Second Price Auctions A Case Study of Secure Distributed Computing Bart De Decker Gregory Neven Frank Piessens Erik Van Hoeymissen

2 Secure Distributed Computing  Given  n different participants P i with secrets x i  a function f  How to  compute f(x 1,..., x n )  Such that  everybody learns result  no further information about x i is leaked

3 Second price auction  Properties  Closed auction (i.e. bids kept secret)  Winner: highest bidder (draw  no winner)  Clearing price: second highest bid  Only information revealed  ID of winner  Clearing price  (draw  no information at all)

4 Overview  Secure Distributed Computing (SDC)  Trivial solution using Trusted Third Party (TTP)  Cryptographic solution [FraHa96]  Implementation using SDC  Circuit design  Assessment  Trade-off using mobile agents  Conclusion

5 Trivial solution using TTP... x1x1 x2x2 x3x3 xnxn y = f(x 1,..., x n ) y y y y n TTP

6 Trivial solution using TTP n TTP

7 Overview  Secure Distributed Computing (SDC)  Trivial solution using Trusted Third Party (TTP)  Cryptographic solution [FraHa96]  Implementation using SDC  Circuit design  Assessment  Trade-off using mobile agents  Conclusion

8 x 1 = x 1 (0) x 1 (1) E(x 1 (0) ), E(x 1 (1) ),... E(x i (j) )  i,j evaluation E(y (j) )  j D i (E(y (0) )), D i (E(y (1) )),... y = y (0) y (1)... Protocol outline

9 Overview  Secure Distributed Computing (SDC)  Trivial solution using Trusted Third Party (TTP)  Cryptographic solution [FraHa96]  Implementation using SDC  Circuit design  Assessment  Trade-off using mobile agents  Conclusion

10 Implementation using SDC  Inputs  encoding of n bids (32b)  Outputs  index of winner (or “draw”)  encoding of second highest bid  Assessment  O(n 2 ) gates = O(n 3 ) broadcasts = O(n 4 ) packets n41632 Overhead (MB)

11 Overview  Secure Distributed Computing (SDC)  Trivial solution using Trusted Third Party (TTP)  Cryptographic solution [FraHa96]  Implementation using SDC  Circuit design  Assessment  Trade-off using mobile agents  Conclusion

12 Two extreme implementations  Using globally TTP  Very efficient  High level of trust in TTP needed  Using SDC  High communication overhead  No trust in other parties needed  Trade-off between these two extremes: using  mobile agents running on  semi-trusted execution sites

13 Trade-off using mobile agents  P i trusts E j to offer secure execution platform  High-bandwidth connections between execution sites  P i sends agent A i to E j  contains private data x i  implements SDC protocol  Generic: useful for wide variety of protocols 1 E2E A1A1 A4A4 A3A3 A5A5 A6A6 A2A2 E3E3 E1E1

14 Overview  Secure Distributed Computing (SDC)  Trivial solution using Trusted Third Party (TTP)  Cryptographic solution [FraHa96]  Implementation using SDC  Circuit design  Assessment  Trade-off using mobile agents  Conclusion

15 Conclusion  Globally Trusted Third Party  Powerful and efficient  High level of trust needed  Secure Distributed Computing protocols  Avoids need of TTP  Overwhelming communication overhead  Trade-off: trust  communication overhead  Semi-trusted sites on high-bandwidth connections  Mobile agents executing SDC protocol

16 Properties of encryption scheme  “Joint”  anyone can encrypt  “decryption witness” of each player needed to decrypt  Probabilistic  one plaintext  many ciphertexts  secure for small message spaces  disadvantage: data blowup  XOR-homomorphic  Given E(b) and E(b’), anyone can compute E(b  b’)