Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2606.00190

A Moderatorless Protocol for WEREWOLF

Naoki Kitamura, Hironori Kiya, Hirotaka Ono

Published May 29, 2026• 0 citations
arXivHTMLPDF

Abstract

Social deduction games, or hidden-role games, are multiplayer games in which players are assigned private roles and act under asymmetric information about other players' roles and actions. In the canonical example Werewolf, werewolves conceal their roles and mislead the other players, while the seer can obtain role information about a chosen player. Thus, a central functionality of such games is controlling which players can access which information. In typical play, this control is implemented by a trusted human moderator, who assigns roles, mediates secret actions, and reveals outcomes. This reliance raises the barrier to participation and introduces a trusted third party as a single point of failure. In this work, we show that Werewolf can be played without a moderator or any digital device, using only ordinary playing cards. Our construction maintains a shared pool of cards that is observable to all players and manipulated according to a common public procedure, while its interpretation depends on each player's private role. This induces role-dependent views from a single public sequence of card operations. Consequently, even without private messages, werewolves can identify one another and coordinate, and the seer can test whether a chosen player is a werewolf in each round. The proposed implementation is built from card-based physical cryptographic primitives, such as face-down commitments and verifiable shuffles, and higher-level subprotocols for intra-role information sharing, secret action designation, and attribute testing. These subprotocols implement the moderator's core functions while keeping all card operations public and auditable under standard assumptions on physical card operations. We show that the resulting complete moderatorless implementation of Werewolf scales to an arbitrary number n of players using O(n^3) cards.

DOI
10.48550/arxiv.2606.00190

Related papers

A Toolbox for Mental Card Games

Christian Schindelhauer

Mental card games are played without a trusted party and without cards. It is well known that the problem of mental card games can be solved in principle. But the schemes known so far are too messy to be used in practice. Only for the mental poker game a suitable solution is known [Cr'ep 87] that achieves security against player coalition and complete confidentiality of a player's strategy. Here, we present a general-purpose scheme that may be used as basic toolbox for straight-forward implementations of card games. We present a data structure for cards and decks that is secure against player coalitions and enables standard operations like picking up a card, opening it, and (re-)mixing stacks. Futhermore, we introduce tools for special operations like inserting a card into the deck, splitting the deck, parting the game. The correctness of all operations is testified by zeroknowledge proofs. Finally, we discuss security problems that are typical for mental card games and suggest solutio...

•Jan 1, 1998•2 citations

Secure Computation for Threshold Functions with Physical Cards: Power of Private Permutations

Takeshi Nakai, Satoshi Shirouchi, Yuuki Tokushige +2 more

Abstract Card-based cryptography is a variant of multi-party computation using physical cards like playing cards. There are two models on card-based cryptography, called public and private models. The public model assumes that all operations are executed publicly, while the private model allows the players private operations called private permutations (PP, for short). Much of the existing card-based protocols were developed under the public model. Under the public model, 2ncards are necessary for every protocol withn-bit input since at least two cards are required to express a bit. In this paper, we proposen-bit input protocols with fewer than 2ncards by utilizing PP, which shows the power of PP. In particular, we show that a protocol for (n-bit input) threshold function can be realized with only $$n+1$$ n+1 cards by reducing the threshold function to the majority voting. Toward this end, we first offer that two-bit input protocols for logic gates can be realized with fewer than four cards. Furthermore, we construct a new protocol for three-input majority voting with only four cards by observing the relationship between AND/OR operations. This protocol can be easily extended to more participants, and to the protocol for threshold functions.

New Generation Computing•Feb 8, 2022•19 citations

Secrecy without one-way functions

Dima Yu. Grigoriev, Vladimir Shpilrain

We show that some problems in information security can be solved without using one-way functions. The latter are usually regarded as a central concept of cryptography, but the very existence of one-way functions depends on difficult conjectures in complexity theory, most notably on the notorious “” conjecture. This is why cryptographic primitives that do not employ one-way functions are often called “unconditionally secure”. In this paper, we suggest protocols for secure computation of the sum, product, and some other functions of two or more elements of an arbitrary constructible ring, without using any one-way functions. A new input that we offer here is that, in contrast with other proposals, we conceal “intermediate results” of a computation. For example, when we compute the sum of k numbers, only the final result is known to the parties; partial sums are not known to anybody. Other applications of our method include voting/rating over insecure channels and a rather elegant and efficient solution of the “two millionaires problem”. Then, while it is fairly obvious that a secure (bit) commitment between two parties is impossible without a one-way function, we show that it is possible if the number of parties is at least 3. We also show how our unconditionally secure (bit) commitment scheme for three parties can be used to arrange an unconditionally secure (bit) commitment between just two parties if they use a “dummy” (e.g., a computer) as the third party. We explain how our concept of a “dummy” is different from the well-known concept of a “trusted third party”. Based on a similar idea, we also offer an unconditionally secure k - n oblivious transfer protocol between two parties who use a “dummy”. We also suggest a protocol, without using a one-way function, for the so-called “mental poker”, i.e., a fair card dealing (and playing) over distance. Finally, we propose a secret sharing scheme where an advantage over Shamir's and other known secret sharing schemes is that nobody, including the dealer, ends up knowing the shares (of the secret) owned by any particular player. It should be mentioned that computational cost of our protocols is negligible to the point that all of them can be executed without a computer.

arXiv:1301.5069•journal of Groups complexity cryptology•Jan 1, 2013•5 citations

Card-based Cryptography with a Standard Deck of Cards, Revisited: Efficient Protocols in the Private Model

Takeshi Nakai, Keita Iwanari, Tomoki Ono +3 more

Abstract Card-based cryptography is a secure computation protocol realized by using physical cards. There are two models on card-based cryptography: public and private models. We adopt private one that allows players to handle cards privately. While much of the existing works for card-based cryptography use two-colored cards, it is also a vital task to construct an efficient protocol with playing cards. In the public model, 2n cards are necessary for any n-bit input protocol since at least two cards are required to express a Boolean value. It holds true for both two-colored and playing-card settings. On the other hand, the private model enables us to construct a protocol with fewer than 2n cards. However, all existing protocols that achieve such properties are only in the two-colored setting. This paper shows that the private model enables us to construct a protocol with fewer than 2n cards using the playing cards. We first show two-bit input protocols with fewer than four cards for logical operations, AND, OR, and XOR. Furthermore, we show a three-input majority voting protocol using only three cards, which is constructed by combining our AND and OR protocols. Notably, our proposed protocols require no randomness. All operations are deterministic and depend only on players’ private inputs.

New Generation Computing•Jun 21, 2024•6 citations

Card-Based Computation in the Virtual Player Simulation Model

Suthee Ruangwises

Player simulation has recently emerged as a new direction in card-based cryptography, with protocols developed for simulating virtual players in physical card games such as Old Maid, UNO, and President. Unlike conventional card-based secure computation, player simulation imposes additional constraints: the cards represent a persistent game state, the remaining cards in a virtual player's hand must be preserved after each action, and it is desirable to represent each card in the game by a single physical card. In this paper, we study generic card-based computation in the virtual player simulation model. We focus on games whose cards admit a publicly known ranking and propose two fundamental protocols. First, we present the Play-Minimum protocol, which securely selects and plays the minimum-value card from a virtual player's hand when all cards in the deck have distinct values. By symmetry, the protocol can also be used to play the maximum-value card. Second, we present the Sorting protocol, which securely arranges a virtual player's hand in nondecreasing order and remains applicable when multiple cards have the same value. These protocols provide generic computational primitives independent of any particular card game and constitute a step toward understanding the computational capabilities of the virtual player simulation model.

arXiv:2609.02716•Sep 2, 2026•0 citations

Card-Based Cryptographic Protocols with Malicious Players Using Private Operations

Yoshifumi Manabe, Hibiki Ono

Abstract This paper shows new card-based cryptographic protocols using private operations that are secure against malicious players. Physical cards are used in card-based cryptographic protocols instead of computers. Operations that a player executes in a place where the other players cannot see are called private operations. Using several private operations, calculations of two variable Boolean functions and copy operations were realized with the minimum number of cards. Though private operations are very powerful in card-based cryptographic protocols, there is a problem that it is very hard to prevent malicious actions during private operations. Though most card-based protocols are discussed in the semi-honest model, there might be cases when the semi-honest model is not enough. Thus, this paper shows new protocols that are secure against malicious players. We show logical XOR, logical AND, n-variable Boolean function, and copy protocols. We can execute any logical computations with a combination of these protocols. We use envelopes as an additional tool that can be easily prepared and used by people.

New Generation Computing•Feb 3, 2022•18 citations
Social deduction games, or hidden-role games, are multiplayer games in which players are assigned private roles and act under asymmetric information about other players' roles and actions. In the canonical example Werewolf, werewolves conceal their roles and mislead the other players, while the seer can obtain role information about a chosen player. Thus, a central functionality of such games is controlling which players can access which information. In typical play, this control is implemented by a trusted human moderator, who assigns roles, mediates secret actions, and reveals outcomes. This reliance raises the barrier to participation and introduces a trusted third party as a single point of failure. In this work, we show that Werewolf can be played without a moderator or any digital device, using only ordinary playing cards. Our construction maintains a shared pool of cards that is observable to all players and manipulated according to a common public procedure, while its interpretation depends on each player's private role. This induces role-dependent views from a single public sequence of card operations. Consequently, even without private messages, werewolves can identify one another and coordinate, and the seer can test whether a chosen player is a werewolf in each round. The proposed implementation is built from card-based physical cryptographic primitives, such as face-down commitments and verifiable shuffles, and higher-level subprotocols for intra-role information sharing, secret action designation, and attribute testing. These subprotocols implement the moderator's core functions while keeping all card operations public and auditable under standard assumptions on physical card operations. We show that the resulting complete moderatorless implementation of Werewolf scales to an arbitrary number n of players using O(n^3) cards.
Mental card games are played without a trusted party and without cards. It is well known that the problem of mental card games can be solved in principle. But the schemes known so far are too messy to be used in practice. Only for the mental poker game a suitable solution is known [Cr'ep 87] that achieves security against player coalition and complete confidentiality of a player's strategy. Here, we present a general-purpose scheme that may be used as basic toolbox for straight-forward implementations of card games. We present a data structure for cards and decks that is secure against player coalitions and enables standard operations like picking up a card, opening it, and (re-)mixing stacks. Futhermore, we introduce tools for special operations like inserting a card into the deck, splitting the deck, parting the game. The correctness of all operations is testified by zeroknowledge proofs. Finally, we discuss security problems that are typical for mental card games and suggest solutio...
Abstract Card-based cryptography is a variant of multi-party computation using physical cards like playing cards. There are two models on card-based cryptography, called public and private models. The public model assumes that all operations are executed publicly, while the private model allows the players private operations called private permutations (PP, for short). Much of the existing card-based protocols were developed under the public model. Under the public model, 2ncards are necessary for every protocol withn-bit input since at least two cards are required to express a bit. In this paper, we proposen-bit input protocols with fewer than 2ncards by utilizing PP, which shows the power of PP. In particular, we show that a protocol for (n-bit input) threshold function can be realized with only n+1n+1n+1 n+1 cards by reducing the threshold function to the majority voting. Toward this end, we first offer that two-bit input protocols for logic gates can be realized with fewer than four cards. Furthermore, we construct a new protocol for three-input majority voting with only four cards by observing the relationship between AND/OR operations. This protocol can be easily extended to more participants, and to the protocol for threshold functions.
We show that some problems in information security can be solved without using one-way functions. The latter are usually regarded as a central concept of cryptography, but the very existence of one-way functions depends on difficult conjectures in complexity theory, most notably on the notorious “” conjecture. This is why cryptographic primitives that do not employ one-way functions are often called “unconditionally secure”. In this paper, we suggest protocols for secure computation of the sum, product, and some other functions of two or more elements of an arbitrary constructible ring, without using any one-way functions. A new input that we offer here is that, in contrast with other proposals, we conceal “intermediate results” of a computation. For example, when we compute the sum of k numbers, only the final result is known to the parties; partial sums are not known to anybody. Other applications of our method include voting/rating over insecure channels and a rather elegant and efficient solution of the “two millionaires problem”. Then, while it is fairly obvious that a secure (bit) commitment between two parties is impossible without a one-way function, we show that it is possible if the number of parties is at least 3. We also show how our unconditionally secure (bit) commitment scheme for three parties can be used to arrange an unconditionally secure (bit) commitment between just two parties if they use a “dummy” (e.g., a computer) as the third party. We explain how our concept of a “dummy” is different from the well-known concept of a “trusted third party”. Based on a similar idea, we also offer an unconditionally secure k - n oblivious transfer protocol between two parties who use a “dummy”. We also suggest a protocol, without using a one-way function, for the so-called “mental poker”, i.e., a fair card dealing (and playing) over distance. Finally, we propose a secret sharing scheme where an advantage over Shamir's and other known secret sharing schemes is that nobody, including the dealer, ends up knowing the shares (of the secret) owned by any particular player. It should be mentioned that computational cost of our protocols is negligible to the point that all of them can be executed without a computer.
Abstract Card-based cryptography is a secure computation protocol realized by using physical cards. There are two models on card-based cryptography: public and private models. We adopt private one that allows players to handle cards privately. While much of the existing works for card-based cryptography use two-colored cards, it is also a vital task to construct an efficient protocol with playing cards. In the public model, 2n cards are necessary for any n-bit input protocol since at least two cards are required to express a Boolean value. It holds true for both two-colored and playing-card settings. On the other hand, the private model enables us to construct a protocol with fewer than 2n cards. However, all existing protocols that achieve such properties are only in the two-colored setting. This paper shows that the private model enables us to construct a protocol with fewer than 2n cards using the playing cards. We first show two-bit input protocols with fewer than four cards for logical operations, AND, OR, and XOR. Furthermore, we show a three-input majority voting protocol using only three cards, which is constructed by combining our AND and OR protocols. Notably, our proposed protocols require no randomness. All operations are deterministic and depend only on players’ private inputs.
Player simulation has recently emerged as a new direction in card-based cryptography, with protocols developed for simulating virtual players in physical card games such as Old Maid, UNO, and President. Unlike conventional card-based secure computation, player simulation imposes additional constraints: the cards represent a persistent game state, the remaining cards in a virtual player's hand must be preserved after each action, and it is desirable to represent each card in the game by a single physical card. In this paper, we study generic card-based computation in the virtual player simulation model. We focus on games whose cards admit a publicly known ranking and propose two fundamental protocols. First, we present the Play-Minimum protocol, which securely selects and plays the minimum-value card from a virtual player's hand when all cards in the deck have distinct values. By symmetry, the protocol can also be used to play the maximum-value card. Second, we present the Sorting protocol, which securely arranges a virtual player's hand in nondecreasing order and remains applicable when multiple cards have the same value. These protocols provide generic computational primitives independent of any particular card game and constitute a step toward understanding the computational capabilities of the virtual player simulation model.
Abstract This paper shows new card-based cryptographic protocols using private operations that are secure against malicious players. Physical cards are used in card-based cryptographic protocols instead of computers. Operations that a player executes in a place where the other players cannot see are called private operations. Using several private operations, calculations of two variable Boolean functions and copy operations were realized with the minimum number of cards. Though private operations are very powerful in card-based cryptographic protocols, there is a problem that it is very hard to prevent malicious actions during private operations. Though most card-based protocols are discussed in the semi-honest model, there might be cases when the semi-honest model is not enough. Thus, this paper shows new protocols that are secure against malicious players. We show logical XOR, logical AND, n-variable Boolean function, and copy protocols. We can execute any logical computations with a combination of these protocols. We use envelopes as an additional tool that can be easily prepared and used by people.