An auction protocol which hides bids of losers. (English) Zbl 0969.94023
Imai, Hideki (ed.) et al., Public key cryptography. 3rd international workshop on Practice and theory in public key cryptosystems, PKC 2000, Melbourne, Victoria, Australia, January 18-20, 2000. Proceedings. Berlin: Springer. Lect. Notes Comput. Sci. 1751, 422-432 (2000).
Summary: Many auction protocols using practical cryptographic means have successfully achieved capability of hiding the bids of each entity, but not the values of bids themselves. In this paper we describe an auction protocol which hides the bids of non-winners even from the bid-opening centers, and still makes it possible to publicly verify the validity of the winning bid, i.e. that it was the highest bid submitted. The first approach to such a protocol was made by H. Kikuchi, M. Harkavy and D. Tyger [Multi-round anonymous auction protocols. In IEEE Workshop on Dependable and Real-Time E-Commerce System (1998)]. However, several deficiencies have been pointed out regarding their protocol; for example, it is not well suited for handling tie bids.
We present an auction protocol in which a bid will not be successfully decrypted unless it is the highest bid, thus ensuring bid privacy. In addition, it enables participants to verify that the winning bid is indeed the highest. Also in contrast to the previous work, our protocol can identify all the winners who submitted the winning bid.
Our protocol allows for very compact representations for bids: a bid is represented by a single probabilistic encryption. In the protocol cited above a bid is represented by a vector of encryptions, of length linear in the number of possible bid values.
We present two practical schemes based on the ElGamal cryptosystem and the RSA cryptosystems, respectively.
For the entire collection see [Zbl 0931.00050].
We present an auction protocol in which a bid will not be successfully decrypted unless it is the highest bid, thus ensuring bid privacy. In addition, it enables participants to verify that the winning bid is indeed the highest. Also in contrast to the previous work, our protocol can identify all the winners who submitted the winning bid.
Our protocol allows for very compact representations for bids: a bid is represented by a single probabilistic encryption. In the protocol cited above a bid is represented by a vector of encryptions, of length linear in the number of possible bid values.
We present two practical schemes based on the ElGamal cryptosystem and the RSA cryptosystems, respectively.
For the entire collection see [Zbl 0931.00050].
