Single-Cut Full-Open Protocols

• Single-cut full-open protocols are card-based secure computation methods where private inputs are encoded as a single face-down deck, one random cyclic cut is applied, and all cards are revealed to determine the output.
• They leverage cyclic rotation orbits to enforce security and correctness by ensuring that inputs yielding the same result have indistinguishable revealed configurations.
• Recent constructions demonstrate explicit protocols for Boolean functions like three-bit parity, while same-color restrictions underline critical feasibility limits.

Searching arXiv for recent and foundational papers on single-cut full-open card-based protocols. Searching for the exact papers cited in the provided source block to ground the article. Single-cut full-open protocols are card-based secure computation protocols in which private inputs are encoded as a single face-down sequence, exactly one uniformly random cut is performed, and then all cards are opened to determine the output. In the current arXiv literature, the term refers specifically to protocols where the shuffle primitive is a hidden cyclic rotation of the whole deck, not an arbitrary permutation, and where privacy is information-theoretic: the revealed configuration must leak no information beyond the output value itself (Shinagawa et al., 4 Jul 2025, Ikeda et al., 22 Sep 2025, Eriguchi et al., 20 Oct 2025).

1. Formal model and protocol mechanics

An SCFO protocol has three defining properties: the input is encoded as a single face-down sequence of cards, a single random cut is applied, and the protocol is full-open, meaning that after the cut all cards are turned face up and no face-down “garbage” remains (Shinagawa et al., 4 Jul 2025). In the notation used for literal-template protocols, if $S=(s_1,\dots,s_n)$ is the ordered sequence, then for $k \in \{0,\dots,n-1\}$ the $k$-cut is the cyclic rotation

$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$

with indices taken modulo $n$; the hidden cut amount is sampled uniformly (Shinagawa et al., 4 Jul 2025).

Two closely related formalisms appear in recent work. In the standard commitment-based SCFO model, a bit $x \in \{0,1\}$ is committed as the pair $(x,\neg x)$, so that $x=0$ is represented by $(\spadesuit,\heartsuit)$ and $x=1$ by $k \in \{0,\dots,n-1\}$0, and an $k \in \{0,\dots,n-1\}$1-bit input is initially encoded as

$k \in \{0,\dots,n-1\}$2

A standard protocol may also permute these committed cards and insert additional cards before the single cut (Ikeda et al., 22 Sep 2025). In the literal-template formulation, by contrast, the protocol fixes a sequence of literal-labeled cards such as $k \in \{0,\dots,n-1\}$3, and an input assignment determines the visible bits those cards will show when opened (Shinagawa et al., 4 Jul 2025).

The single-cut operation is strictly weaker than the broader “single-shuffle” model. In card-based cryptography, a random cut is a uniformly random cyclic rotation of the whole deck, whereas single-shuffle full-open protocols may use richer shuffle families such as complete shuffles, pile-scramble shuffles, pile-shifting shuffles, or compositions thereof (Eriguchi et al., 20 Oct 2025). This distinction is structurally important: many universal constructions known for single-shuffle full-open protocols do not specialize to one random cut.

2. Security, correctness, and cyclic equality

The central security notion is perfect output-only privacy. If $k \in \{0,\dots,n-1\}$4 denotes the distribution of face-up sequences produced by the protocol on input $k \in \{0,\dots,n-1\}$5, correctness requires that the decoding function output $k \in \{0,\dots,n-1\}$6 with probability $k \in \{0,\dots,n-1\}$7, and privacy requires

$k \in \{0,\dots,n-1\}$8

Under a uniform random cut, this condition is equivalent to a combinatorial criterion based on cyclic equality (Ikeda et al., 22 Sep 2025).

Two binary sequences $k \in \{0,\dots,n-1\}$9 are cyclically equal if there exist contiguous substrings $k$0 such that $k$1 and $k$2. Equivalently, one is a cyclic rotation of the other. In SCFO, if all pre-cut arrangements for inputs with output $k$3 are cyclically equal, then the single hidden cut produces identical observable distributions for all such inputs; conversely, equality of the observable distributions under uniform cyclic rotation forces the underlying arrangements to be cyclically equal, modulo the placement of inserted fixed-color cards (Ikeda et al., 22 Sep 2025).

This yields the standard characterization of SCFO security and correctness. Security requires cyclic equality within each output class: for any output bit $k$4, any two admissible pre-cut sequences corresponding to output $k$5 must belong to the same rotation orbit. Correctness requires separation across output classes: a representative sequence for output $k$6 must not be cyclically equal to a representative sequence for output $k$7 (Ikeda et al., 22 Sep 2025).

In the protocols proposed for specific Boolean functions, decoding is often orbit-based. The reading rule fixes two canonical representatives $k$8 and outputs $k$9 exactly when the revealed word belongs to the orbit

$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$0

For such protocols, the post-cut view on any input with value $C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$1 is the uniform distribution over $C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$2, which makes privacy immediate once orbit membership depends only on the function value (Shinagawa et al., 4 Jul 2025).

3. Concrete constructions for Boolean functions

Recent work provides explicit SCFO protocols for several low-arity Boolean functions. A note devoted specifically to SCFO protocols proposes three new protocols: one for three-bit parity, one for a four-variable function, and one for a derived three-variable function obtained by fixing one public constant (Shinagawa et al., 4 Jul 2025).

Protocol	Function	Template
Protocol 1	$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$3	$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$4
Protocol 2	$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$5	$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$6
Protocol 3	$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$7	$C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$8

All three protocols use $C_k(S)=(s_{k+1},s_{k+2},\dots,s_n,s_1,\dots,s_k),$9 cards, one random cut, and one full opening (Shinagawa et al., 4 Jul 2025). Protocol 1 is notable because it uses two pairs $n$0, which the paper explicitly identifies as distinctive among known SCFO protocols. For each protocol, correctness is certified by exhaustive input tables showing that every evaluated input sequence is a cyclic shift of the correct output representative, and privacy follows because inputs with the same function value induce the same uniform distribution over a rotation orbit (Shinagawa et al., 4 Jul 2025).

The recent literature also situates these constructions relative to older known SCFO protocols. For two variables, SCFO protocols are known for XOR, $n$1, via a $n$2-SCFO, and for AND, $n$3, via a $n$4-SCFO due to den Boer. For three variables, a known SCFO protocol exists for the equality predicate $n$5; the newer note adds three-bit parity and the mixed-literal functions above to the catalog (Ikeda et al., 22 Sep 2025, Shinagawa et al., 4 Jul 2025).

A plausible implication is that template design is the main constructive degree of freedom in SCFO. The papers emphasize fixed literal order, cyclic-orbit decoding, and, in the standard model, the option of inserting additional cards before the cut. The 2025 note explicitly leaves open the role of multiple literal-pairs per variable and the problem of minimal deck sizes for a given function (Shinagawa et al., 4 Jul 2025).

4. Feasibility boundaries and impossibility results

The simplicity of SCFO also makes the model rigid enough for impossibility theorems. For three-variable Boolean functions, a paper proves that under the restriction that all additional cards have the same color, no new SCFO protocols exist beyond the known equality protocol (Ikeda et al., 22 Sep 2025).

More precisely, consider any standard SCFO protocol that performs exactly one uniformly random cyclic cut followed by full reveal, and that uses an arbitrary number of additional cards of a single color only, either a $n$6-SCFO or, by symmetry, a $n$7-SCFO. Then among the NPN-representatives of three-variable functions, the only realizable nontrivial function under this same-color restriction is the triple equality function $n$8 (Ikeda et al., 22 Sep 2025).

The same paper gives a fine-grained enumeration. Under the same-color restriction, the following are ruled out: three-input AND, three-input XOR, majority, exactly-one, $n$9, $x \in \{0,1\}$0, $x \in \{0,1\}$1, $x \in \{0,1\}$2, and $x \in \{0,1\}$3 (Ikeda et al., 22 Sep 2025). The same-color assumption is essential: beyond that assumption, some three-variable functions are known to be realizable by SCFO, and the paper explicitly mentions a $x \in \{0,1\}$4-SCFO for $x \in \{0,1\}$5 and a non-standard SCFO for three-variable XOR (Ikeda et al., 22 Sep 2025).

The proof method is a mathematical optimization framework. Fixing the permutation of the committed input sequence, the protocol is modeled by nonnegative integer variables $x \in \{0,1\}$6 that count inserted same-color cards at each position. The analysis parses each permuted input word into segments between $x \in \{0,1\}$7-cards on the cycle, writes the post-insertion zero counts as

$x \in \{0,1\}$8

and then enforces cyclic equality within each output class by linear equations of the form

$x \in \{0,1\}$9

Correctness is then checked a posteriori by requiring that representative sequences for outputs $(x,\neg x)$0 and $(x,\neg x)$1 are not cyclically equal (Ikeda et al., 22 Sep 2025).

This formulation is significant because the variables $(x,\neg x)$2 are unbounded. The impossibility result therefore does not depend on a small-card assumption: it persists even when arbitrarily many additional same-color cards are allowed (Ikeda et al., 22 Sep 2025).

5. Relation to single-shuffle full-open protocols and PSM

SCFO is best understood as the most restrictive full-open case of the broader single-shuffle literature. A single-shuffle full-open protocol performs one shuffle and then opens all cards, but the shuffle need not be a cyclic rotation. Recent work proves that every Boolean function admits a single-shuffle full-open protocol, thereby establishing universality for the broader model (Eriguchi et al., 20 Oct 2025).

The main universal construction starts from a Private Simultaneous Messages protocol $(x,\neg x)$3 for $(x,\neg x)$4. If the PSM has randomness complexity $(x,\neg x)$5 and communication complexity $(x,\neg x)$6, then there exists a single-shuffle full-open protocol for $(x,\neg x)$7 using at most $(x,\neg x)$8 cards, with shuffle equal to a composition of one pile-shifting shuffle and one complete shuffle (Eriguchi et al., 20 Oct 2025). Combined with the Beimel–Kushilevitz–Nissim bound, this yields single-shuffle full-open protocols for arbitrary $(x,\neg x)$9 with card complexity $x=0$0 (Eriguchi et al., 20 Oct 2025).

A second construction uses additive PSM over $x=0$1. In that case the protocol uses $x=0$2 cards via one-hot encodings and a composition of $x=0$3 pile-shifting shuffles. This gives, for example, an $x=0$4-input AND protocol with $x=0$5 cards and $x=0$6 pile-shifts, and a general construction for arbitrary $x=0$7 via an AND decomposition using $x=0$8 cards together with $x=0$9 pile-shifts and one pile-scramble (Eriguchi et al., 20 Oct 2025).

None of these universal full-open results yields a universal single-cut full-open protocol. The paper is explicit on this point: for arbitrary $(\spadesuit,\heartsuit)$0, the universal full-open constructions require either pile-shifting followed by complete shuffle, or many pile-shifts plus pile-scramble. A cyclic rotation alone cannot both select one randomness block uniformly and erase the information in the nonselected blocks after a full opening (Eriguchi et al., 20 Oct 2025). By contrast, a universal single-cut protocol is obtained only in the adaptive-open model, not in the full-open model: with extra delimiter cards, one random cut suffices for adaptive opening, but not for the universal full-open transformations presented there (Eriguchi et al., 20 Oct 2025).

This distinction resolves a common misconception. Universality has been proved for single-shuffle full-open protocols, but not for single-cut full-open protocols. The former allows richer shuffle families; the latter remains sharply constrained by cyclic-rotation structure (Eriguchi et al., 20 Oct 2025).

6. Scope, design principles, and open questions

Three design principles recur across the literature. First, SCFO protocols are orbit-based: the revealed word after the hidden cut must land in a rotation class determined solely by the output value (Shinagawa et al., 4 Jul 2025). Second, in the standard model, privacy reduces to cyclic equality within output classes, which is strong enough to support optimization-based impossibility proofs (Ikeda et al., 22 Sep 2025). Third, moving beyond a single random cut to richer one-shot shuffles dramatically enlarges expressiveness, up to universality for arbitrary functions (Eriguchi et al., 20 Oct 2025).

At the same time, the current boundary of knowledge is uneven. Concrete SCFO constructions are known for a small but growing collection of functions, including two-input XOR, two-input AND, three-input equality, three-bit parity, the four-variable function

$(\spadesuit,\heartsuit)$1

and the derived three-variable function

$(\spadesuit,\heartsuit)$2

(Shinagawa et al., 4 Jul 2025, Ikeda et al., 22 Sep 2025). Yet even for three variables, strong impossibility holds under same-color insertions, and the general mixed-color SCFO classification problem remains open (Ikeda et al., 22 Sep 2025).

Several research directions are explicit in the papers. One is to characterize exactly which Boolean functions admit SCFO protocols. Another is to determine minimal deck sizes and understand whether allowing multiple literal-pairs per variable changes feasibility in a systematic way (Shinagawa et al., 4 Jul 2025). On the impossibility side, extending the optimization framework beyond the same-color assumption, and scaling from three variables to four or more variables, are natural next steps (Ikeda et al., 22 Sep 2025). On the positive side, the bridge to PSM suggests a broader program of translating cryptographic communication primitives into card-based protocols, while also clarifying which expressive gains fundamentally require shuffle families more powerful than a single cyclic rotation (Eriguchi et al., 20 Oct 2025).

Taken together, these results place SCFO at a distinctive point in card-based cryptography. It is the simplest visually and operationally, analytically governed by cyclic-rotation orbits, constructively nontrivial for selected functions, and provably too weak for universal full-open secure computation as currently understood.