Evaluating card-based protocols in terms of execution time

Card-based cryptography is an attractive and unconventional computation model; it provides secure computing methods using a deck of physical cards. It is noteworthy that a card-based protocol can be easily executed by non-experts such as high school students without the use of any electric device. One of the main goals in this discipline is to develop efficient protocols. The efficiency has been evaluated by the number of required cards, the number of colors, and the average number of protocol trials. Although these evaluation metrics are simple and reasonable, it is difficult to estimate the total number of operations or execution time of protocols based only on these three metrics. Therefore, in this paper, we consider adding other metrics to estimate the execution time of protocols more precisely. Furthermore, we actually evaluate some of the important existing protocols using our new criteria.


Introduction
Card-based protocols are unconventional computing methods using a deck of physical cards; their advantage is that they can be executed by humans practically (e.g., [4,8,11,16]). To illustrate this, let us explain how to manipulate Boolean values based on a two-colored deck of cards. Given a black card An earlier version of this paper was presented at the 17th International Conference on Unconventional Computation and Natural Computation, Fontainebleau, France, June [25][26][27][28][29]2018, and appeared in Proc. UCNC 2018, Lecture Notes in Computer Science, vol. 10867, Springer, pp.145-158, 2018 [7]. B Daiki Miyahara daiki.miyahara.q4@dc.tohoku.ac.jp Takaaki Mizuki tm-paper+cardtime@g-mail.tohoku-university.jp 1 Graduate School of Information Sciences, Tohoku University, 6-3 Aramaki-Aza-Aoba, Aoba, Sendai 980-8578, Japan 2 National Institute of Advanced Industrial Science and Technology, 2-3-26, Aomi, Koto-ku, Tokyo 135-0064, Japan 3 Graduate School of Science and Technology, Nara Institute of Science and Technology, 8916-5 Takayama, Ikoma, Nara 630-0192, Japan 4 Cyberscience Center, Tohoku University, 6-3 Aramaki-Aza-Aoba, Aoba, Sendai 980-8578, Japan ♣ and a red card ♥ , a Boolean value can be expressed as: Following this encoding, for example, two players, Alice and Bob, can each put two cards face down on a table, representing their private bits a and b, respectively: Here, we assume that the backs ? of all cards are indistinguishable and that the fronts ♣ or ♥ are also indistinguishable if the cards have the same color. We call the left pair of two face-down cards in (2) a commitment to a. Similarly, the right pair of two face-down cards are a commitment to b. Typically, given two input commitments to a, b ∈ {0, 1}, as in (2), a card-based protocol should generate a commitment to the value of a predetermined function f (a, b). For instance, we can get a commitment to a ∧ b without leaking any information about a and b, if we execute an AND protocol:  As in Table 1, there are many existing AND protocols (in committed format 1 ). This table implies that the design of "efficient" protocols is one of the goals of card-based protocols; so far, the efficiency has been evaluated in terms of three metrics: (i) the number of required cards, (ii) the number of colors, and (iii) the average number of required trials. These evaluation metrics are simple and reasonable. However, if we are going to actually execute a card-based protocol, these three metrics are insufficient to accurately estimate the number of operations that need to be done during the protocol and the overall execution time of the protocol. Therefore, in this paper, we introduce new metrics to evaluate protocol efficiency more precisely. That is, we determine all the operations during a protocol to help analyze the execution time. Furthermore, we actually evaluate all the AND protocols 2 shown in Table 1, based on our new criteria by counting the number of operations thoroughly. As an application example, we also make a comparison of the AND protocols and discuss which protocol is the most efficient and practical.
The rest of this paper is organized as follows: In Sect. 2, we introduce the AND protocol invented by Stiglic [23] as an example and then give a formalization of the operations in card-based protocols [10]. In Sect. 3, we give new metrics of efficiency, which directly indicate the execution time of a protocol. In Sect. 4, we evaluate the existing AND protocols based on our proposed metrics. In Sect. 5, we conduct a further investigation into evaluation of the execution time. We conclude this study in Sect. 6.
An earlier version of this paper was presented and appeared as a conference paper [7]. The difference is as follows. This paper takes the AND protocol recently proposed by Abe et. al. [1] into account, so that Sect. 3.2.4 along with Fig. 8 has been added and Sect. 4 has been updated. Furthermore, this paper first creates a full version of the KWH-tree [6] of the Crépeau-Kilian AND protocol [3] as Fig. 6 in Sect. 3.2.2 and that of the Niemi-Renvall AND protocol [15] 1 There are also "non-committed-format" AND protocols [2,9]. 2 This paper addresses only AND computation because the other important primitive, XOR, can be done with only four cards and one trial [13].
as Fig. 7 in Sect. 3.2.3. In addition, this paper investigates the execution time of rearrangement operations for cards more precisely; Sect. 5 is devoted to this new treatment.

Preliminaries: a protocol with operations
In this section, we introduce Stiglic's AND protocol [23] as an example to demonstrate the possible operations in cardbased protocols. It should be noted that card-based protocols are outside the Turing model [10,12].
As seen in Table 1, Stiglic's protocol requires a twocolored deck of eight cards and two average trials. Given input commitments to a and b along with four additional cards ♣ ♣ ♥ ♥ , the protocol proceeds as follows: 1. Arrange the sequence as: The term "random cut" means a cyclic shuffle. If we attach numbers to the cards for the sake of convenience: Note that a random cut is known to be easily implemented by humans securely via the Hindu cut [25] as shown in Fig. 3 iii. If the three face-up cards are ♣ ♥ ♣ or ♥ ♣ ♥ , turn them over and go back to Step 2.
This is Stiglic's AND protocol, which we denote by P Sti hereinafter. A shuffling operation called a random cut is used in Step 2 of P Sti . The average number of trials is two, because the probability that Step 3-(c)-iii occurs and we go back to Step 2 is 1 2 . As seen partially in the description of P Sti , the possible operations used in card-based protocols (not just Stiglic's but others that have not been described thus far) are turningover, rearrangement, and shuffling operations, which can be formalized as follows [10]. Below, we assume a sequence of d cards = (α 1 , α 2 , . . . , α d ).
1. Turning-over operation: (turn, i). A turn operation involves turning over the ith card α i , as shown in Fig. 1. The resulting sequence is where β i is obtained by turning over α i . A perm operation involves the application of a permutation π ∈ S d (where S d represents the symmetric group of degree d) to the sequence, as illustrated in Fig. 2. The resulting sequence is 3. Shuffling operation: (shuffle, , F). A shuffle operation involves the application of a permutation π ∈ chosen from a permutation set ⊆ S d according to a probability distribution F. See Fig. 3 again for an example of a shuffle. Note that a set along with a distribution F specifies a shuffle. We simply write (shuffle, ) if F is uniform.
We define for a cyclic permutation (i 1 i 2 · · · i ) such that i 1 < i 2 < · · · < i . Note that the random cut in Stiglic's protocol can be expressed as (shuffle, RC {1,2,3,4,5,6,7,8} ). protocols. In other words, the efficiency evaluation metrics shown in Table 1, i.e., the number of required cards, the number of colors, and the average number of trials, are insufficient to estimate the overall execution time. In Sect. 3.1, we clarify all the operations that need to be considered. In Sect. 3.2, we count the number of occurrences of each operation for every AND protocol. In Sect. 3.3, we provide new metrics to estimate the execution time of protocols.

Operations to consider
In addition to the three kinds of operations, i.e., turn, perm, and shuffle, introduced in Sect. 2, we define another operation, named add. The add operation involves the addition of a card to the sequence with its face up (in order for players to be able to confirm the color), as shown in Fig. 4. When actually executing a protocol that requires additional cards, this add operation is necessary.
Therefore, altogether, the actual execution of a card-based protocol invokes four kinds of operations: add, turn, perm, and shuffle.

Analysis of the number of operations in each protocol
In this subsection, we analyze the number of operations in each of the seven existing AND protocols shown in Table 1.
To this end, we use the KWH-tree [6] developed by Koch, Walzer, and Härtel, which is a diagram showing the state transition.
Let us take the KWH-tree of P Sti shown in Fig. 5 as an example to explain the notation of the KWH-tree. Each box is associated with the "visible sequence trace" that means transitions of a sequence of cards visible from the table during the execution of the protocol. In each box, there are sequences of colors and the associated polynomials next to them. A polynomial represents the conditional probability that the current sequence is compatible with the associated sequence of colors (given the visible sequence trace), where X i j denotes the probability that the input is (i, j).

Stiglic's protocol
We first analyze P Sti in detail. The KWH-tree of P Sti is shown in Fig. 5. This figure enables us to count all the operations appearing in P Sti , as follows: 1. The number of add (adding a card) operations The number of add operations in P Sti is four, because we add four cards to execute the protocol.

The number of turn(turning over a card) operations
Firstly, we execute the turn operation four times, because we need to turn over the four added cards after checking their colors. Secondly, we require the turn operation twice because of (turn, {1, 2}) after applying the first random cut. At this time, the probability that ♣ ♣ or ♥ ♥ appears and the protocol terminates is 1 8 ×2. On the other hand, the probability that the protocol terminates by (turn, {3}) is If the protocol does not terminate by (turn, {3}), we have to turn over the three face-up cards and execute (turn, {1, 2}) again after applying a random cut. Consequently, the expected number of turn operations in P Sti is

The number of perm (rearranging a sequence of cards) operations
We use no perm operation in P Sti , and hence, the number of utilizations of the perm operation is 0. 4. The number of shuffle (shuffling a sequence of cards) operations As seen in the calculation for turn, the probability that P Sti terminates by (turn, {1, 2}) is 1 4 . The probability that P Sti terminates by (turn, {3}) is 1 4 , and the probability that P Sti does not terminate and gets into a loop is 1 2 . Therefore, the expected number of shuffle operations is 2.
Thus, the numbers of add, turn, perm, and shuffle operations are 4, 12.5, 0, and 2, respectively. See the line of P Sti in Table 2.

Crépeau and Kilian's protocol
We also create the KWH-tree of P CK (Crépeau and Kilian's protocol [3]) as shown in Fig. 6, which tells us that the numbers of add, turn, perm, and shuffle operations are 6, 21, 1, and 8, respectively. See the line of P CK in Table 2.

Niemi and Renvall's protocol
The KWH-tree of P NR is shown in Fig. 7, from which we can count the numbers of operations as shown in Table 2.

Abe, Hayashi, Mizuki, and Sone's protocol
The KWH-tree of P AHMS is shown in Fig. 8, from which we can count the numbers of operations as shown in Table 2.

The others
The KWH-tree of P MS (Mizuki and Sone's protocol [13]) has been given in some existing literatures (e.g., [6,12]). Utilizing this KWH-tree, we are able to count each operation in P MS . Table 2 summarizes the result.
In addition, we conducted the same calculation for the two KWH protocols [6]. Table 3 shows the number of operations in the protocols. These protocols need shuffles which have non-uniform probability distributions, 3 and hence, they need special indistinguishable boxes or envelopes [16] to be implemented. Therefore, we have judged that these two protocols are more time-consuming than the other five protocols. Therefore, in the sequel, we focus on the five protocols in Table 2, which we call "practical" AND protocols.

Execution time of protocols
In this subsection, we present an expression for the execution time of each protocol based on four metrics. First, we denote the execution time of add, turn, perm, and shuffle by t add , t turn , t perm , and t shuf , respectively. In addition, Time (P) denotes the overall execution time of a protocol P. Then, the execution time of the protocols in Table 2 can be simply expressed as follows:

Niemi & Renvall's protocol (P NR ):
Time (P NR ) = 8t add + 28t turn + 2.5t perm + 7.5t shuf . Note that we use (six) perm * in this figure for avoiding the KWH-tree to be complicated; the original P CK in [3] does not use them, and we do not count the number of them for Table 2 Fig. 7 P NR 's KWH-tree, where X 0 = X 00 + X 01 + X 10 and X 1 = X 11 . The above left part makes two copied commitments to a, the above right part makes two copied commitments to b, and the bottom part produces a commitment to a ∧ b from these four commitments 3. Stiglic's protocol (P Sti ): Time (P Sti ) = 4t add + 12.5t turn + 2t shuf .
In the next section, we make a comparison to determine the most efficient and practical protocol.

Comparison of the protocols
In this section, we evaluate the efficiency of the five practical AND protocols in Table 2 and discuss which protocol is the most efficient.

Efficiency comparison based on the execution time
In this subsection, we compare the execution times of the protocols. First, we compare each coefficient of equation shown in Sect. 3.3 or Table 2. Obviously, we obtain the following inequalities: Therefore, P Sti is superior to P CK and P NR .
Next, we compare P Sti with P MS . At first glance, the coefficients might give us an impression that P MS would be better than P Sti . However, we cannot immediately come to a con-  [1], where X 0 = X 00 + X 01 + X 10 and X 1 = X 11 clusion because Time (P MS ) has 2t perm , while Time (P Sti ) has no t perm . Therefore, we actually measured the duration of each operation by manipulating real cards. For its experimental method and detailed result, see Appendix A. As a result, our measurement provides us the following relationship: t add = t turn and 0.1t perm < t turn . ( Moreover, it is reasonable to assume that because the shuffling operation generally takes more time than the rearrangement operation. From these assumptions, we have Time (P MS ) < Time (P Sti ). Finally, we compare P MS with P AHMS . Because we have assumed that t add = t turn as the above, we have Time (P MS ) < Time (P AHMS ). As a result, we may conclude that P MS is the protocol with the least execution time (as long as we admit the above assumptions).
One might think that the execution time of the shuffle used in P Sti (i.e., a random cut) and the execution time of the shuffle used in P MS and P AHMS (i.e., a random bisection cut) are different. We note that the authors in [24] showed that a random bisection cut can be reduced to a random cut if the backsides of all cards are vertically asymmetric such as ? . Therefore, we may assume that they are the same. Moreover, we measured the execution time of the secure implementation for a random bisection cut proposed in [24], which uses additional tools such as a ball and a rubber band; if we use this implementation, P Sti is faster (see Sect. 4.3 for the details).

Impact of execution time of shuffling
In the previous subsection, we assumed that t perm < t shuf holds. In this subsection, we further investigate how the difference between t perm and t shuf affects the overall execution time of a protocol. To this end, we regard t shuf as a variable and other metrics t add , t turn , and t perm as constants. Specifically, based on our measurement of the actual execution time, we fix 4 t add = t turn = 0.8 (sec.), t perm = 7t turn .
Then, we vary the value t shuf from three seconds to sixty seconds; Fig. 9 shows the result. According to this figure, P Sti and P MS are considered to be more efficient.

Execution time of the secure implementation proposed in [24]
As shown in Table 2, we counted the numbers of the shuffles used in the practical AND protocols in the same way even if they are different. This is because a random bisection cut used in P MS and P AHMS can be reduced to the application of the Hindu cut to a sequence of cards if the backsides are vertically asymmetric, as mentioned before. On the other hand, the authors in [24] proposed a secure implementation of a random bisection cut using additional tools such as a ball and rubber band, which does not depend on a pattern of the backsides. Therefore, it is reasonable to consider the case where one uses such an implementation of a random bisection cut in P MS , which might affect our conclusion that P MS is the fastest one. For this, we measured the execution time of it (denoted by t RBC ) by manipulating real tools that are exactly the same ones used in [24]. Its experimental method and result are shown in Appendix A.2.
As a result, we found that t RBC > 120 sec. Because the authors in [25] showed that it suffices to apply the Hindu cut for 30 s, we derive the following relationship: where t HC denotes the execution time of applying the Hindu cut. From this, we have Time (P Sti ) < Time (P MS ), and hence, we may conclude that P Sti is the fastest one (on average) if one uses the above implementation [24].
To perform this, we move the second card to the third position and the fifth card to the second position and then exchange the portions consisting the third and fourth cards with the portion consisting the sixth and seventh cards. We actually measured the execution time of this move by manipulating real cards. As a result, we found that (perm, (2 3 6 4 7 5)) takes approximately four times as long as just exchanging two portions.
Remember that π 1 is one of the six permutations appeared in the left part of P NR 's KWH-tree in Fig. 7. These six permutations are similar: They move the first to fourth cards to the seventh to tenth, the fifth to eighth cards to the first to fourth, and the ninth and tenth cards to the fifth and sixth, respectively. Among the six permutations, (perm, π 1 ) should take the longest time. We also actually measured the execution time of this move. As a result, we found that it takes approximately nine to ten times as long as just exchanging two portions.
Finally, π 2 is one of the six permutations appeared in the right part of P NR 's KWH-tree. These six permutations are also similar: They move the third and fourth cards to the sixth and seventh, the ninth to tenth cards to the fourth and fifth, and the eleventh to twelfth cards to the ninth to tenth, respectively. They also move the revealed black cards to the third and eighth and the revealed red cards to the eleventh and the twelfth. We also actually measured the execution time of (perm, π 2 ), which should take the longest time among the six permutations. As a result, we found that it takes approximately eleven to twelve times as long as just exchanging two portions.
Therefore, Time (P CK ) and Time (P NR ) could be larger than those in Sect. 3.3. However, even if so, the statement that P MS is the protocol with the least execution time (which we concluded in Sect. 4.1) does hold.
The detailed results for measuring the execution time of applying the four permutations can be seen in Appendix A.3.

Conclusion
The widely-used efficiency evaluation metrics of card-based protocols do not capture the number of operations fully, and hence, it is difficult to estimate their execution time accurately. Therefore, we considered all kinds of possible operations so that we have four metrics, and focused on counting the number of operations comprehensively to estimate the execution time of protocols. Our new criteria allow us to evaluate the efficiency of protocols. Thus, we were able to compare the execution time of the protocols. Some reasonable assumptions concluded that the Mizuki-Sone AND protocol [13] is the most efficient and practical as an AND protocol in terms of the execution time.
To count the number of operations, we created KWH-trees for P CK and P Sti as shown in Figs. 5 and 6, respectively. This is the first attempt to describe KWH-trees for these previous protocols, and we believe that Figs. 5 and 6 themselves form one of the major contributions of this paper.

Compliance with ethical standards
Conflicts of interest The authors declare that they have no conflict of interest.
Ethical approval This article does not contain any new studies with human participants or animals performed by any of the authors.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material Fig. 10 The tools used in our experiment for measuring the execution time of the secure implementation proposed in [24]; the sequence of six cards, separator, rubber band, curving polystyrene foam ball, tape, and scissors is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecomm ons.org/licenses/by/4.0/.

A Experimental results
In this appendix, we show our experimental methods and detailed results. A deck of cards used in our experiments is the one shown in Figs. 1 to 4, which was made by the fourth author.

A.1 Add, turn, and perm
We show how to derive the relationship (3) and (4) shown in Sects. 4.1 and 4.2. This measurement was mainly conducted by the second author, who is familiar with playing cards. Method. To measure t add and t turn , we measured the execution time of adding and turning over ten cards five times, respectively. To measure t perm , we measured the execution time of applying all the permutations appeared in P CK , P NR , P Sti , and P MS (namely six permutations) five times. Result. Table 5 summarizes the experimental result; t add = 0.655, t turn = 0.803, and t perm = 5.889. Since the difference between t add and t turn is relatively small (about 0.15 seconds), we have fixed t add = t turn = 0.8 as in (4).

A.2 Secure implementation using a ball and rubber Band
We show how to derive t RBC > 120 sec shown in Sect. 4.3. This evaluation was mainly conducted by the first author, who is an inventor of this implementation. Table 5 The experimental result of measuring the execution time of adding, turning over, and permuting cards, which was mainly conducted by the second author, who is familiar with playing cards. Since we measured the execution time of adding and turning over ten cards for each time, the values in the rightmost column are the ones in the left of them divided by ten, respectively. For perm, since we measured the execution time of applying six (different) permutations, the value in the rightmost column is the one in the left of it divided by six  Method. To measure t RBC , we prepared exactly the same tools in [24] as shown in Fig. 10. We measured the execution time of the following procedure five times: 1. Band the two halves of the sequence of six cards using the rubber band and separator. 2. Place the banded pile of cards into one half of the curving ball. 3. On the half, put the other half and tape them together using the tape and scissors. 4. Throw the ball in the air in a spinning manner. 5. Remove the tape and rubber band and place the resulting sequence in its original position.
Result. Table 6 summarizes the experimental result. Because it took more than 120 seconds at every time, we have t RBC > 120 sec.