Brandt’s Fully Private Auction Protocol Revisited

Abstract

Abstract. Auctions have a long history, having been recorded as early as 500 B.C. [17]. Nowadays, electronic auctions have been a great success and are increasingly used. Many cryptographic protocols have been proposed to address the various security requirements of these electronic transactions, in particular to ensure privacy. Brandt [4] developed a protocol that computes the winner using homomorphic operations on a distributed ElGamal encryption of the bids. He claimed that it ensures full privacy of the bidders, i.e. no information apart from the winner and the winning price is leaked. We first show that this protocol -when using malleable interactive zero-knowledge proofs -is vulnerable to attacks by dishonest bidders. Such bidders can manipulate the publicly available data in a way that allows the seller to deduce all participants' bids. Additionally we discuss some issues with verifiability as well as attacks on non-repudiation, fairness and the privacy of individual bidders exploiting authentication problems.

ERA: Towards privacy preservation and verifiability for online ad exchanges

“…When these existing privacy preserving and/or verifiable auction mechanisms are directly applied to ad exchanges, they have high computation and communication complexity. Thus, these works could only support auctions with small scale [37,42,43] or a limited number of possible bids [44,45,46], which may be unacceptable for today's ad exchanges.…”

Formal modelling and analysis of receipt-free auction protocols in applied pi

“…The tool has been used to verify many security and privacy properties, e.g., see [32,33,34,35,36,9,37,21].…”

“…However, security protocols are notoriously difficult to design and analyse, and proofs of security protocols are known to be error-prone, thus we do not want to rely on an informal analysis. In several cases, formal verification found security flaws in protocols which were thought to be secure [19,20,15,21].…”

Secure Auctions without Cryptography

“…The seller then determines the winner using the same technique as above. 7 To prove to the bidders that his result is correct, he sends 7 There is a potential attack when a bidder and the seller collude: the seller can open all bids from the other bidders until he identifies the highest bid, and then inform the colluding bidder to submit a bid for the same price in order to provoke a tie. Note that this can only be used to provoke a tie, as submitting a higher bid afterwards results in two envelopes for different prices containing "Yes" with broken seals, which can be detected.…”

“…only the winner and the seller learn who the winner is. However, the reliance on cryptographic primitives has its downside: cryptographic primitives are complex, and their use requires great care not to introduce subtle weaknesses, as recent analysis of Brandt's protocol shows [7].…”