How to obtain full privacy in auctions

Abstract

Privacy has become a factor of increasing importance in auction design. We propose general techniques for cryptographic first-price and (M + 1)st-price auction protocols that only yield the winners' identities and the selling price. Moreover, if desired, losing bidders learn no information at all, except that they lost. Our security model is merely based on computational intractability. In particular, our approach does not rely on trusted third parties, e.g., auctioneers. We present an efficient implementation of the proposed techniques based on El Gamal encryption whose security only relies on the intractability of the decisional Diffie-Hellman problem. The resulting protocols require just three rounds of bidder broadcasting in the random oracle model. Communication complexity is linear in the number of possible bids.

Brandt’s Fully Private Auction Protocol Revisited

“…The protocol of Brandt [4] was designed to ensure full privacy in a completely distributed way. It exploits the homomorphic properties of a distributed El-Gamal encryption scheme [12] for a secure multi-party computation of the winner.…”

“…, k} (where bid a is the bid chosen by the bidder with index a), Y ∈ G q \ {1}. More precisely, the n bidders execute the following five steps of the protocol [4]:…”

“…A first scheme for PDL was developed in 1986 by Chaum et al [6]. In the original auction paper [4] Brandt proposes to use a non-interactive variant of PDL as developed by Schnorr [24], which are malleable. Unfortunately, interactive malleable PDL are subject to man-inthe-middle attacks [16].…”

“…the bids of losing bidders remain private. Brandt proposed a first-price sealed-bid auction protocol [4,3,2] and claimed that it is fully private, i.e. it leaks no information apart from the winner, the winning bid, and what can be deduced from these two facts (e.g.…”

“…This corresponds exactly to the structure of the products inside each γ a ij . It is also equivalent to formula (1) in Section 4.1.1 of the original paper [4] without the random vector R * k . In the following we prove that the function f is injective.…”