclic shift over the left three cards out of five, we get the following. The left cyclic shift has a feature that the order of the cards is restored after m left cyclic shifts over m cards.

Three-Input Majority Voting Protocol
In this section, we first propose a three-input majority voting protocol with announcement. This protocol is obtained from reducing a card from Nakai et al.'s four-card AND/OR protocol. Next, the three-input majority protocol is modified to be executable without announcement.
1) If a = 0, then Alice sends face-down ♣ to Bob. Otherwise, she sends face-down ♥ to Bob. 2) If b = 0, Bob places ♣ behind his back to the left of the card he received. Otherwise, he places ♥ behind his back to the right.

Outputs:
The left card represents a ∧ b, and the right card represents a ∨ b. If it is ♣, the output is 0; otherwise, 1. Table 3 Combinations of cards after Step 2) in four-card AND/OR protocol [7] a b Combinations of cards after Step 2) Based on this idea, Nakai et al. [7] proposed a four-card AND/OR protocol, which is described in Protocol 1. We note that this protocol requires four cards for representing all combinations of inputs, although only two cards are used to execute this protocol. Table 3 shows the combinations of cards after step 2) of this protocol for readers' convenience, where the subscript indicates who has the card. This protocol is obtained by merging a three-card AND protocol [4] and a three-card OR protocol [7].
In Protocol 1, binary inputs are encoded as which is used throughout this paper. Three-Card AND/XOR/NOR Protocol Based on Protocol 1, we propose a new cardbased protocol to compute AND/NOR simultaneously instead of computing AND/OR. The proposed protocol is implemented by three cards, which is a result of reducing one card from Protocol 1. Furthermore, the proposed protocol can compute XOR of two binary inputs simultaneously with AND/NOR. The application of this protocol to majority voting will be discussed in Sect. 3.1.
Idea behind the protocol To see our idea, we try to construct a new AND/OR protocol by reducing a card from Protocol 1 at first. In Protocol 1, Alice has ♥ and ♣ in the setup. It seems hard to reduce the number of her cards because she has to securely input her bit by a face-down card. Hence, if we can reduce the number of cards in Protocol 1, the only way is to reduce one card from Bob. Which one of ♣ or ♥ should Bob have? To answer this question, observe the following properties (see also Fig. 1): The properties (a)-(c) suggest Bob having ♣, and placing it to the leftmost of the cards he received from Alice if b = 0; otherwise, to the right. However, this approach obviously fails to realize (d) because a ∨ b = 1 holds, whereas ♣ is placed on the right.
Considering the above discussion of the difficulty in realizing the AND/OR protocol with three cards, we alternatively show that a secure AND/NOR protocol is realizable with three cards as follows (see also respectively. Recalling that ♣ indicates 0, properties (b') and (d') imply that it is possible to output ¬(a ∨ b) at the left of the cards if Alice prepares two cards a ¬a in step 1) instead of one card a in Fig. 1 and Bob places ♣ to the left if b = 0; otherwise, to the right.
Three-card AND/XOR/NOR protocol Observing Fig. 2, we find that the center of three cards is a in the case of b = 0, whereas it is ¬a in the case of b = 1. Noticing that a = a ⊕ 0 and ¬a = a ⊕ 1, the center of three cards indicates a ⊕ b, where ⊕ denotes the XOR operation. Therefore, surprisingly, the AND/NOR protocol discussed in Fig.  2 also succeeds in computing XOR simultaneously. Hence, we call this protocol as a card-based AND/XOR/NOR protocol. The card-based AND/XOR/NOR protocol can be described in Protocol 2. We show the combinations of cards after the Step 2) in Table 4 for readers' convenience.

MAJ 3 wA: Three-Card Majority Voting with Announcement
Although we failed to construct a three-card AND/OR protocol, we succeeded to construct the three-card AND/XOR/NOR protocol (Protocol 2). Even if the AND/XOR/NOR protocol is used instead of a AND/OR protocol, three-input majority voting can be easily constructed by allowing Carol to announce. If Carol inputs c = 1, she shall choose the card indicating ¬(a ∨ b) behind her back, and makes a ∨ b public by negating ¬(a ∨ b) in her mind. Making a ∨ b public is possible for Carol if she is allowed, for instance, to announce her output. 5 It is obvious that she can obtain no information other than a ∨ b in this process.
One might wonder if this announcement leaks important information since Carol can see a ∧ b (resp., a ∨ b) if c = 0 (resp., c = 1). We would like to note that it does not violate security since Carol eventually obtains the information from the output of the majority voting.

Protocol 3 MAJ 3 wA: Three-Input Majority Voting Protocol with Announcement
Inputs: Alice inputs a ∈ {0, 1}, Bob inputs b ∈ {0, 1}, and Carol inputs c ∈ {0, 1}. Setup: Alice has ♣ and ♥, Bob has ♣, and Carol has nothing at hand. 1) If a = 0, then Alice sends Bob face-down ♣♥ in this order. Otherwise, she sends face-down ♥♣ to Bob. 2) If b = 0, Bob places face-down ♣ at the left of the card pair he received. If b = 1, he places face-down ♣ at the right of the card pair. Then, he sends all face-down cards to Carol. 3) (Output) Carol opens the leftmost card behind her back if c = 0, and announces 1 (0) if the card she opens is ♥ (♣). If c = 1, she opens the rightmost card behind her back, and announces 1 (0) if the card she opens is ♣ (♥). Carol discard all cards in the deck.
In summary, the proposed protocol MAJ 3 wA is described in Protocol 3. For readers' convenience, we show in Table 5 all combinations of cards after the step 2) of Protocol 3, where the underline indicates the card that Carol opens behind her back. In the case of c = 1, we can see that the bit represented by the card she opens and the output she announces are flipped.

MAJ 3 : Three-Input Majority Voting Protocol Without Announcement
In this subsection, we show how we modify MAJ 3 wA in the previous subsection so that all the operations (including the output) are represented by cards without increasing the number of cards.

Construction Idea
To construct a card-based majority voting protocol with three inputs without announcement, we take another look at Eq.
3) If c = 0, Carol swaps the center card for the right one behind her back; otherwise, she does nothing.
Then, she sends them to Bob. 4) If b = 0, Bob swaps the center card for the left one behind his back; otherwise, he does nothing. Then, he sends them to Alice. 5) If a = 0, Alice swaps the center card for the left one behind her back; otherwise, she does nothing.
Then, Alice opens the leftmost card, and discards the others.
Output: If the card Alice opens at Step 5 is ♣, the output is 0; otherwise (if it is ♥), the output is 1.
In summary, (1) is equivalent to Suppose that Step 2) of MAJ 3 wA has been completed. Then, the leftmost card represents a ∧ b (see also Protocol 2 and Fig. 2), which is equivalent to the output of maj(a, b, c) in the case where a = b. Therefore, we additionally require the procedure that, the leftmost card is replaced by the card representing c if a = b, or otherwise it is untouched. The following two steps are sufficient so as to realize this requirement: Step A) Keeping the leftmost card representing a ∧ b, let the center card represent c if a = b.
Step B) Swap the leftmost and the center cards if a = b.
For realizing step A), observe that a ⊕ b = 1 and ¬(a ∨ b) = 0 hold in the case of a = b, and, after the Step 2) of Protocol 3, the center and the rightmost cards represent a ⊕ b and ¬(a ∨ b), respectively, (see Protocol 2 and Fig. 2). Hence, Carol can realize Step A) without knowing the actual values of a and b by swapping the center card for the right one (behind her back) if c = 0, or does nothing otherwise.
Realization of Step B) is easy: it is sufficient that Alice and Bob successively swap the left card for the center card if and only if his/her input is 0, since the swap is done only once if and only if a = b under this rule.

MAJ 3 : Three-Card Majority Voting for Three Inputs Without Announcement
Based on the construction idea, we construct MAJ 3 , a three-input majority voting protocol with three cards without any announce operations, which is described in Protocol 4. See also Fig. 3, where the question marks denote the face-down cards a player received from the previous player. In this section, we consider a more general setting, i.e., majority voting protocols with arbitrary-number inputs. However, unfortunately, the construction of MAJ 3 is specific to the three-input setting, so it seems hard to extend MAJ 3 itself to the arbitrarynumber input setting. Nevertheless, we construct an n-input majority voting protocol, called gMAJ n , for any n ≥ 4 based on the construction approach of MAJ 3 . Note that gMAJ n does not include MAJ 3 as a special case; indeed, gMAJ n for n = 3 does not work well.
The outline of our construction approach is as follows. First, based on the procedure of MAJ 3 , we assume gMAJ n has three phases (called placement, permutation, and output). In addition, we also assume the operations in the permutation phase and the output phase. Then, we deduce the card sequence in the placement phase based on the assumed permutation and output phase.

Our Construction Approach
First, we divide the procedures of our three-input protocol MAJ 3 into three phases as follows.
-Placement phase: Alice and Bob place all of three cards face down and perform private operations to generate a card sequence depending on the value of a and b (cf., Steps 1)-2)). -Permutation phase: Each player performs private operations to permute a part of the card sequence (cf., Steps 3)-5)). More concretely, these procedures can be organized into the following two sub-phases.
-Permutation phase 1: At Step 3), Carol swaps the center card for the rightmost one if c = 0.
-Permutation phase 2: At Steps 4) and 5), Bob and Alice swap the center card for the leftmost one if b = 0 and a = 0, respectively.
-Output phase: The protocol outputs the leftmost card of the card sequence.
Toward realizing n-input protocol gMAJ n , we abstract the above procedures as follows.
Suppose there are two groups (or two sets) of players, P l and P s , such that |P l | = |P s | + 1. 6 Let op l and op s be two distinct private operations. Then, the procedures of MAJ 3 can be abstracted as follows.
-Placement phase: All players in P l place all of three cards face down and perform private operations to generate a card sequence depending on their inputs. -Output phase: The protocol outputs the leftmost card of the card sequence.
In the case of MAJ 3 , Alice and Bob belong to the large group P l and Carol belongs to the small group P s . op l is the replacement of the center card with the leftmost one, and op s is the replacement of the center card with the rightmost one. We take the above constructing approach based on MAJ 3 : during the placement phase, all players in P l place all cards face down in the some order; during the permutation phase, each player performs private operations (i.e., op l or op s ) if the player's input is zero; and during the output phase, the protocol outputs the leftmost card of the card sequence. Note that players belonging to the same group perform the same operation in the permutation phases 1 and 2. Therefore, what we need to determine to realize gMAJ n is threefold: -The concrete card sequence at the end of the placement phase.
-How the players in P l generate the card sequence during the placement phase.
-The concrete procedures of op l and op s in the permutation phase.
To determine the above three for gMAJ n , particularly for the first one (i.e., to figure out the concrete card sequence), we take a closer look at MAJ 3 in the next subsection. We here describe the overview. First, we analyze how the private operations in MAJ 3 affect the output of the protocol. Namely, we analyze where the output card (i.e., the leftmost card at the output phase) is placed at each step in MAJ 3 . The analysis clarifies the minimum requirement of the card sequence at the end of the placement phase; it determines the suits and positions of some cards in the card sequence. In the subsection after that, we then extend the minimum requirement to the arbitrarynumber input setting, and determines the suits of the rest of cards as well as the concrete procedures during the placement and permutation phases, respectively. For simplicity, we describe card sequences in MAJ 3 by and , where denotes the output card of MAJ 3 , i.e., the leftmost card at the output phase. Namely, the card sequence at the output phase (or the output sequence) is represented as " ." Note that the output sequence (hence the output card) is always the above one for any a, b, c ∈ {0, 1}.
We begin with the analysis of the card sequences for any fixed a, b, c ∈ {0, 1} during the permutation phase. It is obvious that the card sequence after the permutation phase 2 (i.e., before the output phase) is " " for any a, b, c ∈ {0, 1}. How about the card sequence after Step 3), i.e., after the permutation phase 1? At Steps 4) and 5) (i.e., during the permutation phase 2), the leftmost card is swapped with the center one depending on the value of b and a, respectively. Therefore, we can summarize the card sequence after the permutation phase 1 in Table 6. If a + b = 1, the center card at the end of the permutation phase 1 will be used for the output of the protocol since the left and center cards are swapped once during the permutation phase 2; otherwise, the cards are swapped twice or not swapped at all during the permutation phase 2, so the leftmost card at the end of the permutation phase 1 will be used as the output card.
Next, to determine the card sequence at the beginning of the permutation phase, we look at the procedure at the permutation phase 1. If c = 0, the center card is swapped with the rightmost one. As can be seen in Table 6, the swap affects the position of the output card only when a + b = 1, and the position of the output card varies depending on the value of c. Therefore, we can summarize the card sequences at the beginning of the permutation phase in Table 7.
Due to the correctness of MAJ 3 , the suits of in Table 7 are uniquely determined; Table 8 shows the minimum requirement for the suits and positions of some cards in the Table 8 The minimum requirement of card sequences (at the beginning of the permutation phase) that MAJ 3 correctly works Table 9 Concrete card sequences at the beginning of the permutation phase card sequences at the beginning of the permutation phase, i.e., before Step 3). Table 9 shows the concrete card sequences in MAJ 3 , and one can see that the sequences meet the minimum requirement in Table 8. Moreover, one can also check that the placement phase of MAJ 3 , i.e., Steps 1) and 2), correctly generates the card sequences in Table 9 for any a, b ∈ {0, 1} by manually inputting all combinations of a, b ∈ {0, 1}.

Toy Example: the Case of n = 5
Based on the above observation, let us consider how to construct a five-input majority voting protocol gMAJ 5 as an example. Suppose that each player P i has a binary input x i ∈ {0, 1} for i ∈ {0, 1, . . . , 4}, and let P l := {P 0 , P 1 , P 2 } and P s := {P 3 , P 4 }. We assume gMAJ 5 's procedure as follows based on that of MAJ 3 . Note that, just as three cards are used in the case where n = 3, we also assume that five cards are used in the case where n = 5. The suit of each of the five cards is specified later.
-Placement phase: P 0 , P 1 , P 2 ∈ P l place all of five cards face down and perform private operations to generate a card sequence depending on their inputs. -Permutation phase: -Permutation phase 1: Each of P 3 , P 4 ∈ P s performs the private operation op s if the player's input is zero. -Permutation phase 2: Each of P 0 , P 1 , P 2 ∈ P l performs the private operation op l if the player's input is zero.
-Output phase: The protocol outputs the leftmost card of the card sequence.
As in the observation on MAJ 3 , we construct gMAJ 5 based on the above assumptions. Concretely, we first consider the card sequence during the permutation phase. Then, the requirement of card sequences at the beginning of the permutation phase is specified. Finally, we determine the suits of cards and the operations in the placement phase.  Table 11 Card sequences at the beginning of the permutation phase in gMAJ 5 , where Table 10, which is extended from Table 6 in the five-input setting, shows the expected card sequences after the permutation phase 1. Note that swapping two cards and a left cyclic shift over two cards are equivalent. Therefore, we consider the swapping in the permutation phase 2 in MAJ 3 as a left cyclic shift and extend it to the case of five inputs. That is, we assume that op l is the left cyclic shift over three cards on the left. As a result, the output card is placed at the leftmost position after the permutation phase 1 if P i ∈P l x i = 0 or P i ∈P l x i = 3 (= |P l |). Note that this is the same as we can see in MAJ 3 if a + b = 0 or a + b = 2. Then, at the end of the permutation phase 1 in gMAJ 5 , the output card is placed at the center of the sequence if the inputs of two players in P l will be zero (i.e., P i ∈P l x i = 1). Similarly, the output card is placed the second one from the left if only one player in P l will be zero, i.e., P i ∈P l x i = 2. Now, recall the private operation op s in MAJ 3 , i.e., the replacement of the center and rightmost cards, during the permutation phase 1; it can be also regarded as the left cyclic shift over two cards on the right. By extending it, we consider the following private operation as op s during the permutation phase 1 in gMAJ 5 : the left cyclic shift over four cards on the right.
By fixing op l and op s as above, we can find out the card sequences and the minimum requirement of card sequences at the beginning of the permutation phase (see Tables 11,  12, respectively).
The last issue we have to resolve is how the players place cards and perform private operations so that the resulting card sequence is consistent with the minimum requirement, op l , and op s . Through the second and third card sequences in Table 12, let us Protocol 5 gMAJ 5 : Five-Input Majority Voting Protocol 1. Inputs: P 0 , P 1 , . . . , P 4 have x 0 , x 1 , . . . , x 4 ∈ {0, 1}, respectively. 2. Setup: Publicly put a sequence of five face-down cards ♣♥♥♣♣ in this order. Then, P 0 receives the card sequence. 1) From i = 0 to i = 2, if x i = 0, then P i does nothing behind the player's back; otherwise, P i does a left cyclic shift behind the player's back over the two cards from the left of the received card sequence. Then, P i sends the cards to P i+1 . 2) From i = 3 to i = 4, if x i = 0, then P i does a left cyclic shift behind the player's back over the four cards from the right of the received card sequence; otherwise, P i does nothing behind the player's back. Then, P i sends the resulting card sequence to P (i+1 mod 5) . 3) From i = 0 to i = 2, if x i = 0, then P i does a left cyclic shift behind the player's back over the three cards from the left of the received card sequence; otherwise, P i does nothing behind the player's back. Then, if i = 2, P i sends the resulting card sequence to P i+1 . If i = 2, P 2 opens the leftmost card of the five cards, and discards the others. 3. Output: If the card P 2 opens at step 3) is ♣, the output is 0; otherwise (i.e., if the card is ♥,) the output is 1.

Table 12
The minimum requirement of card sequences (at the beginning of the permutation phase) that gMAJ 5 correctly works assume that the three cards on the right are the same regardless of any input of P l , i.e., x 0 , x 1 , and x 2 . From Table 12, the leftmost card should be ♣ if P i ∈P l x i = 0, whereas it should be ♥ if P i ∈P l x i = 3. Moreover, the second card from the left should be ♥ if P i ∈P l x i = 2. It means we need a certain private operation to make the protocol consistent. Hence, we set the private operation during the placement phase is the left cyclic shift over the two cards ♣ ♥ on the left, and each player in P l performs it if their input is one. Then, the cards ♣ ♥ are shifted left (swapped) P i ∈P l x i times, which satisfies the requirements shown in Table 12 because if P i ∈P l x i is even, the two cards result in ♣ ♥, and if P i ∈P l x i is odd, the two cards result in ♥ ♣. Consequently, an initial card sequence (i.e., a card sequence at the beginning of the placement protocol) should be ♣ ♥ ♥ ♣ ♣. Table 13 summarizes the concrete card sequences at the beginning of the permutation phase, and our five-input majority voting protocol gMAJ 5 is formally given in Protocol 5.
We note that we may construct different protocols if we make different assumptions about the number of cards, the procedure of the protocol (i.e., placement, permutation, and output phases), the operations op l and op s in the permutation phase, and the suits of three cards on the right (assumed for determining the placement phase).

Construction Idea for Arbitrary n
We generalize the above construction for n = 5 and construct gMAJ n , a majority voting protocol with n inputs. We assume gMAJ n 's generalized procedure for odd n = 2m + 1 and extend it to even n later. Suppose that each player P i has a binary input x i ∈ {0, 1} for i ∈ {0, 1, . . . , n}, and let P l := {P 0 , . . . , P m } and P s := {P m+1 , . . . , P 2m }. In the generalized procedure, the operations op s and op l in the permutation phases 1 and 2 are assumed to be a left cyclic shift refer to the case where n = 5. In addition, we assume to use n (= 2m + 1) cards, although the suit of each card is determined later.
-Placement phase: All of n cards are (publicly) placed face down in some order (will be determined as in gMAJ 5 ), and players P i ∈ P l perform private operations to generate a sequence of cards depending on their inputs. -Output phase: The protocol outputs the leftmost card of the card sequence.
By assuming the above procedure, all we have to do to construct an n-input majority voting protocol becomes to figure out the operations in the placement phase. As we constructed gMAJ 5 , we specify the placement phase by following steps: (1) Specify the position of the output card depending on players' inputs.
(2) Specify the requirement of card sequences which has to be satisfied at the beginning of the permutation phase. (3) Specify the suits of cards and operations in the placement phase to generate the card sequence satisfying the requirement.
Indeed, Tables 14, 15, and 16 support these steps, respectively, as in the case of gMAJ 5 in the previous subsection.  Table 15 The minimum requirement (at the beginning of the permutation phase) that gMAJ 2m+1 correctly works m i=0 x i Card sequence Odd Case: Majority Voting Protocol with 2m + 1 Inputs Where m ≥ 2 Based on the construction idea in Sect. 4.4, we construct an n-input majority voting protocol for n = 2m + 1, m ≥ 2 called gMAJ 2m+1 . By tracing the output card during the assumed permutation phase, the card sequence at the end of the placement phase can be represented as shown in Table 14. Note that the numbers 0, 1, . . . , 2m in the table's heading row indicate the index of the order in the sequence of cards.  Then, from the values of m i=0 x i and X (= 2m i=m+1 ), we can specify the suits of the output cards shown in Table 14 to compute the majority voting correctly. The specified result, which indicates the minimum requirement for the correctness of gMAJ 2m+1 , is represented in Table 15.
To specify the cards at the non-output positions in the sequences of cards after the placement phase, let us assume that m + 1 cards from the right are the same regardless of any input of P l , i.e., P 0 , P 1 , . . . , P m . Then, the m cards from the left can be considered to sequences of cards obtained by m i=0 x i times left cyclic shift over the m cards ♣ m−1 ♥ · · · ♥. Actually, by performing these operations, ♣ appears at the ((m − m i=0 x i ) mod m)-th leftmost place of the sequence and other places are filled by ♥. We can see that such a sequence satisfies the requirement shown in Table 15. Therefore, the specified sequences of cards and constructed protocol become as shown in Table 16 and Protocol 6, respectively.
Even Case: Majority Voting Protocol with 2m Inputs Where m ≥ 2 Next, for n = 2m, m ≥ 2, we consider to construct an n-input majority voting protocol, called gMAJ 2m , in the same way as for n = 2m + 1. In this case, we consider two types of majority voting protocols, one computes maj m 2m , and the other computes maj m+1 2m . 7 Suppose that each player P i has a binary input x i ∈ {0, 1} for i ∈ {0, 1, . . . , 2m − 1}. Basically, we can construct gMAJ 2m in the same way as for gMAJ 2m+1 in Sect. 4.5, but we need to be careful about how to divide the players into two groups P l and P s . Our construction framework works well if 2m players are divided into m + 1 players and m − 1 players, i.e., |P l | = m + 1 and |P s | = m − 1.
(See Appendix A for details.) However, suppose that 2m players are divided into two groups so that |P l | = |P s | = m holds, i.e., P 0 , P 1 , . . . , P m−1 ∈ P l and P m , P m+1 , . . . , P 2m−1 ∈ P s . Then, our approach to construct a majority voting protocol does not work well because the minimum requirement for the correctness of gMAJ 2m cannot be satisfied.
Let us consider the computation of maj m 2m at first. In this case, the leftmost card of the card sequence cannot be determined uniquely when m−1 i=0 x i = 0. Concretely, if there exists at least one of players in P s inputs 0, i.e., 2m−1 i=m x i < m, then the leftmost card has to be ♣ (because 2m−1 i=0 x i < 0 + m = m); otherwise, it has to be ♥ (because 2m−1 i=0 x i = 0 + m = m). Since choosing one of ♣ or ♥ does not allow the other condition to be satisfied at the same time, the approach of dividing the players into two groups of equal numbers does not work. Table 17 shows the situation.
Analogously, in the computation of maj m+1 2m , the leftmost card cannot be uniquely determined when m−1 i=0 x i = m. If all players in P s input 0, i.e., 2m−1 i=m x i = 0, then the leftmost card when m−1 i=0 x i = m has to be ♣, otherwise, it has to be ♥. Thus, we cannot achieve both requirements, which results in our construction approach not working well for the case where |P l | = |P s | = m.

Conclusion
We showed efficient card-based majority voting protocols under the assumption of private operations. Our three-input majority voting protocols (called MAJ 3 wA and MAJ 3 ) are implemented by only three cards, whereas previous work requires four cards [7]. MAJ 3 wA (Protocol 3) uses an AND/XOR/NOR hybrid protocol (Protocol 2) obtained by modifying the AND/OR protocol proposed by Nakai et al. [7]. Our idea of transforming the AND/XOR/NOR protocol to MAJ 3 wA is to allow Carol to announce her output. To get rid of this extra condition, we proposed MAJ 3 (Protocol 4) that enables us to output the result of majority voting by a card without announcement. In addition, n-input majority voting protocols using n cards (Protocols 6 and 7: called gMAJ n ) were constructed with combinations of cyclic shifts by deciding a part of the protocol procedures based on the observations of MAJ 3 .
Recalling that eight cards are sufficient for realizing three-input majority voting protocols using shuffle operations [9], the proposed protocols (and Nakai et al.'s protocols [7]) are very efficient thanks to the power of private operations [8]. Proving the optimality of MAJ 3 wA and MAJ 3 for three-input majority voting or that of gMAJ n for n-input majority voting is important future work. Note that since a (natural) lower bound of the number of cards required to a protocol seems to be the number of bits required for encoding the result (e.g., for the majority voting, the sum of all inputs, i.e., log 2 (n + 1) ), there also seems to be room for improvements. On the other hand, it is easy to see that the proposed AND/XOR/NOR protocol (Protocol 2) is optimal in terms of the number of cards since three cards are obviously necessary for representing three respective outputs (AND/XOR/NOR) simultaneously.
In this paper, we assume that players are semi-honest, and we did not use the announcement, which was used in MAJ 3 wA, in the extended protocol gMAJ n . However, it could be future work to consider protocols that allow other operations such as the announcement or those in other security settings, e.g., there are malicious players who do not follow the protocol. Furthermore, it is also challenging to propose Protocol 7 gMAJ 2m : (2m)-Input Majority Voting Protocol Inputs: P 0 , P 1 , . . . , P 2m−1 have x 0 , x 1 , . . . , x 2m−1 ∈ {0, 1}, respectively.
Setup: Publicly put 2m face-down cards ♣ m−1 ♥ · · · ♥ ♦ m−1 ♣ · · · ♣ in this order. Note that ♥ (resp., ♣) is placed in the position of ♦ when we compute maj m 2m (resp., maj m+1 2m ). Then, P 0 receives these 2m cards. 1) From i = 0 to i = m, if x i = 0, then P i does nothing behind the player's back; otherwise, P i does a right cyclic shift behind the player's back over the m cards from the left of the received cards. Then, P i sends the cards to P i+1 . 2) From i = m + 1 to i = 2m − 1, if x i = 0, then P i does a left cyclic shift behind the player's back over the 2m − 1 cards from the right of the received cards; otherwise, P i does nothing behind the player's back. Then, P i sends the cards to P (i+1 mod 2m) . a method to construct a protocol for any given application by generalizing existing studies' methods that construct a protocol for a given application.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
We assume gMAJ 2m 's procedure as follows. Moreover, we assume that n (= 2m) cards are used.
-Placement phase: All of n cards are (publicly) placed face down in some order, and players P i ∈ P l perform private operations to generate a sequence of cards depending on their inputs. -Permutation phase: -Permutation phase 1: Each player P i ∈ P s (i ∈ {m + 1, . . . , 2m − 1}) performs the left cyclic shift over n − 1 (= 2m − 1) cards on the right as the private operation op s if x i = 0. · · · m + 1 · · · · · · -Permutation phase 2: Each player P i ∈ P l (i ∈ {0, . . . , m + 1} performs the left cyclic shift over m + 1 cards on the left as the private operation op l if x i = 0.
-Output phase: The protocol outputs the leftmost card of the card sequence.
Then, based on the construction idea in Sect. 4.4, the card sequences after the placement phase and the minimum requirement for computing maj m 2m (or maj m+1 2m ) correctly can be represented as shown in Tables 18 and 19, respectively. To specify the cards at the non-output positions in the sequences of cards after the placement phase, let us assume that m cards from the right are the same regardless of P l . Then, m cards from the left can be considered to sequences of cards obtained by m i=0 x i times left cyclic shift over the m cards ♣ m−1 ♥ · · · ♥. Actually, by performing the operations, ♣ appears at the ((m − m i=0 x i ) mod m)-th leftmost place in the sequence and other places are filled by ♥. We can see that such a sequence satisfies the requirement shown in Table 19. Therefore, the specified sequences of cards and constructed protocol become as shown in Table 20 and Protocol 7, respectively.