Faster Shuffling for a Simple Application Alice, Bob, and Charlie are working on three projects.

Alice is the manager.  At the beginning of each day, she chooses one
project to work on (this choice is based on her preferences and is
not random) and then assigns the other projects to Bob and Charlie.
Bob and Charlie demand that this assignment be 50/50 random and
anonymous (so Alice does not know who got which of the two projects).
Alice accepts this demand, but demands that her original choice be
anonymous too (so Bob and Charlie can not know which project Alice
has, unless they tell each other their projects to deduce the remaining
project).

To accomplish this, at the beginning of each day, Alice writes the
two projects she does not want on two cards and puts them face down on
a table.  Everyone mixes/shuffles the cards until everyone is content
that no one knows which is which.  Bob picks a card, Charlie gets the
other card, and they then work separately on the projects written on
their cards.



The only way I see to accomplish this "at a distance with cryptography"
is Mental Poker, based on
a commuting encryption/decryption method:

Alice shuffles and encrypts both (starting from her two unwanted projects)
-&gt; Bob shuffles and encrypts both
-&gt; Charlie shuffles and encrypts both
-&gt; Alice decrypts both
-&gt; Bob decrypts the first and Charlie decrypts the second
-&gt; In secret, Bob decrypts the second and Charlie decrypts the first


This is a lot of back and forth for every daily assignment - Is there any
simpler solution?

Ignoring Charlie, I was thinking Bob could give some seed (generated from a
private key) to Alice before everything and then Alice would generate random numbers for Bob (readable with his private key, but unreadable to
Alice) which somehow exclude Alice's project...but maybe that is a pipe
dream.
The obvious way is to use two oblivious transfers.  In case you need reminding: an Oblivious Transfer is a protocol where one party (Alice) has a number of secrets (in this case, two), and the other party (Bob or Charlie) gets to pick which one he gets to learn, but he doesn't learn the other (and Alice doesn't learn which one he picked).  There are several known protocols that implement this.

Here is how it would work:

Bob and Charlie randomly agree on a random bit $b$

Alice takes the two tasks she doesn't want, and randomly labels them $T_0$ and $T_1$

Bob then performs an oblivious transfer with Alice, obtaining the task $T_b$

Charlie then performs an oblivious transform with Alice (but using the bit $1-b$ rather than $b$ in the oblivious transfer), obtaining the task $T_{1-b}$

Because of the guarantees that OT provides, neither Alice, Bob nor Charlie know any of the tasks other than their own.

Now, one obvious issue is that, if Bob or Charlie wanted to cheat, they could use the wrong value of $b$, and learn the task given to the other guy.  However, if they did that, they wouldn't learn their own, and so if we assume that they find that unacceptable, this isn't an issue.  It is possible to insert a zero knowledge proof that would ensure that they're not doing that (the details of which would depend on the OT protocol used); however I don't know if you need to do that.