A case study in almost-perfect security for unconditionally secure communication

In the Russian cards problem, Alice, Bob and Cath draw a, b and c cards, respectively, from a publicly known deck. Alice and Bob must then communicate their cards to each other without Cath learning who holds a single card. Solutions in the literature provide weak security, where Alice and Bob’s exchanges do not allow Cath to know with certainty who holds each card that is not hers, or perfect security, where Cath learns no probabilistic information about who holds any given card. We propose an intermediate notion, which we call ε\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varepsilon $$\end{document}-strong security, where the probabilities perceived by Cath may only change by a factor of ε\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varepsilon $$\end{document}. We then show that strategies based on affine or projective geometries yield ε\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varepsilon $$\end{document}-strong safety for arbitrarily small ε\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varepsilon $$\end{document} and appropriately chosen values of a, b, c.


Introduction
Consider the following problem, which appeared in the 2000 Moscow Mathematics Olympiad: Alice, Bob and Cath draw three, three and one cards, respectively, from a publicly known deck of seven.Alice and Bob wish to inform each other of the cards they hold, but they may only do so by public, unencrypted announcements.Moreover, they do not wish for Cath to know who holds a single card that is not hers.Can Alice and Bob achieve this?
It later came to be known as the Russian cards problem [13], and is interesting from a cryptographical viewpoint since it provides a framework for unconditionally secure communication, perhaps the strongest notion of security that one may demand from a cryptographic protocol.

Notions of cryptographic security
Claude Shannon, one of the first people to formalize the study of cryptography, proposed several notions of cryptographic security.To be precise, he defined the following: • Computational Security: We say that a protocol is computationally secure for n if at least n operations are needed to break it.It is usually very difficult to prove that protocol is secure in this sense, as we would need to know all the possible strategies for attack.However, it is a good measure of when a system isn't secure, that is, when it fails to be secure for a relatively small n.
• Provable Security: We say that a protocol is provably secure if we can link it with a 'hard' problem, cryptographic or not, in such a way that solving the second problem will allow us to break the encryption.In that case, we know that we need at least as many operations to break the code as we need to solve the second problem.Typically, the 'hard' problem is in np but believed to not be in p.Many of the cryptographic protocols in use today are based on this notion of security.
• Unconditional Security: A protocol is unconditionally secure if it can't be broken even with unlimited computational resources; the eavesdropper simply does not have enough information to reconstruct the original message.
It should be clear that unconditional security implies both computational and provable security, and as such it would ideally be desirable to develop unconditionally secure cryptographic protocols.However, such protocols tend to be unpractical and as such few of them are known, with a notable example being Vernam's one time pad [10].However, the setup of the Russian cards, which presupposes a secure dealing phase, provides a convenient setup for developing unconditionally secure protocols.

Related work
The Russian cards problem may be traced back to Kirkman [8], but recently it has received renewed attention after its inclusion in the 2000 Mathematics Olympiad [13].One of the solutions for deals of distribution type (3, 3, 1) uses the Fano plane, a special case of a combinatorial design, which can also be used for many other distribution types [1].Another solution uses modular arithmetic, which can also be generalized for many distribution types where the eavesdropper holds one card [3].These solutions use only two announcements, but some cases are known to require more.A solution using three announcements for (4, 4, 2) is reported in [14], and a four-step protocol for c = O(a 2 ) and b = O(c 2 ) is presented in [4].The solution we will work with in this paper is similar to the one reported in [2], which also takes two steps.The Russian cards problem has also been generalized to a larger number of agents in [6,7].However, while the protocols mentioned above provide unconditionally secure solutions to the Russian cards problem in that the eavesdropper may not know with certainty who holds a given card, that does not mean that she may not have a high probability of guessing this information correctly.To this end, stronger notions of security are studied in [12].There, a distinction is made between weak and perfect security; in perfectly secure solutions, Cath does not acquire any probabilistic information about the ownership of any specific card.All of the above solutions provide weak security in this sense, but Swanson and Stinson show how designs may be used to achieve perfect security, an idea further developed in [11].
The solutions we present here will provide an intermediate level of security between weak and perfect, controlling the amount of probabilistic information that may be acquired by the eavesdropper, while having the advantage of being much easier to construct than perfectly secure solutions.

A Worked Example
We will motivate the work in this article with a relatively small example.Let's suppose we have 49 cards, with Alice holding 7, Cath holding 5 and Bob the rest.In this case, Alice can take advantage of the fact that there is a field F 7 with 7 elements (the quotient Z/(7) forms a field), and thus may identify each point in the two-dimensional vector space over F 7 , which we will denote 2  7 , with a card.Moreover, she can do this in such a way that her cards (marked by ♠) form a line.Suppose then that Cath holds the cards marked by ♣, while Bob holds the rest of the cards (♦).
Alice then announces how she has distributed the cards on the plane.In this particular announcement, Cath's cards all fall within the same line.This is an extreme case, but it is a real possibility, as Alice has no knowledge of Cath's hand when she makes her announcement.Bob and Cath know that Alice's hand falls on a line, but they do not know which line. Bob then knows exactly which cards Alice holds (since there is only one complete line that he does not hold), but Cath does not.However, she may consider it more likely that Alice holds one card over another.To illustrate this, let us consider the points labeled x and y in Figure 2.
First we will take a look at x. Cath knows that, in order for Alice to hold x, one of the lines that passes through x must be Alice's hand.We draw these lines on the plane.
Cath knows that not all the lines that pass through x can be Alice's hand, Figure 1: Alice assigns each card to a point on the plane in such a way that her hand forms a line.She does not know how the other cards will fall, since she can only see her own hand.In this example, all of Cathy's cards happen to fall on another line.
because if a line contains a card that belongs to Cath, it clearly cannot be held in its entirety by Alice .In this case, only one line fits that description, so Cath takes it out of consideration.We denote this by drawing the line dotted.Every point in the plane has 8 lines that cross it; therefore, the point x still belongs to 7 hands that could possibly belong to Alice.However, this is not the case for all cards that Cath does not hold.Let us now turn our attention to y.While x was colinear with Cath's hand, all the lines that contain y and one of Cath's cards are different.In this case Cath can discard more lines than she could when considering x.Only 3 possible lines remain, compared to the 7 lines that pass through x and avoid Cath's hand.Therefore, it seems to Cath that the point x would be more likely to belong to Alice's hand than the point y as there are more possible hands that contain it.Before the announcement, both cards had the same probability to be in Alice's hand but after the announcement, x seems far more likely.
Note that the total number on lines in the announcement is 56.We also know that 36 of these lines contain a card that Cath holds.This is because there are 8 lines touching each point, but the 5 points all share one line.Therefore Alice's hand is one of the 20 lines that avoid Cath's hand.Of those 20 only three contain y compared to the 7 that contain x.Thus, it seems to Cath that there is a 7 /20 = 0.35 probability that Alice holds x compared to 3 /20 = 0.15 that she holds y.Thus, according to the information that Cath has, it is more than twice as likely that Alice holds x as it is that she holds y.
In this case, we know neither of the cards actually belongs to Alice, but we want to be able to quantify this information and control it, especially in higher dimensions where it is not as simple to visualize.Our goal is to show that, by choosing different parameters appropriately, we can make the different probabilities be arbitrarily close to each other.But first we need some preliminaries to make this precise.
Lines that Cath may discard from Alice's announcement.It is important to note that most of the lines are truncated, as the natural representation of 2  7 is as a torus and lines are harder to visualize in two dimensions.

Strategies and Probabilistic Security
In this section we will set up the basic concepts needed to formalize the Russian cards problem and different notions of security that one may require from its possible solutions.We will assume that Alice holds a cards, Bob

Equitable strategies
In most solutions to the Russian cards problem, Alice makes an announcement, after which Bob knows the entire deal and thus can make a second (trivial) announcement where he tells Alice which cards Cath holds.Thus we need only model Alice's first announcement, and we follow [12] in referring to the way that Alice is to choose her announcement as a strategy.Suppose that Alice holds a cards, Bob holds b and Cath holds c.Given a set X and a natural number n, we denote by X n the set of n-element subsets of X, and we will refer to such sets as n-sets.We denote the cardinality of X by |X|.A possible hand for Alice is then an element of Ω a .In Alice's first announcement she gives a set of possible hands that she may hold, and thus we may consider an announcement simply as a set A ⊂ Ω a .However, there are many possible announcements that may inform Bob of Alice's hand, and it may be convenient for Alice to randomize from all such possible announcements.Thus a strategy for Alice consists on a probability distribution among the possible announcements that she may choose from.Definition 1.A strategy (on Ω a ) is a function S that assigns to each hand A ∈ Ω a a probability distribution over 2 ( Ω a ) .We denote the probability of an announcement A given the hand A as P S (A|A).Given a strategy S and a hand A, we will say that A is a possible announcement if P S (A|A) > 0. The set of possible announcements will be denoted by S A .
When it is clear from context, we will drop the subindex S and write simply P (A|A) to simplify notation.It will also be convenient for computations if the number of possible announcements is independent of Alice's hand.If we could guarantee that there are m possible announcements for each hand, we could always assign a probability of 1 /m to each individual announcement.If a strategy has this property, we will say it is equitable [12].Definition 2. A strategy S is equitable if there exists a positive integer m such that, for every a-set A, |S A | = m and the probability of choosing a particular announcement A ∈ S A is P (A|A) = 1/m.One advantage of equitable strategies is that we need less information to specify them than more general strategies.In particular, we may model equitable strategies merely as a function where S A is the set of announcements with positive probability (and thus with probability 1 /m).Since the geometric strategy, which will be our main focus, is equitable, we will adopt this presentation.
The first condition that a two-step solution to the Russian cards problem should satisfy is that Bob should be informed of Alice's hand after an announcement.Let us make this precise.First, we introduce an abuse of notation that we will use throughout the text.
If X ⊂ 2 Ω and Y ⊂ Ω, define Thus, X \ Y is the set of elements of X avoiding Y .
Thus after an informative announcement, Bob knows exactly which hand A Alice is holding.But an informative strategy may also give Cath information, yet we also require for Alice's strategy to be secure.

Probabilistic Security
Before Alice makes an announcement, Cath knows that Alice can possibly hold any hand that doesn't contain one of Cath's cards.Hence, there are a+b a possible hands for Alice.However, after an announcement, Cath can discard any hand that isn't found in the announcement.After doing so, it is possible that Cath acquires new information about the cards she does not hold.In particular, she may know that there is a high probability that Alice holds a given card.If Alice and Bob want to communicate securely, it would be desirable to avoid giving Cath such information.
There are three different notions of probabilistic security for strategies: weak, perfect, and our notion of ε-strong security, which lies between the other two.Unconditional security is equivalent to weak security.If we wanted to avoid Cath learning any probabilistic information after an announcement, we would need to ensure that no card seems more likely after the announcement than it did before.For this, the number of hands in the announcement (after Cath eliminates the ones which have a card that she holds) that contain a given card must be equal for every card that Cath does not hold.In this case, the probability of Alice having a set card should stay the same after Alice's announcement.As a matter of fact, we know the value of this probability; we must only count the hands that could contain that card given Cath's hand and divide it by the number of remaining hands in the announcement: If this number stays constant after Alice's announcement, we will say that Alice's strategy is perfectly secure.Definition 4. A strategy S on Ω a is perfectly secure for (a, b, c) if for every C ∈ Ω c , every card x ∈ Ω \ C, and every announcement A with P (A|C) = 0, we have that P (x ∈ A|C, A) This notion is equivalent to 1-perfect security in [12] and represents Cath's inability to gleam information about the position of individual cards.Compare this to weak security, where we only require that Cath is not certain about the position of any card she does not hold.

Definition 5. A strategy S on Ω
a is weakly secure for (a, b, c) if for every C ∈ Ω c , every card x ∈ Ω \ C, and every announcement A with P (A|C) = 0, we have that In [11,12], the authors present examples of perfectly secure strategies when Cath has at most 3 cards.Due to the rigidity needed to ensure this level of security, it is not clear whether perfectly secure strategies can be constructed when Cath holds more cards.Instead, we will define an intermediate level of security, where the constraint is relaxed so we can have more flexibilty and can work in cases where Cath's hand is larger.In fact, this notion will permit us to find secure protocols for any possible hand size that Cath may hold.Definition 6.Let ε > 0. A strategy S on Ω a is ε-strongly secure for (a, b, c) if for every C ∈ Ω c , every card x ∈ Ω \ C, and every announcement A with P (A|C) = 0, we have that As mentioned above, equitable strategies are useful for simplifying computations.In particular, the above probabilities may be computed by counting.The following result can be found in [12].
Lemma 1.Let S be an equitable strategy on Ω a and (A, B, C) be a deal.Suppose that C ∈ Ω c and A is an announcement with P (A|C) > 0 and A ∈ A.
|A\C| .In other words, the probability that A is Alice's hand given Cath's hand C and the announcement A (when A is a valid hand given C) is given by the quotient of one over the number of hands in the announcement that avoid C.
Thus the probability of Alice having a set hand A according to Cath is 1 /|A\C|.However, what we want to calculate is the probability that Alice holds a given card x.For this, we introduce a new abuse of notation: for X ⊆ 2 Ω and y ∈ Ω, set X y = {X ∈ X : y ∈ X}.
Thus for Z ⊂ Ω, X y \ Z denotes the set of elements of X which contain y but avoid Z.The following can also be found in [12].
Lemma 2. Let S be an equitable strategy on Ω a and (A, B, C) be a deal.If z ∈ Ω \ C, then

Finite geometries
The geometric strategy is convenient because it allows us to use many familiar results from linear algebra.One key difference when working over finite fields (instead of, say, R) is that now it becomes relevant to count the number of points in a subspace, the number of subspaces touching a point, etc.These quantities will be useful more than once in this article.First, we recall a general result about the cardinalities of finite fields.Results in this section are presented without proof; for a more thorough treatment of finite fields and finite geometry, the reader may consult a text such as [5,9].
Theorem 1 (Existence and Uniqueness of Finite Fields).If q is a natural number, there exists a finite field with cardinality q if and only if q is of the form p n , with p a prime and n a positive integer.This field is unique up to isomorphism and is called the Galois Field of order q.We will denote it by q .
Our protocol will be based on affine subspaces of a finite vector space.For brevity, we will refer to an affine space of dimension α as an 'α-plane', while an α-plane passing through the origin (i.e., a linear subspace of dimension α) will be referred to as an 'α-space'.Definition 7. Let V be a vector space over a field F. We say that W ⊂ V is an α-space if it is a an α-dimensional subspace of V.
A subset U ⊆ V is an α-plane if it is of the form x + W , where x ∈ V and W is an α-space.Two α-planes X, Y are parallel if there exists y ∈ V such that Y = y + X.
Thus an α-plane is similar to an α-space, although it does not necessarily pass through the origin.If F is finite, then it is not difficult to count the number of points on an α-plane.Lemma 3. If q is a prime power and V is a vector space over F q , then any α-plane in V has exactly q α points.
Meanwhile, the intersection of two distinct α-planes is either empty or a η-plane for some η < α, which has the following consequence.Lemma 4. If q is a prime power, V is a vector space over F q and U, W ⊆ V are distinct α-planes, then We may also fix a point x in our vector space and instead ask how many α-planes meet x.Here the dimension of V will be relevant.We will denote the δ-dimensional vector space over F q by F δ q .
Definition 8. Fix a prime power q.Then, given positive integers α ≤ δ, define Lemma 5. Let q be a prime power and δ ≥ α > 0.Then, 1.Given x ∈ F δ q , the total number of α-planes meeting x is equal to [ α] q,δ .
2. Given distinct points x, y ∈ F δ q , the number of α-planes meeting both x and y is given by 3. The total number of α-planes in F δ q is q δ−α [ α] q,δ .
Proof.For the first claim, we may assume without loss that x = 0. Fix q and let k δ α denote the number of (ordered) sequences v 1 , . . ., v α of linearly independent vectors in F δ α .Observe that, for each α-space W , there are exactly k α α ordered bases for W , and thus the total number of α-spaces is precisely k δ α/k α α .Thus it suffices to find an expression for k δ α .For v 1 , we have q δ − 1 options, since we may choose any vector in F δ q save for 0. For v 2 , we have q δ − q options, since we may choose any vector that does not lie in the line generated by v 1 .More generally, for v i we have q δ − q i−1 options, since we may choose any vector that does not lie in the (i − 1) space generated by v 1 , . . ., v i−1 .Thus the total number of options is and hence the total number of α-spaces is The second claim is proven in a similar fashion.As before, we may assume that x = 0 and fix y = 0. Then we proceed as above, except that we fix v 1 to be y.This removes the first factor from both the numerator and the denominator, giving us Finally, for the third claim, note that if we fix an α-space W , the α-planes parallel to W , together with W , form a partition of F δ q , hence there are q δ /q α = q δ−α of them.But there are [ α] q,δ different α-spaces, and thus the total number of α-planes is q δ−α [ α] q,δ .

The Geometric Strategy
We've informally presented the geometric solution to the Russian Cards problem, and will now formalize it to construct the Geometric Strategy.The protocol we will use is essentially presented in [2].The basic idea is to construct a finite vector space where every point represents a different card and Alice's hand forms an α-plane.Below, we use f [X] to denote the set {f (x) : x ∈ X}.Each announcement is parametrized by a suitable map.Definition 9. Fix a prime power q, natural numbers 0 < α < δ and A ∈ Ω a .We define a suitable map for A to be a function f : Ω → F δ q such that f [A] is an α-plane.
Given a suitable map f , we define The geometric strategy is then defined by letting Alice choose uniformly from all suitable maps f and announcing A[f ].
Definition 10 (The geometric strategy).Let q be a prime power and 0 < α < δ.Given a, b and c such that a = q α and a + b + c = q δ , we define the geometric strategy (with parameters q, α, δ), denoted G = G(q, δ, α), to be the strategy such that G A is the set of all announcements of the form A[f ], where f : Ω → F δ q is suitable for A, and Alice chooses uniformly from G A .This strategy generalizes that in [2] where α = δ − 1, although that article also considers the case where Alice holds more than one plane.Let us now show that the strategy is equitable.Lemma 6.Let q be a prime power, 0 < α < δ and a = q α , and let G = G(q, δ, α).
As a first step, we will build a function σ that permutes the elements of Ω.We know that |A \ A ′ | = |A ′ \ A|, so we can find a bijection s : Using the function s we will define a permutation σ : Ω → Ω given by Since s is invertible, σ is well-defined, and it is easy to check that σ is bijective.
We then define Σ : Then, it is easy to see that Σ has an inverse given by Σ −1 (B) = {σ −1 [H] : H ∈ B}, and hence Σ is a bijection, so that We have now proven that for every hand that Alice can have there is the same number m of possible announcements.This permits us to set the probability of a particular announcement to be chosen to 1/m, and thus the geometric strategy is equitable.As mentioned above, this will simplify some computations, even without explicitly computing m.
In the remainder of this section we will prove that the geometric strategy gives an informative and weakly safe solution to the Russian cards problem, provided c satisfies certain bounds.Lemma 7. Let q be a prime power, 1 ≤ α < δ and a, b, c positive integers such that a = q α , a + b + c = q δ and c < q α − q α−1 .Then, the geometric strategy with parameters q, δ, α is informative for (a, b, c).
Proof.Let q, δ, α, a, b, c satisfy the hypotheses of the lemma.Let A ∈ Ω a and 1 , and thus c ≥ q α − q α−1 , contradicting our hypothesis.
We conclude that U = U ′ , so that also A = A ′ and thus the geometric strategy is informative.
Next we must see that, given a card x not held by Cath, there is a nonzero probability that Alice holds x, which means that it is impossible that there is x ∈ Ω \ C such that all α-spaces passing through x meet C. Lemma 8. Let q be a prime power, 0 < α ≤ δ and a, b, c be such that a = q α and a + b + c = q δ .Let C ∈ Ω c , and f : Ω → F δ q be a bijection.If c < q δ −1 is the number of α-planes meeting f (x).If we take z ∈ C, there are [α] q,δ α-planes touching both x and z and, since there are c points in C, there are at most c[α] q,δ α-planes touching f (x) and meeting f [C].Thus in order to guarantee that there is at least one α-plane touching f (x) but not f [C], it suffices to have c[α] q,δ < [ α] q,δ .Solving for c and using Lemma 5.2, this becomes Thus if c satisfies this constraint, there is an α-space U touching f (x) but not meeting f [C] and Likewise, there should be a nonzero probability that any card not held by Cath is held by Bob.In other words, if y is not held by Cath, there should be an α-plane avoiding y and Cath's hand.Lemma 9. Let q be a prime power, 0 < α ≤ δ and a, b, c be such that a = q α and a + b + c = q δ .Let C ∈ Ω c and f : Ω → F δ q be a bijection.If c < q δ−α and y ∈ Ω \ C, there is Proof.Let y ∈ Ω \ C and z ∈ C be arbitrary and V be an α-plane touching both f (y) and f (z).We know that there are q δ−α α-planes parallel or equal to V .Thus if c < q δ−α there is at least one α-plane U parallel to V which does not contain any pont from C. But by construction, y is not on U either.Thus there is an α-plane avoiding both y and U , and we may take Lemma 10.Let q be a prime power, 0 < α < δ and a, b, c be such that a = q α and a+ b + c = q δ .Then, the geometric strategy with parameters q, α, δ is weakly secure for (a, b, c) whenever c < q δ−α .
Proof.It is straightforward to check that q δ−α < q δ −1 q α −1 , so this is a direct consequence of Lemmas 8 and 9.
Putting together Lemmas 7 and 10 we obtain the main result of this section.Theorem 2. Let q be a prime power, 0 < α < δ and a, b, c be such that a = q α and a+ b + c = q δ .Then, the geometric strategy with parameters q, α, δ is weakly safe and informative for (a, b, c) whenever c < min(q α − q α−1 , q δ−α ).
We may use Theorem 2 to find many tuples (a, b, c) for which the geometric strategy is weakly secure.If Alice holds a line in the plane, then we may take c to be almost as large as a: Corollary 1.There are infinitely many values of a such that for any c ≤ a − 2 there is b < a 2 such that the geometric strategy is informative and weakly safe for (a, b, c).
On the other hand, if c is much smaller, then we can give Alice a higherdimensional plane to ensure that the number of cards is not too large relative to Alice and Cath's hands.
Corollary 2. Given rational ρ ∈ (0, 1), there are infinitely many values of a such that for any c < a ρ there is b < a 1+ρ such that the geometric strategy is informative and weakly safe for (a, b, c).
Observe that in either case, the geometric strategy gives infinitely many solutions for tuples (a, b, c) with c < a and b < ac.

Strong safety of the geometric strategy
Since the geometric strategy is equitable, we may apply the results in the previous section to it in order to find parameters for which this strategy is ε-strongly safe.As we have seen, this strategy is weakly safe if c < q α −q α−1 and c < q δ−α .Our goal will be to find tuples for which it is ε-strongly safe for a given ε.

Some auxiliary estimates
We will need to find bounds on the number of hands that Cath considers possible.We begin by counting the total number of hands in an announcement.The following is a direct consequence of Lemma 5.
Lemma 11.The number of a-sets in an announcement A of the geometric strategy with parameters q, δ, α is q δ−α [ α] q,δ .Now let us see how many hands Cath can discard from this announcement.Recall that A \ C denotes the set of lines avoiding C and A x \ C denotes the set of lines avoiding C that also pass through x.We may compute the probability that Alice holds x from Cath's perspective as What we are interested in is bounding the quotient of Cath's perceived probabilites before and after the announcement, that is, As we will see, by modifying the parameters, this quotient can become arbitrarily close to 1.
In order to find bounds for (1), it suffices to bound the numerator, since the denominator is constant.Thus we need to estimate |A x \ C| and |A \ C|.Let us begin with the latter.Lemma 12.If A is an announcement of the geometric strategy with parameters α, δ, q and C ∈ Ω c is non-empty, then Both equalities hold whenever c = 1.
Proof.By Lemma 11, |A| = q δ−α [ α] q,δ .Thus we may estimate the number of α-planes that meet C and subtract to obtain our bounds.Suppose that A = A[f ].To bound |A\C| from below, observe that there are [ α] q,δ α-planes passing through each point in f [C] and there are c such points, so that the number of hands in A meeting C, which is equal to the number of α-planes touching f [C], is at most c[ α] q,δ .It follows that Observe that when c > 1 we are subtracting one α-plane at least twice so the inequality is strict, but when c = 1 then equality holds.Now let us show the right-hand inequality.Since C = ∅, we can pick z ∈ C and observe that there are [ α] q,δ α-planes meeting f (z), and thus at least and if C = {z} this computation is exact.Lemma 13.If A is an announcement of the geometric strategy with parameters α, δ, q and C ∈ Ω c is non-empty, then Equality holds when c = 1.

Proof. Once again suppose that
To give our estimate, we will take the number of α-planes passing through f (x) and subtract the number of α-planes passing through f (x) and f (y) for each y ∈ C, without taking into account that many α-planes will be subtracted twice.Evidently this bound will not be tight, but it will be sufficient to establish our main results.
Recall that [ α] q,δ counts all of the α-planes passing through a given point.But, there are [α] q,δ α-planes passing through f (x) and f (y) for each y ∈ C, and thus there are at most c[α] q,δ planes meeting both f (x) and f [C], hence also hands in A meeting x and C. It follows that Now let us bound |A x \ C| from above.This time we use the fact that there is at least one y 0 ∈ C, and we can discard all of those α-planes that touch f (y 0 ) as well as f (x), of which there are [α] q,δ .It follows that and the result follows.Once again this bound is exact when c = 1.

Bounding probabilities
The counting lemmas we have given above may be used to bound the probabilities we are interested in.First, we give a more exact bound, and later we will give a simplified version.Lemma 14.If A is an announcement of the geometric strategy with parameters q, α, δ and C ∈ Ω c is non-empty, and Proof.For the lower bound, we put the lower bound of Lemma 13 together with the upper bound of Lemma 12 to obtain Using Lemma 5.2 and simplifying we obtain Figure 3: Some choices of parameters for the geometric strategy along with their respective lower and upper bounds given by Lemma 14.These were found by fixing c ∈ {2, 3, 4}, α ≤ 3 and δ = α + 1 and finding the least q for which the strategy is 0.05-strongly safe. Thus, using the equalities a = q α and a + b + c = q δ and simplifying once again we obtain q 2δ − cq δ+α − q δ + c 2 (q α − 1) + c q 2δ − q δ − q δ+α + q α ≤ P (x ∈ A|C, A) P (x ∈ A|C) .
Now we turn to bounding the quotient of probabilities from above.As before, we focus on the numerator, since the denominator is fixed, and use Lemma 13 bound |A x \ C| from above and Lemma 12 to bound |A \ C| from below.
Thus we obtain the following upper bound: Once again we may use Lemma 5.2 and some algebra to obtain  4: Tuples for which the geometric strategy is 0.5-strongly secure with q a prime power, a = q α , c ≥ γα, and b = q 2α+1 − a − c.

Making Bob's hand small
We may also give a ε-strongly secure analogue of Corollary 2. Suppose that we instead want to have a small number of cards in Bob's hand relative to Alice's.
In our above construction Bob's hand grew relatively quickly, so we want a different strategy for selecting parameters.The trade-off will be that Cath's hand may be substantially smaller than Alice's.In general if we want Bob to have less than a 1+β cards, then Cath must have less than a γ for some γ < β.
Corollary 6.Let ε > 0, γ ∈ (0, 1) and β > γ be such that β ∈ Q.Then, there are infinitely many values of a such that for any c < a γ there is b < a 1+β such that the geometric strategy is informative and ε-strongly safe for (a, b, c).
Proof.Similar to the proof of Corollary 2, but taking c < q γα and using Theorem 3.
Once again, we may obtain ε-strong security for infinitely many tuples (a, b, c) where c < a and b = O(ac 1+β ).So the takeaway in either case is that, making Bob's hand only a bit bigger compared to the rest of the deck and choosing an appropriately large deck, we may obtain ε-strong security instead of merely weak security.In Figure 5 we use this idea to find additional tuples for which the geometric protocol is 0.5-safe.

Concluding remarks
While the Russian cards provides a setting in which we may attain unconditionally safe communication, many known solutions to the Russian cards problem are only weakly safe, meaning that they may provide the eavesdropper with probabilistic information.Although perfectly secure solutions are known, it is somewhat difficult to find tuples for which this level of security may be attained.In this paper we have shown, however, that the amount of probabilistic information obtained by the eavesdropper may be controlled, to the extent that in  5: Tuples for which the geometric strategy is 0.05-strongly secure with q a prime power, δ ≥ α > 0, γ < δ /α − 1, a = q α , c = ⌊a γ ⌋, and b = q δ − a − c. some cases we can obtain a degree of safety indistinguishable from perfect safety for all practical purposes.Weakening the notion of perfect security has led to an infinite number of new tuples for which we may still obtain a high degree of security, and indeed the bounds we have given may be used to analyze the level of security in any instance of the geometric strategy.Moreover, our techniques had the added bonus of replicating some results of [12].
There are further directions that may be explored.Although our bounds are tight when c = 1, the larger c is, the less exact they are, which may keep us from identifying many tuples for which we have a high degree of security.These bounds may be improved with a deeper (and, possibly, messier) combinatorial analysis which takes into account collinear points using the inclusion-exclusion principle.In fact, tailor-made bounds can be used for specific values of c that may be of interest.
Finally, this analysis could be generalized further to include other combinatorial constructions, for example considering a wider class of designs.Such efforts could very well lead to more flexible methods of finding tuples for which there are strategies with very high levels of security.
b and Cath c, and Ω is the set of cards with |Ω| = a + b + c.A deal (of size (a, b, c)) is a partition (A, B, C) of Ω such that |A| = a, |B| = b and |C| = c; each of A, B, C represent the hand of Alice, Bob and Cath, respectively.