Is there a cryptographic way (a la mental poker) two people can determine if they both Like each other, without revealing their personal preferences?

Question

Specifically: Alice and Bob want to know if they like each other, but won't admit it if the other person doesn't reciprocate. (They're teenagers, or physicists.) They don't trust anyone else, so want to do it cryptographically.

So, say A->B=1 if Alice likes Bob, 0 otherwise. And let B->A=1 if Bob likes Alice, and zero otherwise. They want to compute "(A->B) AND (B->A)", without revealing their individual rankings. Is there a way that the following sequence could be applied:

1. Alice encodes her answer (either flipping her bit, or not) and sends it to Bob

2. Bob applies some function to Alice's preference and his own, and sends the answer back to Alice (but also possibly sends some other information or output from the calculation)

3. Alice applies some inverse function to determine only whether both A->B and B->A were 1, and announces the outcome, without her being able to know (or determine) B->A (excluding repeated games, or Princess Bride style psychological arguments).

My gut instinct is that this can't be done (the AND operator destroys information, and providing any extra outputs would allow Alice to determine Bob's true feelings) but intuition is hard. I'm thinking of solutions along the lines of poker by phone and the Three-Pass Protocol. It's similar but different to Yao's millionaire problem, which allows two parties to secretly decide if a>=b; that's not sufficient in this case (both because it doesn't distinguish between (1,1) and (0,0), and because it could allow them to quickly deduce their opposite's opinions.

More generally, it could apply to any situation where revealing the truth would be problematic unless the other person was on board.

Appreciate any thoughts!

Answer 1

You were on the right track with Yao's Millionaires Problem. Yao's Millionaires Problem is just one specific example, but almost anything can be calculated securely by using by a garbled circuit.

@mikeazo is right that if Bob chooses 1, then he'll always know Alice's choice. However, if Bob chooses 0, then the output of the circuit will always be 0, so Bob won't be able to determine Alice's choice.

The following tables show the information that is revealed to both parties when you use different gates in the circuit:

AND

+-------+---------+----------+--------------+--------------+
|  Bob  |  Alice  |  Output  |  B knows A?  |  A knows B?  |
+-------+---------+----------+--------------+--------------+
|   0   |    0    |    0     |  No          |  No          |
|   0   |    1    |    0     |  No          |  Yes         |
|   1   |    0    |    0     |  Yes         |  No          |
|   1   |    1    |    1     |  Yes         |  Yes         |
+-------+---------+----------+--------------+--------------+

OR

+-------+---------+----------+--------------+--------------+
|  Bob  |  Alice  |  Output  |  B knows A?  |  A knows B?  |
+-------+---------+----------+--------------+--------------+
|   0   |    0    |    0     |  No          |  No          |
|   0   |    1    |    1     |  Yes         |  No          |
|   1   |    0    |    1     |  No          |  Yes         |
|   1   |    1    |    1     |  No          |  No          |
+-------+---------+----------+--------------+--------------+

XOR

+-------+---------+----------+--------------+--------------+
|  Bob  |  Alice  |  Output  |  B knows A?  |  A knows B?  |
+-------+---------+----------+--------------+--------------+
|   0   |    0    |    0     |  Yes         |  Yes         |
|   0   |    1    |    1     |  Yes         |  Yes         |
|   1   |    0    |    1     |  Yes         |  Yes         |
|   1   |    1    |    0     |  Yes         |  Yes         |
+-------+---------+----------+--------------+--------------+

An XOR gate is useless for privacy, since it reveals the other person's choice in all cases. An OR gate is also pretty useless in this scenario, but it could be added to an AND gate circuit to remove the information asymmetry. (All inputs revealed unless both parties choose 0.)

The AND gate example could be used to create a secure P2P dating application, where two people are only matched if they like each other. In the context of a mobile application, there would be some additional possibilities that explain negative outcomes. For example, the other person might not have viewed your profile yet, or they might have uninstalled the app.

If someone likes someone who doesn't like them back, then the other person will have no idea. The real-world benefit is that they can interact with the person they like without any embarrassment. And maybe they can try to win them over :)

Answer 2

The answer to your specific scenario is no, it cannot be done. As mentioned in a comment, if Bob knows his preference (B->A) and learns that the result of the calculation is $0$, then Bob now knows Alice's preference, i.e., A->B is 0.