Completely Anonymous, Secure, Verifiable, and Secrecy Preserving Auctions Michael O. Rabin, Harvard University and Google Research Joint work with Yishay Mansour Valiant Symposium, Washington DC. May 2009

GOALS Auction Mechanism, Auctioneer/Prover, Auction, Bidders Bidding: Secret, Non-Coercible, Deniable Verifiable Proof of Correctness of Outcome Bids, Winners, Prices: Permanently Secret Winners Deniably Know Prices, Quantities

High level structure Bidders –Send their bid-shares to Trusted Parties Trusted parties –Prepare random vector representations of each share, and securely send to Auctioneer –Can have t faulty out of 3t+1 parties Auctioneer –Calculates auction outcome –Prepares public zero-knowledge proofs of correctness, for future verifiers.

Main Ideas and Methods Representing numbers: Let p be a 128-bit prime –F p = {0, …, p-1} –operations: addition and multiplication mod p. X = (u,v) –val(X) = u+v mod p For x in F p, X = (u,v) represents x if val(X) = x. – Example: p = 17, x = 5, X = ( 13, 9 ) Creating Random Representations X of x –Choose u randomly, set v= (x-u) mod p

Illustration of the Method Auctioneer/Prover (AU) has x, y, z, where x = y+z, wants to prove this sum. X=(u 1,v 1 ); Y=(u 2,v 2 ); Z=(u 3,v 3 ) rand. Reps. of x, y, z. Coordinates posted as COM(u 1 ) … COM(v 3 ) x = y+z iff val(X) = val(Y)+val(Z) iff exists r u 1 = u 2 +u 3 +r ………………(2) v 1 = v 2 +v 3 -r ……………….(3)

Proof and verification Verifier (VR) sees: COM(u 1 ), COM(v 1 ), …, COM(u 3 ),COM(v 3 ). AU reveals r VR randomly picks c from {1,2} If c=1, –AU reveals u 1, u 2, u 3 ; VR checks com. and (2). Similarly, for c=2. Probability of cheating ≤ ½.

Amplification Simultaneously verifying: x=y+z, y+w=t+x+q, etc., same representations and same coin c used. Probability of cheating ≤ ½. Using 20 random representations X i,Y i,Z i of x,y,z and independent choices c 1, …, c 20 from {1,2}. Probability of cheating ≤ 1/2 20 < 1/

Extensions Proving multiplications Proving inequalities Using addition, multiplication and inequalities captures any reasonable code In all proofs never are both coordinates of vector representations revealed

Submitting Values to AU Since proofs/verifications require multiple representations of values, to submit x –create, say, 40 random representations X 1 = (u 1,v 1 ), …, X 40 = (u 40,v 40 ) –submit COM(u 1 ), …, COM(v 40 ) –Securely de-commit (reveal)

Extending Sequence of Representations of a Value Given representations Y 1 = (u 1, v 1 ), …, Y 40 = (u 40, v 40 ) of a value y, Auctioneer can create representations Y 41, …, Y 40+N and ZK proves: (1)of original 40, more than 35 represent the same value y (2) of the next N representations N/2 remain untouched and (7/8)N/2 represent the value y

Bidders bidding Bidders B 1, …, B m. Trusted Parties (TP) P 1, …, P 16 No more than 5 TPs may become faulty Bidder B j bids x j. –He (16, 5) Secret Shares x j into s j 1, …, s j 16 –Bidder secretly transmits s j k to P k, 1 ≤ k ≤ 16

Parties submit bid-shares to Auctioneer Party P k prepares, for every bidder B j, 40 random vector representations S j k,1, …, S j k,40 of the share s j k of bid x j. Submits to AU (signed) commitments to the coordinates of these vector representations P k securely submits to AU de- commitments of above.

Auctioneer AU discovers 11 TPs, say P 1, …, P 11, whose submitted S j k,1, …, S j k,40 are value consistent, and for every 1 ≤ j ≤ m, all 11 shares of x j are on the graph of a 5-th degree polynomial Computes outcome of the auction.

Preparation of anonymazing ZKP AU extends, for each B j, the submitted S j 1,1, …, S j 1,40 reps of share s j 1 of x j S j 2,1, …, S j 2,40 : S j 11,1, …, S j 11,40 in each row i, 1 ≤i≤11, by N additional representations of the same value.

Outline of Auctioneer’s proof and of verification Given sufficiently many representations X j 1, …, X j M of each bid x j, AU can construct verifiable proof of correctness of auction computation. This proof reveals identity of winners, possibly information about ordering of bid values.

Permuting identities of bid representations X 1 1, …, X 1 M X 2 1, …, X 2 M : X m 1, …, X m M Y 1 1, …, Y 1 K Y 2 1, …, Y 2 K : Y m 1, …, Y m K permutation Perm 1 Perm 2 Perm H Test half randomly chosen (for being permutation) Prove correctness of auction outcome using the other half.

Future Work Study implications of anonymization, secrecy preservation, deniability,for combating collusions in auction mechanisms Further improve efficiency Implement, measure performance