Finding a winner in mental poker game In a mental poker game I am designing as an learning exercise, (One used in example is a 3 card flash with no desk cards) suppose I have a set of cards and other person also has a set of cards. each card is mapped to a prime order (EC)DH group element. We both know other persons cards raised to some power. That is if my opponent has cards c1, c2 and c3, I know c1z1, c2z2 and c3z3, with z1, z2 and z3 being known only to my opponent. The mapping (which card maps to which group element is publicly known) and what my opponent knows is the discrete logarithm of the numbers I know he has base a valid card. Of course this is exactly what my opponent knows about my card too. Now is there any way to find out who won without revealing the cards or any other information about my cards (like whether the doubles or sequences exist), as in zero knowledge proof.
EDIT:
Just realized that it is called Pohlig-Hellman cipher. I assume others know what I am trying to do with this to shuffle cards. I guessshould be we can create a EC version of it too. While I understand that it is not IND-CPA, I don't think that it much of a problem in this game.
I looked at security problems with PH cipher but almost all of them has to do with the fact that it can distinguish plain texts based on whether or not they are QR modulo p in group ℤp* and they are malleable. Actually, I need to use this malleability. This malleability is what allows players in my game to produce a proof that they have not cheated, I realized that the proof will be too damn long tho). But the game I am designing uses no Quadratic non-residue, the group is a $q$ order subgroup of quadratic residues as we often use for Diffie-hellman and (large prime subgroup as we normally use in EC versions), the card to group element mapping must be pseudo random and different in each game, agreed to by each player. My another question is are there any other security risks associated with it?
OK
I had asked this unanswered question earlier and now, I think I have an answer (sort of), not really but I think I know where to look for it. We assign each type of card combination a score such that a winning card combination always has a higher score and a tie always have equal score.The two players then play Yao's millionaire's problem to decide who is winner. With mapping known, a player who reveals the secret exponentiations (or cards) and the secret data used to provide his/her input to the problem, one can easily verify that they have shown scores honestly. Which means that the problem is in NP and thus the player should be able to construct zero knowledge proof showing that the score really reflects his card rank without revealing either the cards or the score according to a 1987 paper.That way two players can check who won without actually revealing his/her cards