Implementing Private Vickrey Auctions - Semantic Scholar
2005 ACM Symposium on Applied Computing
Implementing Private Vickrey Auctions Ismael Rodríguez and Natalia López Dept. Sistemas Informáticos y Programación Universidad Complutense de Madrid 28040 Madrid. Spain
{isrodrig,natalia}@sip.ucm.es
his reserve price, that is, the maximum price that the agent would pay for the auctioned item. Thus, the Vickrey auction is a mechanism of direct revelation since, in order to maximize their utility, agents have to say the truth. Note that if the auctioneer found out in advance the reserve price of the highest bid, he would prefer to sell the item with a xed price as take it or leave it. Besides, the Vickrey auction is usually assumed to be a private value auction, that is, reserve prices are locally and independently xed by each agent. This property disallows an agent to get more interested in an item because other agents have higher bids. Privacy issues may be a handicap in Vickrey auctions. If the auctioneer has access to all the bids, he could use this information in subsequent auctions of similar items (by using a take it or leave it strategy). Thus, it is is not desirable for the agents that the auctioneer knows their reserve prices. Moreover, if the bidders know all the bids they can also adapt their subsequent bids. This would imply that the auction is not with private value anymore, so that reserve prices are not used afterwards [4]. Thus, a desirable characteristic to be included in Vickrey auctions consists in keeping, as much as possible, the privacy of the bids. In other words, our goal is that at the end of the auction each bidder is the only one who knows his own bid. Obviously, there exists some minimal exceptions to complete privacy. Actually, we need to know the second highest bid as well as the highest bidder. However, we need to know neither the highest bid nor the second highest bidder. Some protocols have been proposed to keep the good properties of Vickrey auction while guaranteing privacy (see e.g. [3, 1, 2]). In [1] privacy is partially lost: although the auction authority cannot relate bids with bidders, he knows the value of all the bids that have been submitted. In the case of [3], the collusion of the auctioneer and the auction issuer allows them to infer all the bids of the bidders. In [2] bidders do not communicate their real bid to other agents (neither other bidders nor the auctioneer). So, that protocol does not depend on a trusted third part as the previous works. However, a deeper analysis of this protocol is still needed, because it was presented in a theoretical fashion and some topics concerning its practical applicability were not addressed. Besides, some key issues that are related to privacy were tackled too brie y. In particular, some problems concerning collusion of bidders were not properly considered. In this paper we present an implementation of that protocol and analyze some of its properties in a deeper way. In particular, we show that the collusion of bidders is useless unless n − 1 bidders collude, where n is the number of
ABSTRACT Vickrey auctions have the interesting property of eliminating any incentive for bidders to bid values that are dierent from their reserve prices (i.e., the true value they give to the item being auctioned). For several reasons, it is desirable that bidders keep private their reserve price. In [2] a protocol to implement a Vickrey auction was presented. Its main feature is that bids are kept private without the necessity of any trusted third party. In particular, after the auction is nished only the value of the second highest bid and the identity of the highest bidder are publicly revealed. However, in that paper several questions about the applicability of the protocol were left unanswered. In particular, all the presentation was theoretical and no implementation was provided. Besides, the analysis of collusion risk was too brief. In this paper we address these issues in a deeper way. In addition, we present and analyze an implementation of the protocol, and we consider its practical applicability.
Categories and Subject Descriptors K.4.4. [Computing Milieux]: COMPUTERS AND SOCIETYElectronic Commerce
Keywords Vickrey auctions, privacy
1. INTRODUCTION Auctions are very eective ways to allocate resources. There exists several auction mechanisms, being the Vickrey auction [5] one of the mechanisms that has attracted more interest from the computer science researchers. This is a sealed bid where the bidder who submits the highest bid gets the item, but he pays the amount submitted in the second highest bid. As it is well-known, the Vickrey auction has several good properties. First, it removes any incentive for bidders to bid strategically. This is so because the dominant strategy of each agent consists in submitting a bid for
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. SAC’05, March 13-17, 2005, Santa Fe, New Mexico, USA. c 2005 ACM 1-58113-964-0/05/0003 ...$5.00.
796
bidders in the auction. The rest of the paper is organized as follows. In Section 2 we sketch the main ideas of our method. Explanations are brief because any interested reader can nd the original presentation of this protocol in [2]. Afterwards, in sections 3 and 4 we discuss some properties that are required in order to keep the privacy of the protocol. Next, in Section 5 we present a simple simulation of our protocol and discuss brie y a concrete experiment. Finally, in Section 6 we present our conclusions and some lines for future work.
2.
rameters is f (x) = (B · xA ) + C . Clearly, two examples of inputs and outputs are not enough to infer the function. We will go back to this idea in the next section. In order to obtain the desired behavior in the global function, local functions must ful ll some properties (see [2] for more details): • All local functions are strictly increasing. • The rst local function to be applied to each bid will be that of the owner of that bid. So, no bid will be sent to another bidder.
METHODOLOGY
• After a bidder receives a (partially) transformed value and applies his own local function, he will choose freely (e.g., randomly) the next bidder in the transformation of that value.
In this section we sketch brie y the basic ideas underlying the protocol presented in [2]. Basically, this protocol consists in applying some function to all bids. Then, the values returned by the function are compared, and we select the second highest value. Next, we apply the inverse function to that value, and we obtain the second highest bid. We ask publicly who is the bidder who would pay this value for the item being auctioned. Let us remark that since the Vickrey auction rules promote that all bidders bid their reserve prices, only the highest bidder wants to buy the item at that price, as the second highest bidder does not care about purchasing the item at that price or not. However, the utility of the highest bidder improves if he buys the item at that price. Hence, only the bidder who submitted the highest bid will claim to be the winner. The item is assigned to that bidder, and the price is the value of the second highest bid.1 Let f be the function used in the previous scheme. This function must ful ll some properties. First, it must be strictly increasing, that is, ∀ x, y : x < y =⇒ f (x) < f (y). This is required to guarantee that the second highest transformed value corresponds actually to the second highest bid. Another property of f is that it must be injective, because we need to use f −1 to decode the second highest value. In addition, privacy will be achieved only if we have that both f and f −1 are unknown to all bidders. Otherwise, a bidder could nd out all bids by applying f −1 to the values returned by the function. To achieve that goal, each bidder will know only a piece of the function called local function, and f will be the composition of all of them. Bidders will create privately their local functions, and the encoding or decoding of a bid will only be possible with the collaboration of all bidders together. The composition of local functions will work as follows: After some bidder receives a (partially) transformed bid from other bidder, he applies his local function, and afterwards he sends the result to another bidder, and so on. Finally, we need that the global function depends on at least three parameters. After the auction is over, all bidders know a pair (input,output) of the global function. This pair consists of the second bid and the second transformed value. Moreover, the winner of the auction knows another example, because he knows his bid and its transformation, which is the highest transformed value. Hence, function f must be such that two examples of application are not enough to infer it.2 For example, a function depending on three pa-
• The order of application of local functions could be dierent for each bid. However, we want the global function to be the same in all cases. A su cient condition for that is that the composition of local functions is commutative, that is, for any local functions f, g we have f (g(x)) = g(f (x)). • The inverse transformation will be computed by applying the inverse of each local function. So, we need that each local function is invertible. Moreover, their composition must also be commutative.
As we said before, the global function should depend on at least three parameters. This could be achieved by making each local function to depend on at least three parameters. However, the composition of functions that depend on so many parameters is rarely commutative, so we prefer to increase the number of function parameters iteratively. We will illustrate this idea with an example. Let us consider again the function F (x) = (xA + B) · C , which depends on three parameters. Clearly, the composition of functions of this form is not commutative, so local functions cannot be like that. Instead, we can compose some commutative local functions to achieve function F in several stages. In the rst stage, all bidders will apply local functions of the form f (x) = xa , where a is privately chosen by each bidder. After all local functions are applied to all bids, we have that all bids are transformed according to a function f (x) = xA , where a is the multiplication of each a chosen privately by each bidder. Then, the second stage begins. Let us note that transformed values are not publicly communicated after the rst stage is over. Instead, the bidder who was the last one applying his function in the rst stage sends the value only to some bidder to begin the second stage (in particular, it could be itself). In the second stage, functions follow the form f (x) = x + b. After this stage is carried out like the previous one, we have that all bids have been transformed according to a function f (x) = xA + B , where B is the addition of all b. Then, the bidders who were the last in the second stage send the values to some bidder to begin the third stage. This time, local functions follow the pattern f (x) = c · x. After the third stage nishes, all values are broadcasted. The relation between these values and the original bids is given by a function F (x) = (xA + B) · C , where C is the multiplication of each c.
1 Alternatively, in order to guarantee that the winner (and not the second bidder) buys the item, the price could be raised in any tiny amount . 2 In [2] the possibility that a bidder knew two examples of the function was not explicitly considered. However, the global function depended in general on more than two unknowns, since each stage that used a dierent kind of function intro-
duced a new unknown in the global function.
797
Once the second highest transformed value is selected, the inverse function will be applied to it. To obtain the inverse function, the order of stages has to be opposite to that we had before. In the rst stage of the backwards path we use functions of the form f (x) = x · 1c , in the next one functions 1 f (x) = x − b, and nally functions f (x) = x a . At the end, the last bidder applying one of such functions will broadcast the result, which is actually the second highest bid. According to the previous scheme, bidders send each other some information in both the codi cation and the decoding phases. After a bidder applies his local function to some value and he decides the next bidder in the transformation, he has to send to him two data: The (partially) transformed value and the set of bidders who have already applied their local functions to this value in the current stage. The latter is needed by the next bidder to choose the bidder after him. It is also needed to know whether the transformation in this stage is nished and the next stage must begin.
3.
cation of the value a of each bidder. If either B1 or B2 is the winner of the auction, he can use this function to calculate the transformation of his own bid before the last decoding stage. Let w be such value. Let us note that the function governing the composition of decoding stages 1 and 2 follows the form f (x) = (x· C1 )−B , which depends on 2 parameters. So, the winner of the auction can easily infer this function by taking into account his two examples of application. This function provides the whole inverse global function, and this one gives the global function. So, the winner of the auction could have access to all bids. Moreover, the winner is not the only bidder who could infer the global function by being located in the intermediate of stages. In particular, if the same bidder is located both in the intermediate point of stages 1 and 2 and in the point between stages 2 and 3, then he can easily infer the function governing each stage, which gives him the global function. In order to avoid this problem, we must impose an additional condition to ensure that no bidder can infer the global function. First, we must avoid that some bidder is located in more than 2 intermediate points. During the decoding stage, any bidder that is located in an intermediate point will be included in a set. Then, if some bidder has to send a value to another and the next step is positioned in an intermediate point, the bidder will avoid to send the value to a bidder in the previous set. Second, the problem with the winner can be solved by using at least 4 stages. Besides, the kinds of function in each stage will be iterated as follows. The three kinds of functions commented before (exponentiation, addition, multiplication) are ordered in some arbitrary way {K0 , K1 , K2 }. Then, stage i uses the kind Ki mod 3 . Let us consider that 4 stages are used. Then if the winner is located in the rst intermediate point, then the function corresponding to the next three steps depends on three parameters. The case is similar if he is located in the third intermediate point. If he is located in the second, then he cannot transform his own bid according to the function used up to this point. Hence, he is unable to get at least 2 examples. So, this mechanism avoids this problem.
KEEPING THE PRIVACY
If the global function depends on at least 3 parameters then two examples of application of that function are not enough to infer the function. For example, let us consider that the global function follows the same form as before, that is, F (x) = (B · xA ) + C . Besides, let us suppose that the second highest bid is 2 and its transformation is 4, while the highest bid and its transformation are 4 and 8, respectively. After the auction nishes all bidders know that 4 is the transformation of 2, and that there is a bid whose transformation is 8. Besides, the winner (who is the bidder with more information) knows also that 8 is the transformation of 4. However, the winner is unable to nd out the global function, that is, he is unable to nd out A, B , and C . According to his knowledge, these parameters could be 1 ) are (A, B, C) = (1, 0, 2). However, (2, 8, 31 ) and (3, 48, 14 other valid possibilities. Actually, there are in nite possibilities. So, the relative distance between transformed values (e.g., 8 is double than 4, 8 is 4 plus 4) does not provide any information to infer totally or partially the respective bids. However, we must address some issues concerning the use of several stages in our scheme. In order to keep the privacy, some additional conditions must be introduced. Let us consider the backwards process where the second highest bid is decoded. During this process, both the last bidder who applies his local function in some stage k and the rst bidder who applies it in the next stage k + 1 have privileged information. We will illustrate this issue with an example. Let us consider that the global function is F (x) = (xA + B) · C , and let us suppose that it is composed using 3 stages as explained previously. Let us note that a bidder located in the intermediate of two stages knows the transformed value of the second highest bid at this point. For example, both the last bidder of the second decoding stage (that stage where functions are of the form f (x) = x − b) and the rst bidder 1 of the last one (where functions of the form f (x) = x a are used) know the transformed value of the second highest bid after the rst two stages. Let s be that value, and let B1 and B2 be the two previous bidders, respectively. After the last stage, the true second highest bid is broadcasted (say b). Then, by taking into account s and b, bidders B1 and B2 can easily infer the whole function of the last stage, which 1 follows the form f (x) = x A for some A that is the multipli-
4.
RISKS OF COLLUSION
In spite that no single bidder can break the privacy by his own, we have to consider the possibility that some bidders collude to share their information in order to infer some bids or the global function (which would give all bids). To the best of our knowledge, the collusion of n−1 bidders is needed to extract some information, where the number of bidders is n. In order to have this property, the protocol described in the previous section has to be slightly modi ed. Below we will present such a modi cation. Let us consider some collusion scenarios. Let us consider that functions of the form f (x) = xa are used in the rst stage. Then, let us suppose that during the transformation of some bid in the rst stage a bidder B1 sends a value to bidder X . Then, after X applies his function, he sends the result to B2 . Besides, let us suppose that the transformation of the bid of X began as follows: X applied his function to his bid, and then he sent the resulting value to some bidder B3 . In this case, B1 , B2 , and B3 can easily infer the bid of bidder X . First, bidders B1 and B2 nd out together the exponent bidder X uses in his local function. In order to do that, it is enough to compare the value sent from B1 to X and the value sent from X to B2 . Then, B1 and
798
bid 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
Bidder 1 30 425.234 6715.23 3.13306E+09 6.64109E+17 4.70011E+18 2.2208E+25 1.21115E+40 5.08121E+43 1.96679E+49 2.43639E+79
Bidder 2 18 171.33 6461.33 3.0146E+09 6.17765E+17 4.65376E+18 2.1989E+25 1.19232E+40 5.08119E+43 1.96679E+49 2.43638E+79
Bidder 3 65 1683.41 7973.41 3.72007E+09 9.16682E+17 4.95268E+18 2.34014E+25 1.31567E+40 5.08132E+43 1.96684E+49 2.43647E+79
Bidder 4 97 3432.27 9722.27 4.53602E+09 1.33002E+18 5.36602E+18 2.53544E+25 1.49347E+40 5.08149E+43 1.9669E+49 2.43661E+79
Bidder 5 47 945.367 7235.37 3.37573E+09 7.63919E+17 4.79992E+18 2.26796E+25 1.25207E+40 5.08125E+43 1.96681E+49 2.43643E+79
Bidder 6 39 678.261 6968.26 3.25111E+09 7.11848E+17 4.74785E+18 2.24336E+25 1.23066E+40 5.08123E+43 1.9668E+49 2.43641E+79
Bidder 7 46 909.87 7199.87 3.35917E+09 7.569E+17 4.7929E+18 2.26465E+25 1.24918E+40 5.08125E+43 1.96681E+49 2.43642E+79
Bidder 8 58 1374.45 7664.45 3.57592E+09 8.5115E+17 4.88715E+18 2.30918E+25 1.28824E+40 5.08129E+43 1.96682E+49 2.43645E+79
Bidder 9 63 1592.34 7882.34 3.67759E+09 8.9713E+17 4.93313E+18 2.3309E+25 1.30746E+40 5.08131E+43 1.96683E+49 2.43647E+79
Bidder 10 46 909.87 7199.87 3.35917E+09 7.569E+17 4.7929E+18 2.26465E+25 1.24918E+40 5.08125E+43 1.96681E+49 2.43642E+79
Figure 1: Example of auction.
an intermediate point or is in the same intermediate point than him). Since this problem applies only to the rst two stages, by using 5 or more stages we avoid it. In spite that the probabilities of having some bidders in all intermediate points is negligible (specially when the number of bidders is high), even this problem can be avoided by using n stages, where n is the number of bidders. In this case, only the collusion of n − 1 bidders can uncover the global function. Let us note that the complexity of our protocol is O(n) when a x number of stages is used, because the codi cation of all bids is performed in parallel. However, if n stages are used, the complexity is O(n2 ), which could be too high if the number of bidders is high. Hence, the risk of this kind of collusion should be assessed before taking the decision of using n stages.
B2 communicate the local function of X to B3 . With this information, bidder B3 can nd out the bid of X . In practice, this kind of collusion cannot occur. Let us suppose that, before the auction begins, bidders B1 , B2 , and B3 make a deal to perform that plan. Let us note that the plan will work only if X sends both the transformation of his bid and the transformation of some other value to any bidder in that group. Recall that after a bidder applies his function, he chooses freely (e.g., randomly) what bidder will receive his transformed value to continue with the transformation. So, bidders B1 , B2 , and B3 must be really lucky to be positioned in the necessary positions with respect to some speci c bidder X (or even to any other bidder Y ). Hence, the probability of this risk is negligible, specially when the number of bidders is high. The previous problem could be formulated the other way around. In this case, no deal is made between three speci c bidders before the auction begins. Instead, after some bidder (say B2 ) notices that he received some transformed value from X , then he tries to nd who are, in this speci c case, the bidders who play the roles of B1 and B3 in the previous presentation. After he nds them, he can propose them to make a deal to uncover the bid of X . However, this scenario is not possible. Recall that once a bidder has applied his local function to some value, he sends to another bidder two data: The (partially) transformed value and a set containing all the bidders who have already applied their functions to this value. So, bidder B2 receives from X the set of previous bidders, but not an ordered sequence of bidders who have participated in this transformation. So, B2 is not provided with the necessary information to nd out who is B1 . Actually, according to that information B2 can infer who is B1 only if the size of the received set is 2 (i.e., this thread represents the transformation of the bid of B1 ). However, even in this case B2 is unable to know who is B3 . The use of several stages in our scheme yields a dierent risk of collusion. In the previous section we introduced some conditions that are necessary to avoid that bidders located in intermediate points during the decoding of the second highest bid collect enough information to infer the global function. However, we did not consider a scenario where these bidders collude. Contrarily to the previous situation, in this case it is relative easy for a bidder to nd another bidders to collude. Let B2 be a bidder located in the intermediate point between decoding stages 2 and 3. Since he receives a set with the previous bidders in intermediate points, he knows who is the bidder between stages 1 and 2. Let B1 be that bidder. B1 and B2 can together infer the function of the rst two decoding stages. If 4 or less stages are used and one of these bidders is the winner, they can uncover the global function. However, let us note that they cannot nd out who are the bidders in the rest of intermediated points (recall that the next bidder after B2 is not in
5.
IMPLEMENTATION
The distributed algorithm performing our method and taking into account all the previous considerations is depicted in Figure 2. Besides, we have implemented a simple simulation of our protocol. It is a mono-processor C ++ simulation where relevant actions that would occur in the real system are properly represented. In particular, we simulated a simple environment where 10 bidders participate in the auction. Exponential, additive and multiplicative functions were used as explained in previous sections. Since exponential functions dramatically modify inputs, we were concerned about the precision of the overall process. This issue is critical because it concerns whether the transformed bids keep their relative order like the original bids. Besides, it also concerns whether the decoding of a coded bid matches the original value. Even though 5 stages are enough to guarantee most privacy properties, more stages are used to maximize numerical errors. In particular, we use 10 stages, where the kind of function alternates cyclicly. The C data type used to store values was long double, which provides 80-bit precision oating point numbers. In our experiment, bidders choose a random bid between 1 and 100. Then, they select multiplicative factors between 1 and 10 and exponential factors between 1.01 and 1.1. Regarding additive factors, they choose values whose magnitude is close to that of the values they manipulated in the previous stage. In spite that in our experiment the probability of each value is uniformly distributed, decisions of bidders in a true auction implemented by our protocol would not be restricted by this constraint. A simulation of the process is depicted in Figure 1. The winner is depicted in bold face, while the second highest bidder is shown in italics. Only the codi cation phase is depicted, because the decoding of the second highest value matched perfectly the original second highest bid (65). Moreover, for the sake of checking precision issues, all values were decoded. It turns out that not only
799
the relative order between bids is kept, but also the nal values match perfectly with the original bids. That is, values in any decoding stage i coincide to those in the codi cation stage n−i. The reason is that our protocol does not mix different kinds of operations in the same stage. That is, in spite that the order in which each exponential function is applied is dierent for each bid, no single addition or multiplication is performed until all the bids are transformed according to all exponential functions in this stage. A similar argument applies when the kind of function is either multiplicative or additive. This fact minimizes numerical precision problems. Let us note that if the number of bidders in an auction is high, then the factors used by bidders in their local functions should be constrained by some upper and lower bounds. Otherwise, the size of transformed values could be too high or too low, and it could over ow the maximal precision allowed by our data types.
Notation: • P : set of bidders, with n = |P |. • Given pi ∈ P , the bid of pi is bi . • ST : number of stages. • S : set of bidders already used in the current stage. • G: set of bidders already used in intermediate points (in the inverse transformation). Initialization: 1. ST is agreed by all bidders (ST ≥ 5) 2. The set of functions πi of each stage i is xed commonly by all bidders such that: • ∀ 1 ≤ i ≤ ST − 1 : πi ∈ Fi mod 3 , where F1 = {f | f (x) = xl }, F2 = {f | f (x) = x + l}, and F0 = {f | f (x) = l · x} 3. For each bidder pj ∈ P , privately do: (a) For each stage i, choose a function fji ∈ πi (b) c := fj1 (bj ) (c) p := ChooseRandomly(P \{pj }) (d) Transmit (c, {pj }, 1) to bidder p /∗ where 1 denotes the rst stage ∗/
6. CONCLUSIONS AND FUTURE WORK In this paper we have studied some properties of the protocol presented in [2]. In that paper, some relevant issues concerning risks against the privacy, with or without collusion, were not considered. Besides, since the presentation was theoretical, a discussion about practical issues was missing. In this paper we have addressed all these topics, and some results about a simple implementation have been reported. Let us note that this protocol requires that all bidders behave conforming to the protocol. However, the result of the auction could be ruined if some bidder cheats. For example, if a bidder applies a dierent function when a bid is coded and when it is decoded, the published value of the second highest bid could be wrong. We are currently developing a mechanism to detect liars in the protocol. It consists in applying a kind of checksum to nd out whether some bidder modi ed the results. It is a di cult task because faults in the results must be detected without revealing too much information, which could break the privacy.
Inductive Case (forward way): When tuple (c, S, i) is transmitted to bidder pj , do: 1. c := fji (c) 2. If |S| ≤ n − 2 then /∗ more bidders must apply their functions ∗/ (a) p := ChooseRandomly(P \(S ∪ {pj })) (b) Transmit (c, S ∪ {pj }, i) to bidder p else if i < ST then /∗ there are more stages ∗/ (a) p := ChooseRandomly(P ) (b) Transmit (c, ∅, i + 1) to bidder p else Broadcast c Comparison: Once n values are broadcasted, we publicly perform: 1. Obtain the second highest value (namely d) 2. p := ChooseRandomly(P ); G := ∅ 3. Transmit (d, ∅, ST, G) to bidder p Inductive Case (backward way): When tuple (c, S, i, G) is transmitted to bidder pj , do: −1 1. c := fji (c) 2. If |S| ≤ n − 2 then /∗ more bidders must apply their functions ∗/ (a) p := MaybeChooseRandomly((P \(S ∪ {pj })) ∩ G) (b) If p does not exist then
Acknowledgments This work has been supported in part by the MCYT project MASTER (reference TIC2003-07848-C02-01), and by the JCCLM project PAC-03-001.
7. REFERENCES
p := ChooseRandomly(P \(S ∪ {pj }))
[1] H. Lipmaa, N. Asokan, and V. Niemi. Secure Vickrey auctions without threshold trust. In Annual Conference on Financial Cryptography, LNCS 2357, pages 87101. Springer, 2002. [2] N. López, M. Núñez, I. Rodríguez, and F. Rubio. Improving privacy in Vickrey auctions. ACM SIGEcom Exchanges, 5(1):112, 2004. [3] M. Naor, B. Pinkas, and R. Sumner. Privacy preserving auctions and mechanism design. In ACM Conference on Electronic Commerce, pages 129139. ACM Press, 1999. [4] T. Sandholm and V. Lesser. On automated contracting in multi-enterprise manufacturing. In Distributed Enterprise: Advanced Systems and Tools, pages 3342, 1995. [5] W. Vickrey. Counterspeculation, auctions, and competitive sealed tenders. Journal of Finance, 16:837, 1961.
/∗
Depending on whether p nishes this stage: ∗/
(c) If |S| ≤ n − 3 then Transmit (c, S ∪ {pj }, i, G) to bidder p else Transmit (c, S ∪ {pj }, i, G ∪ {p}) to bidder p else if i > 1 then /∗ there are more stages ∗/ (a) p := ChooseRandomly(P \G) (b) Transmit (c, ∅, i − 1, G ∪ {p}) to bidder p /∗p is rst bidder of next stage∗/ else Broadcast c Resolution: Once a value c is broadcasted, do: 1. Ask for the bidder whose bid was greater than c. Let k be such bidder 2. Assign item to bidder k at price c Figure 2: Actual algorithm.
800
Implementing Private Vickrey Auctions Ismael Rodríguez and Natalia López Dept. Sistemas Informáticos y Programación Universidad Complutense de Madrid 28040 Madrid. Spain
{isrodrig,natalia}@sip.ucm.es
his reserve price, that is, the maximum price that the agent would pay for the auctioned item. Thus, the Vickrey auction is a mechanism of direct revelation since, in order to maximize their utility, agents have to say the truth. Note that if the auctioneer found out in advance the reserve price of the highest bid, he would prefer to sell the item with a xed price as take it or leave it. Besides, the Vickrey auction is usually assumed to be a private value auction, that is, reserve prices are locally and independently xed by each agent. This property disallows an agent to get more interested in an item because other agents have higher bids. Privacy issues may be a handicap in Vickrey auctions. If the auctioneer has access to all the bids, he could use this information in subsequent auctions of similar items (by using a take it or leave it strategy). Thus, it is is not desirable for the agents that the auctioneer knows their reserve prices. Moreover, if the bidders know all the bids they can also adapt their subsequent bids. This would imply that the auction is not with private value anymore, so that reserve prices are not used afterwards [4]. Thus, a desirable characteristic to be included in Vickrey auctions consists in keeping, as much as possible, the privacy of the bids. In other words, our goal is that at the end of the auction each bidder is the only one who knows his own bid. Obviously, there exists some minimal exceptions to complete privacy. Actually, we need to know the second highest bid as well as the highest bidder. However, we need to know neither the highest bid nor the second highest bidder. Some protocols have been proposed to keep the good properties of Vickrey auction while guaranteing privacy (see e.g. [3, 1, 2]). In [1] privacy is partially lost: although the auction authority cannot relate bids with bidders, he knows the value of all the bids that have been submitted. In the case of [3], the collusion of the auctioneer and the auction issuer allows them to infer all the bids of the bidders. In [2] bidders do not communicate their real bid to other agents (neither other bidders nor the auctioneer). So, that protocol does not depend on a trusted third part as the previous works. However, a deeper analysis of this protocol is still needed, because it was presented in a theoretical fashion and some topics concerning its practical applicability were not addressed. Besides, some key issues that are related to privacy were tackled too brie y. In particular, some problems concerning collusion of bidders were not properly considered. In this paper we present an implementation of that protocol and analyze some of its properties in a deeper way. In particular, we show that the collusion of bidders is useless unless n − 1 bidders collude, where n is the number of
ABSTRACT Vickrey auctions have the interesting property of eliminating any incentive for bidders to bid values that are dierent from their reserve prices (i.e., the true value they give to the item being auctioned). For several reasons, it is desirable that bidders keep private their reserve price. In [2] a protocol to implement a Vickrey auction was presented. Its main feature is that bids are kept private without the necessity of any trusted third party. In particular, after the auction is nished only the value of the second highest bid and the identity of the highest bidder are publicly revealed. However, in that paper several questions about the applicability of the protocol were left unanswered. In particular, all the presentation was theoretical and no implementation was provided. Besides, the analysis of collusion risk was too brief. In this paper we address these issues in a deeper way. In addition, we present and analyze an implementation of the protocol, and we consider its practical applicability.
Categories and Subject Descriptors K.4.4. [Computing Milieux]: COMPUTERS AND SOCIETYElectronic Commerce
Keywords Vickrey auctions, privacy
1. INTRODUCTION Auctions are very eective ways to allocate resources. There exists several auction mechanisms, being the Vickrey auction [5] one of the mechanisms that has attracted more interest from the computer science researchers. This is a sealed bid where the bidder who submits the highest bid gets the item, but he pays the amount submitted in the second highest bid. As it is well-known, the Vickrey auction has several good properties. First, it removes any incentive for bidders to bid strategically. This is so because the dominant strategy of each agent consists in submitting a bid for
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. SAC’05, March 13-17, 2005, Santa Fe, New Mexico, USA. c 2005 ACM 1-58113-964-0/05/0003 ...$5.00.
796
bidders in the auction. The rest of the paper is organized as follows. In Section 2 we sketch the main ideas of our method. Explanations are brief because any interested reader can nd the original presentation of this protocol in [2]. Afterwards, in sections 3 and 4 we discuss some properties that are required in order to keep the privacy of the protocol. Next, in Section 5 we present a simple simulation of our protocol and discuss brie y a concrete experiment. Finally, in Section 6 we present our conclusions and some lines for future work.
2.
rameters is f (x) = (B · xA ) + C . Clearly, two examples of inputs and outputs are not enough to infer the function. We will go back to this idea in the next section. In order to obtain the desired behavior in the global function, local functions must ful ll some properties (see [2] for more details): • All local functions are strictly increasing. • The rst local function to be applied to each bid will be that of the owner of that bid. So, no bid will be sent to another bidder.
METHODOLOGY
• After a bidder receives a (partially) transformed value and applies his own local function, he will choose freely (e.g., randomly) the next bidder in the transformation of that value.
In this section we sketch brie y the basic ideas underlying the protocol presented in [2]. Basically, this protocol consists in applying some function to all bids. Then, the values returned by the function are compared, and we select the second highest value. Next, we apply the inverse function to that value, and we obtain the second highest bid. We ask publicly who is the bidder who would pay this value for the item being auctioned. Let us remark that since the Vickrey auction rules promote that all bidders bid their reserve prices, only the highest bidder wants to buy the item at that price, as the second highest bidder does not care about purchasing the item at that price or not. However, the utility of the highest bidder improves if he buys the item at that price. Hence, only the bidder who submitted the highest bid will claim to be the winner. The item is assigned to that bidder, and the price is the value of the second highest bid.1 Let f be the function used in the previous scheme. This function must ful ll some properties. First, it must be strictly increasing, that is, ∀ x, y : x < y =⇒ f (x) < f (y). This is required to guarantee that the second highest transformed value corresponds actually to the second highest bid. Another property of f is that it must be injective, because we need to use f −1 to decode the second highest value. In addition, privacy will be achieved only if we have that both f and f −1 are unknown to all bidders. Otherwise, a bidder could nd out all bids by applying f −1 to the values returned by the function. To achieve that goal, each bidder will know only a piece of the function called local function, and f will be the composition of all of them. Bidders will create privately their local functions, and the encoding or decoding of a bid will only be possible with the collaboration of all bidders together. The composition of local functions will work as follows: After some bidder receives a (partially) transformed bid from other bidder, he applies his local function, and afterwards he sends the result to another bidder, and so on. Finally, we need that the global function depends on at least three parameters. After the auction is over, all bidders know a pair (input,output) of the global function. This pair consists of the second bid and the second transformed value. Moreover, the winner of the auction knows another example, because he knows his bid and its transformation, which is the highest transformed value. Hence, function f must be such that two examples of application are not enough to infer it.2 For example, a function depending on three pa-
• The order of application of local functions could be dierent for each bid. However, we want the global function to be the same in all cases. A su cient condition for that is that the composition of local functions is commutative, that is, for any local functions f, g we have f (g(x)) = g(f (x)). • The inverse transformation will be computed by applying the inverse of each local function. So, we need that each local function is invertible. Moreover, their composition must also be commutative.
As we said before, the global function should depend on at least three parameters. This could be achieved by making each local function to depend on at least three parameters. However, the composition of functions that depend on so many parameters is rarely commutative, so we prefer to increase the number of function parameters iteratively. We will illustrate this idea with an example. Let us consider again the function F (x) = (xA + B) · C , which depends on three parameters. Clearly, the composition of functions of this form is not commutative, so local functions cannot be like that. Instead, we can compose some commutative local functions to achieve function F in several stages. In the rst stage, all bidders will apply local functions of the form f (x) = xa , where a is privately chosen by each bidder. After all local functions are applied to all bids, we have that all bids are transformed according to a function f (x) = xA , where a is the multiplication of each a chosen privately by each bidder. Then, the second stage begins. Let us note that transformed values are not publicly communicated after the rst stage is over. Instead, the bidder who was the last one applying his function in the rst stage sends the value only to some bidder to begin the second stage (in particular, it could be itself). In the second stage, functions follow the form f (x) = x + b. After this stage is carried out like the previous one, we have that all bids have been transformed according to a function f (x) = xA + B , where B is the addition of all b. Then, the bidders who were the last in the second stage send the values to some bidder to begin the third stage. This time, local functions follow the pattern f (x) = c · x. After the third stage nishes, all values are broadcasted. The relation between these values and the original bids is given by a function F (x) = (xA + B) · C , where C is the multiplication of each c.
1 Alternatively, in order to guarantee that the winner (and not the second bidder) buys the item, the price could be raised in any tiny amount . 2 In [2] the possibility that a bidder knew two examples of the function was not explicitly considered. However, the global function depended in general on more than two unknowns, since each stage that used a dierent kind of function intro-
duced a new unknown in the global function.
797
Once the second highest transformed value is selected, the inverse function will be applied to it. To obtain the inverse function, the order of stages has to be opposite to that we had before. In the rst stage of the backwards path we use functions of the form f (x) = x · 1c , in the next one functions 1 f (x) = x − b, and nally functions f (x) = x a . At the end, the last bidder applying one of such functions will broadcast the result, which is actually the second highest bid. According to the previous scheme, bidders send each other some information in both the codi cation and the decoding phases. After a bidder applies his local function to some value and he decides the next bidder in the transformation, he has to send to him two data: The (partially) transformed value and the set of bidders who have already applied their local functions to this value in the current stage. The latter is needed by the next bidder to choose the bidder after him. It is also needed to know whether the transformation in this stage is nished and the next stage must begin.
3.
cation of the value a of each bidder. If either B1 or B2 is the winner of the auction, he can use this function to calculate the transformation of his own bid before the last decoding stage. Let w be such value. Let us note that the function governing the composition of decoding stages 1 and 2 follows the form f (x) = (x· C1 )−B , which depends on 2 parameters. So, the winner of the auction can easily infer this function by taking into account his two examples of application. This function provides the whole inverse global function, and this one gives the global function. So, the winner of the auction could have access to all bids. Moreover, the winner is not the only bidder who could infer the global function by being located in the intermediate of stages. In particular, if the same bidder is located both in the intermediate point of stages 1 and 2 and in the point between stages 2 and 3, then he can easily infer the function governing each stage, which gives him the global function. In order to avoid this problem, we must impose an additional condition to ensure that no bidder can infer the global function. First, we must avoid that some bidder is located in more than 2 intermediate points. During the decoding stage, any bidder that is located in an intermediate point will be included in a set. Then, if some bidder has to send a value to another and the next step is positioned in an intermediate point, the bidder will avoid to send the value to a bidder in the previous set. Second, the problem with the winner can be solved by using at least 4 stages. Besides, the kinds of function in each stage will be iterated as follows. The three kinds of functions commented before (exponentiation, addition, multiplication) are ordered in some arbitrary way {K0 , K1 , K2 }. Then, stage i uses the kind Ki mod 3 . Let us consider that 4 stages are used. Then if the winner is located in the rst intermediate point, then the function corresponding to the next three steps depends on three parameters. The case is similar if he is located in the third intermediate point. If he is located in the second, then he cannot transform his own bid according to the function used up to this point. Hence, he is unable to get at least 2 examples. So, this mechanism avoids this problem.
KEEPING THE PRIVACY
If the global function depends on at least 3 parameters then two examples of application of that function are not enough to infer the function. For example, let us consider that the global function follows the same form as before, that is, F (x) = (B · xA ) + C . Besides, let us suppose that the second highest bid is 2 and its transformation is 4, while the highest bid and its transformation are 4 and 8, respectively. After the auction nishes all bidders know that 4 is the transformation of 2, and that there is a bid whose transformation is 8. Besides, the winner (who is the bidder with more information) knows also that 8 is the transformation of 4. However, the winner is unable to nd out the global function, that is, he is unable to nd out A, B , and C . According to his knowledge, these parameters could be 1 ) are (A, B, C) = (1, 0, 2). However, (2, 8, 31 ) and (3, 48, 14 other valid possibilities. Actually, there are in nite possibilities. So, the relative distance between transformed values (e.g., 8 is double than 4, 8 is 4 plus 4) does not provide any information to infer totally or partially the respective bids. However, we must address some issues concerning the use of several stages in our scheme. In order to keep the privacy, some additional conditions must be introduced. Let us consider the backwards process where the second highest bid is decoded. During this process, both the last bidder who applies his local function in some stage k and the rst bidder who applies it in the next stage k + 1 have privileged information. We will illustrate this issue with an example. Let us consider that the global function is F (x) = (xA + B) · C , and let us suppose that it is composed using 3 stages as explained previously. Let us note that a bidder located in the intermediate of two stages knows the transformed value of the second highest bid at this point. For example, both the last bidder of the second decoding stage (that stage where functions are of the form f (x) = x − b) and the rst bidder 1 of the last one (where functions of the form f (x) = x a are used) know the transformed value of the second highest bid after the rst two stages. Let s be that value, and let B1 and B2 be the two previous bidders, respectively. After the last stage, the true second highest bid is broadcasted (say b). Then, by taking into account s and b, bidders B1 and B2 can easily infer the whole function of the last stage, which 1 follows the form f (x) = x A for some A that is the multipli-
4.
RISKS OF COLLUSION
In spite that no single bidder can break the privacy by his own, we have to consider the possibility that some bidders collude to share their information in order to infer some bids or the global function (which would give all bids). To the best of our knowledge, the collusion of n−1 bidders is needed to extract some information, where the number of bidders is n. In order to have this property, the protocol described in the previous section has to be slightly modi ed. Below we will present such a modi cation. Let us consider some collusion scenarios. Let us consider that functions of the form f (x) = xa are used in the rst stage. Then, let us suppose that during the transformation of some bid in the rst stage a bidder B1 sends a value to bidder X . Then, after X applies his function, he sends the result to B2 . Besides, let us suppose that the transformation of the bid of X began as follows: X applied his function to his bid, and then he sent the resulting value to some bidder B3 . In this case, B1 , B2 , and B3 can easily infer the bid of bidder X . First, bidders B1 and B2 nd out together the exponent bidder X uses in his local function. In order to do that, it is enough to compare the value sent from B1 to X and the value sent from X to B2 . Then, B1 and
798
bid 1st 2nd 3rd 4th 5th 6th 7th 8th 9th 10th
Bidder 1 30 425.234 6715.23 3.13306E+09 6.64109E+17 4.70011E+18 2.2208E+25 1.21115E+40 5.08121E+43 1.96679E+49 2.43639E+79
Bidder 2 18 171.33 6461.33 3.0146E+09 6.17765E+17 4.65376E+18 2.1989E+25 1.19232E+40 5.08119E+43 1.96679E+49 2.43638E+79
Bidder 3 65 1683.41 7973.41 3.72007E+09 9.16682E+17 4.95268E+18 2.34014E+25 1.31567E+40 5.08132E+43 1.96684E+49 2.43647E+79
Bidder 4 97 3432.27 9722.27 4.53602E+09 1.33002E+18 5.36602E+18 2.53544E+25 1.49347E+40 5.08149E+43 1.9669E+49 2.43661E+79
Bidder 5 47 945.367 7235.37 3.37573E+09 7.63919E+17 4.79992E+18 2.26796E+25 1.25207E+40 5.08125E+43 1.96681E+49 2.43643E+79
Bidder 6 39 678.261 6968.26 3.25111E+09 7.11848E+17 4.74785E+18 2.24336E+25 1.23066E+40 5.08123E+43 1.9668E+49 2.43641E+79
Bidder 7 46 909.87 7199.87 3.35917E+09 7.569E+17 4.7929E+18 2.26465E+25 1.24918E+40 5.08125E+43 1.96681E+49 2.43642E+79
Bidder 8 58 1374.45 7664.45 3.57592E+09 8.5115E+17 4.88715E+18 2.30918E+25 1.28824E+40 5.08129E+43 1.96682E+49 2.43645E+79
Bidder 9 63 1592.34 7882.34 3.67759E+09 8.9713E+17 4.93313E+18 2.3309E+25 1.30746E+40 5.08131E+43 1.96683E+49 2.43647E+79
Bidder 10 46 909.87 7199.87 3.35917E+09 7.569E+17 4.7929E+18 2.26465E+25 1.24918E+40 5.08125E+43 1.96681E+49 2.43642E+79
Figure 1: Example of auction.
an intermediate point or is in the same intermediate point than him). Since this problem applies only to the rst two stages, by using 5 or more stages we avoid it. In spite that the probabilities of having some bidders in all intermediate points is negligible (specially when the number of bidders is high), even this problem can be avoided by using n stages, where n is the number of bidders. In this case, only the collusion of n − 1 bidders can uncover the global function. Let us note that the complexity of our protocol is O(n) when a x number of stages is used, because the codi cation of all bids is performed in parallel. However, if n stages are used, the complexity is O(n2 ), which could be too high if the number of bidders is high. Hence, the risk of this kind of collusion should be assessed before taking the decision of using n stages.
B2 communicate the local function of X to B3 . With this information, bidder B3 can nd out the bid of X . In practice, this kind of collusion cannot occur. Let us suppose that, before the auction begins, bidders B1 , B2 , and B3 make a deal to perform that plan. Let us note that the plan will work only if X sends both the transformation of his bid and the transformation of some other value to any bidder in that group. Recall that after a bidder applies his function, he chooses freely (e.g., randomly) what bidder will receive his transformed value to continue with the transformation. So, bidders B1 , B2 , and B3 must be really lucky to be positioned in the necessary positions with respect to some speci c bidder X (or even to any other bidder Y ). Hence, the probability of this risk is negligible, specially when the number of bidders is high. The previous problem could be formulated the other way around. In this case, no deal is made between three speci c bidders before the auction begins. Instead, after some bidder (say B2 ) notices that he received some transformed value from X , then he tries to nd who are, in this speci c case, the bidders who play the roles of B1 and B3 in the previous presentation. After he nds them, he can propose them to make a deal to uncover the bid of X . However, this scenario is not possible. Recall that once a bidder has applied his local function to some value, he sends to another bidder two data: The (partially) transformed value and a set containing all the bidders who have already applied their functions to this value. So, bidder B2 receives from X the set of previous bidders, but not an ordered sequence of bidders who have participated in this transformation. So, B2 is not provided with the necessary information to nd out who is B1 . Actually, according to that information B2 can infer who is B1 only if the size of the received set is 2 (i.e., this thread represents the transformation of the bid of B1 ). However, even in this case B2 is unable to know who is B3 . The use of several stages in our scheme yields a dierent risk of collusion. In the previous section we introduced some conditions that are necessary to avoid that bidders located in intermediate points during the decoding of the second highest bid collect enough information to infer the global function. However, we did not consider a scenario where these bidders collude. Contrarily to the previous situation, in this case it is relative easy for a bidder to nd another bidders to collude. Let B2 be a bidder located in the intermediate point between decoding stages 2 and 3. Since he receives a set with the previous bidders in intermediate points, he knows who is the bidder between stages 1 and 2. Let B1 be that bidder. B1 and B2 can together infer the function of the rst two decoding stages. If 4 or less stages are used and one of these bidders is the winner, they can uncover the global function. However, let us note that they cannot nd out who are the bidders in the rest of intermediated points (recall that the next bidder after B2 is not in
5.
IMPLEMENTATION
The distributed algorithm performing our method and taking into account all the previous considerations is depicted in Figure 2. Besides, we have implemented a simple simulation of our protocol. It is a mono-processor C ++ simulation where relevant actions that would occur in the real system are properly represented. In particular, we simulated a simple environment where 10 bidders participate in the auction. Exponential, additive and multiplicative functions were used as explained in previous sections. Since exponential functions dramatically modify inputs, we were concerned about the precision of the overall process. This issue is critical because it concerns whether the transformed bids keep their relative order like the original bids. Besides, it also concerns whether the decoding of a coded bid matches the original value. Even though 5 stages are enough to guarantee most privacy properties, more stages are used to maximize numerical errors. In particular, we use 10 stages, where the kind of function alternates cyclicly. The C data type used to store values was long double, which provides 80-bit precision oating point numbers. In our experiment, bidders choose a random bid between 1 and 100. Then, they select multiplicative factors between 1 and 10 and exponential factors between 1.01 and 1.1. Regarding additive factors, they choose values whose magnitude is close to that of the values they manipulated in the previous stage. In spite that in our experiment the probability of each value is uniformly distributed, decisions of bidders in a true auction implemented by our protocol would not be restricted by this constraint. A simulation of the process is depicted in Figure 1. The winner is depicted in bold face, while the second highest bidder is shown in italics. Only the codi cation phase is depicted, because the decoding of the second highest value matched perfectly the original second highest bid (65). Moreover, for the sake of checking precision issues, all values were decoded. It turns out that not only
799
the relative order between bids is kept, but also the nal values match perfectly with the original bids. That is, values in any decoding stage i coincide to those in the codi cation stage n−i. The reason is that our protocol does not mix different kinds of operations in the same stage. That is, in spite that the order in which each exponential function is applied is dierent for each bid, no single addition or multiplication is performed until all the bids are transformed according to all exponential functions in this stage. A similar argument applies when the kind of function is either multiplicative or additive. This fact minimizes numerical precision problems. Let us note that if the number of bidders in an auction is high, then the factors used by bidders in their local functions should be constrained by some upper and lower bounds. Otherwise, the size of transformed values could be too high or too low, and it could over ow the maximal precision allowed by our data types.
Notation: • P : set of bidders, with n = |P |. • Given pi ∈ P , the bid of pi is bi . • ST : number of stages. • S : set of bidders already used in the current stage. • G: set of bidders already used in intermediate points (in the inverse transformation). Initialization: 1. ST is agreed by all bidders (ST ≥ 5) 2. The set of functions πi of each stage i is xed commonly by all bidders such that: • ∀ 1 ≤ i ≤ ST − 1 : πi ∈ Fi mod 3 , where F1 = {f | f (x) = xl }, F2 = {f | f (x) = x + l}, and F0 = {f | f (x) = l · x} 3. For each bidder pj ∈ P , privately do: (a) For each stage i, choose a function fji ∈ πi (b) c := fj1 (bj ) (c) p := ChooseRandomly(P \{pj }) (d) Transmit (c, {pj }, 1) to bidder p /∗ where 1 denotes the rst stage ∗/
6. CONCLUSIONS AND FUTURE WORK In this paper we have studied some properties of the protocol presented in [2]. In that paper, some relevant issues concerning risks against the privacy, with or without collusion, were not considered. Besides, since the presentation was theoretical, a discussion about practical issues was missing. In this paper we have addressed all these topics, and some results about a simple implementation have been reported. Let us note that this protocol requires that all bidders behave conforming to the protocol. However, the result of the auction could be ruined if some bidder cheats. For example, if a bidder applies a dierent function when a bid is coded and when it is decoded, the published value of the second highest bid could be wrong. We are currently developing a mechanism to detect liars in the protocol. It consists in applying a kind of checksum to nd out whether some bidder modi ed the results. It is a di cult task because faults in the results must be detected without revealing too much information, which could break the privacy.
Inductive Case (forward way): When tuple (c, S, i) is transmitted to bidder pj , do: 1. c := fji (c) 2. If |S| ≤ n − 2 then /∗ more bidders must apply their functions ∗/ (a) p := ChooseRandomly(P \(S ∪ {pj })) (b) Transmit (c, S ∪ {pj }, i) to bidder p else if i < ST then /∗ there are more stages ∗/ (a) p := ChooseRandomly(P ) (b) Transmit (c, ∅, i + 1) to bidder p else Broadcast c Comparison: Once n values are broadcasted, we publicly perform: 1. Obtain the second highest value (namely d) 2. p := ChooseRandomly(P ); G := ∅ 3. Transmit (d, ∅, ST, G) to bidder p Inductive Case (backward way): When tuple (c, S, i, G) is transmitted to bidder pj , do: −1 1. c := fji (c) 2. If |S| ≤ n − 2 then /∗ more bidders must apply their functions ∗/ (a) p := MaybeChooseRandomly((P \(S ∪ {pj })) ∩ G) (b) If p does not exist then
Acknowledgments This work has been supported in part by the MCYT project MASTER (reference TIC2003-07848-C02-01), and by the JCCLM project PAC-03-001.
7. REFERENCES
p := ChooseRandomly(P \(S ∪ {pj }))
[1] H. Lipmaa, N. Asokan, and V. Niemi. Secure Vickrey auctions without threshold trust. In Annual Conference on Financial Cryptography, LNCS 2357, pages 87101. Springer, 2002. [2] N. López, M. Núñez, I. Rodríguez, and F. Rubio. Improving privacy in Vickrey auctions. ACM SIGEcom Exchanges, 5(1):112, 2004. [3] M. Naor, B. Pinkas, and R. Sumner. Privacy preserving auctions and mechanism design. In ACM Conference on Electronic Commerce, pages 129139. ACM Press, 1999. [4] T. Sandholm and V. Lesser. On automated contracting in multi-enterprise manufacturing. In Distributed Enterprise: Advanced Systems and Tools, pages 3342, 1995. [5] W. Vickrey. Counterspeculation, auctions, and competitive sealed tenders. Journal of Finance, 16:837, 1961.
/∗
Depending on whether p nishes this stage: ∗/
(c) If |S| ≤ n − 3 then Transmit (c, S ∪ {pj }, i, G) to bidder p else Transmit (c, S ∪ {pj }, i, G ∪ {p}) to bidder p else if i > 1 then /∗ there are more stages ∗/ (a) p := ChooseRandomly(P \G) (b) Transmit (c, ∅, i − 1, G ∪ {p}) to bidder p /∗p is rst bidder of next stage∗/ else Broadcast c Resolution: Once a value c is broadcasted, do: 1. Ask for the bidder whose bid was greater than c. Let k be such bidder 2. Assign item to bidder k at price c Figure 2: Actual algorithm.
800
