Power Auction Protocol without revealing winning bids

1. Power Auction Protocol without revealing winning bids Hiroaki Kikuchi Tokai univ.

2. My apology • The protocol in proceedings is not secure. • Don’t referee this version. • Revised version will be published in FC01.

3. Internet Auction • Entertainment • Real-time • Pseudonym • Anonymity • A world-wide auction • Scalability • Bidding and selling • Interactive

4. Auction Style • English Auction • Dutch Auction • Sealed-bid Auction • First-price rule (Dutch) • Second-price rule (English) • M+1st price rule (Power Auction)

5. Why sealed-bid? • proxy-auction • bidding agent that automatically rises price up to the maximum price. • one-shot auction • the winning price is determined by the second-highest bid

6. 8 7 M=2 3 2 1 A B C D E (M+1)st-price Auction • Definition • Given M units of item, n bidders wish to know M+1st highest price, w*, and M winners who outbid w*.

7. Requirements • Privacy of bids • privacy of winner’s bids • Performance • Round complexity (non-interactive) • Communication cost • Computational cost • Trust of Auctioneers

8. A is $10 B is $8 Issue 3: Malicious Auctioneer $10 $8 A B C

9. A:10 B:8,C:6 Preference DB Issue 4: Privacy of bidder $10 $8 $6 A B C

10. Related Works • Dutch Approach • Undeniable Signature （Miyazaki & Sakurai 1999） • One-way hash （Kobayashi & Morita 1999） • Distributed Approach • Secret Sharing （Franklin and Reiter 1997） • Group signature （Sako 1999） • Oblivious function evaluation (Cachin 99, Naor 99)

11. Our Approach • Distributed auctioneers • Secure multiparty protocol • Our contribution • to the optimal first-price auction protocol • to present (M+1)st-price auction for the first time

12. Model seller Auctioneers m bidders n

13. Building Blocks • 1. Protocol MAXIMUM • max(x, y, z) • 2. Protocol WINNER • W = {i | bi > w*} • 3. Protocol PRICE • w* = M+1st-highest price

14. New Trick • Homomorphism of polynominals + f, g f+g deg(f), deg(g) MAX(deg(f), deg(g)) MAX

15. Protocol MAXIMUM • Random polynomial with degree representing bid • fA(x)=a1x+a2x2(a=2) • fB(x)=b1x+b2x2+b3x3(b=3) • fC(x)=c1x (c=1) • F(x) = fA(x)+fB(x)+fC(x) = (a1+b1+c1)x +(a2+b2)x2 + b3x3 degree d = Max(a,b,c) = 3

16. Degree Resolution • Assumption • m > k (k = # of possible prices) • c faulty auctioneers • t-th interpolation • F(t)(0) = 0 if t> deg(F)

17. fA(1)+ fB(1)=F(1) F(0)=0? fB(1) B fB(2) fA(2)+ fB(2)=F(2) Secret Function Computation • Distributed summation A 1 fA(1) fA(2) 2

18. Protocol MAJORITY • Definition • Given vi in {yes(1), no(0)}, • determine whether V=v1+v2+...+vn > T, or not without revealing V • Idea • Secure distributed computation of multiplication of polynomials of degree vi

19. Protocol MAJORITY (cont.) • Polynomials of degree • deg(fi) = c+1 if i-th bidder bids at the price c Otherwise fA(x)=a1x+a2x2(a=1) fB(x)=b1x+b2x2 (b=1) fC(x)=c1x (c=0) fd(x)=d1x (d=0) F(x) = fA(x)×fB(x) ×fC(x) ×fC(x) deg(F) e = a+b+c+d+4=6

20. Protocol (M+1)st-Price • Overview • bidders commit bid using Protocol MAXIMUM • auctioneers use Protocol MAJORITY for w1,w2,...,wk to find (M+1)st price w*.

21. Bids distribution M > # of willing-to-bids F(M)(0) M bidding price w

22. Performance First-Price (M+1)st

23. Conclusion • We have proposed efficient and secure protocol for (M+1)st-price auction in which no distribution of bids are revealed. • The round complexity between bidders and auctioneers is in O(1).