230 likes | 392 Views
(M+1)st-Price Auction Protocol. Hiroaki Kikuchi Tokai Univ. My apology. The protocol in proceedings is not secure . Don’t referee this version. Revised version will be published in FC01. Internet Auction. Entertainment Real-time Pseudonym Anonymity A world-wide auction Scalability
E N D
(M+1)st-Price Auction Protocol Hiroaki Kikuchi Tokai Univ.
My apology • The protocol in proceedings is not secure. • Don’t referee this version. • Revised version will be published in FC01.
Internet Auction • Entertainment • Real-time • Pseudonym • Anonymity • A world-wide auction • Scalability • Bidding and selling • Interactive
Auction Style • English Auction • Dutch Auction • Sealed-bid Auction • First-price rule (Dutch) • Second-price rule (English) • M+1st price rule (Power Auction)
Why sealed-bid? • proxy-auction • bidding agent that automatically rises price up to the maximum price. • one-shot auction • the winning price is determined by the second-highest bid
8 7 M=2 3 2 1 A B C D E (M+1)st-price Auction • Definition • Given M units of item, n bidders wish to know M+1st highest price, w*, and M winners who outbid w*.
Requirements • Privacy of bids • privacy of winner’s bids • Performance • Round complexity (non-interactive) • Communication cost • Computational cost • Trust of Auctioneers
A is $10 B is $8 Issue 3: Malicious Auctioneer $10 $8 A B C
A:10 B:8,C:6 Preference DB Issue 4: Privacy of bidder $10 $8 $6 A B C
Related Works • Dutch Approach • Undeniable Signature (Miyazaki & Sakurai 1999) • One-way hash (Kobayashi & Morita 1999) • Distributed Approach • Secret Sharing (Franklin and Reiter 1997) • Group signature (Sako 1999) • Oblivious function evaluation (Cachin 99, Naor 99)
Our Approach • Distributed auctioneers • Secure multiparty protocol • Our contribution • to the optimal first-price auction protocol • to present (M+1)st-price auction for the first time
Model seller Auctioneers m bidders n
Building Blocks • 1. Protocol MAXIMUM • max(x, y, z) • 2. Protocol WINNER • W = {i | bi > w*} • 3. Protocol PRICE • w* = M+1st-highest price
New Trick • Homomorphism of polynominals + f, g f+g deg(f), deg(g) MAX(deg(f), deg(g)) MAX
Protocol MAXIMUM • Random polynomial with degree representing bid • fA(x)=a1x+a2x2(a=2) • fB(x)=b1x+b2x2+b3x3(b=3) • fC(x)=c1x (c=1) • F(x) = fA(x)+fB(x)+fC(x) = (a1+b1+c1)x +(a2+b2)x2 + b3x3 degree d = Max(a,b,c) = 3
Degree Resolution • Assumption • m > k (k = # of possible prices) • c faulty auctioneers • t-th interpolation • F(t)(0) = 0 if t> deg(F)
fA(1)+ fB(1)=F(1) F(0)=0? fB(1) B fB(2) fA(2)+ fB(2)=F(2) Secret Function Computation • Distributed summation A 1 fA(1) fA(2) 2
Protocol MAJORITY • Definition • Given vi in {yes(1), no(0)}, • determine whether V=v1+v2+...+vn > T, or not without revealing V • Idea • Secure distributed computation of multiplication of polynomials of degree vi
Protocol MAJORITY (cont.) • Polynomials of degree • deg(fi) = c+1 if i-th bidder bids at the price c Otherwise fA(x)=a1x+a2x2(a=1) fB(x)=b1x+b2x2 (b=1) fC(x)=c1x (c=0) fd(x)=d1x (d=0) F(x) = fA(x)×fB(x) ×fC(x) ×fC(x) deg(F) e = a+b+c+d+4=6
Protocol (M+1)st-Price • Overview • bidders commit bid using Protocol MAXIMUM • auctioneers use Protocol MAJORITY for w1,w2,...,wk to find (M+1)st price w*.
Bids distribution M > # of willing-to-bids F(M)(0) M bidding price w
Performance First-Price (M+1)st
Conclusion • We have proposed efficient and secure protocol for (M+1)st-price auction in which no distribution of bids are revealed. • The round complexity between bidders and auctioneers is in O(1).