Practical secrecy-preserving, verifiably correct and trustworthy auctions

Abstract

We present a practical system for conducting sealed-bid auctions that preserves the secrecy of the bids while providing for verifiable correctness and trustworthiness of the auction. The auctioneer must accept all bids submitted and follow the published rules of the auction. No party receives any useful information about bids before the auction closes and no bidder is able to change or repudiate her 1 bid. Our solution uses Paillier's homomorphic encryption scheme [25] for zero knowledge proofs of correctness. Only minimal cryptographic technology is required of bidders; instead of employing complex interactive protocols or multi-party computation, the single auctioneer computes optimal auction results and publishes proofs of the results' correctness. Any party can check these proofs of correctness via publicly verifiable computations on encrypted bids. The system is illustrated through application to firstprice, uniform-price and second-price auctions, including multiitem auctions. Our empirical results demonstrate the practicality of our method: auctions with hundreds of bidders are within reach of a single PC, while a modest distributed computing network can accommodate auctions with thousands of bids.

Secure Second Price Auctions with a Rational Auctioneer

“…However, in many cases privacy is achieved by using third parties, either through numerous auctioneers or by asymmetric models in which in addition to the auctioneer the entity of a supervisor (or auction issuer) is assumed (Naor et al, 1999;Lipmaa et al, 2003). Parkes et al (Parkes et al, 2008) settle for verifiable correctness and trustworthiness in combination with complete secrecy to all parties except the auctioneer. However, their scheme demands considerable time for preparation and verification of auctions.…”

“…This Table 1: Comparison of various secure auction schemes. Legend: n -Number of bidders; α -Probability that a third party verifies auctioneer's output; l -Maximum number of bits needed to represent a single bid; k -A constant used in (Parkes et al, 2008).…”

Cryptographic Combinatorial Securities Exchanges

“…Any basic cryptographic protocols supporting provably correct, secrecy-preserving computation over private inputs, such as those described in [20], [15] and [14], are sufficient to construct our exchange. As our protocol does not depend on specific features, such as a particular homomorphism, we do not burden our exposition with specific implementation details.…”

“…If a homomorphic cryptosystem is used for the computations, such as the system described by Paillier [10] and elaborated in [14] and [4], then additional preparation is required to prove results of computations employing both additions and multiplications. Since no known cryptosystem is doubly homomorphic, 4 we require instead that whatever underlying cryptosystem is employed support proofs of correct computation of both addition and multiplication.…”

“…In a homomorphic cryptosystem, a verifier would check one operation by direct computation over ciphertexts, and the other by receiving information from the prover. For example, using Paillier encryption, a verifier could check addition by simply multiplying ciphertexts; she would only be able to check multiplication with the help of a prover using (non-interactive) protocols such as those described in [4,14].…”