Auction Protocols

1
Auction Protocols

• CIS 6930
• Crypto Protocols
• Raymond Page
• pagerc_at_ufl.edu

2
Cocaine Protocol

• Druglords bidding on a cocaine shipment.
• English auction where only buyer and seller will
  know each others identities at auction end.
• Bidders and seller have minimal trust in others.

3
Cocaine Attacks

• Seller not selling to highest bidder
• Is alleviated by the true winner being able to
  broadcast his winning x.
• Seller bidding at his own auction
• Can create no-sale by overbid or offer bid to
  next highest and risk exposure of cheating.
• Deadbeat bidders
• Use reputation as a way to thwart deadbeat
  bidders.

4
Secure Sealed-Bid

• Seller(S) Has goods that he wishes to offload.
• Auctioneer(A) Brokers the deal between seller
  and bidders.
• Bidder(B) Individual that intends to
  participate in the auction.
• 2 Phase system
• Bids are submitted to a blackboard (broadcasted)
• Bids are decrypted with each bidders public key
  masked by a nonce.
• Winner is announced and next-highest bid.

5
Goals of Execution

• E1- The auctioneer is not capable of determining
  a false winner.
• E2- The auctioneer is not capable of manipulating
  the selling price upwards.
• E3- The auctioneer is not capable of manipulating
  the selling price downwards.
• E4- The highest bidder cannot deny having made
  the highest bid.
• E5- The second highest bidder cannot deny or
  alter his bid.
• E6- The auction process cannot be paralyzed by
  malicious bidders.

6
Goals of Privacy

• P1- The bids and the corresponding bidders
  identities are unknown prior to the opening of
  the bids.
• P2- The bids and the corresponding bidders
  identities remain unknown after the auction
  process is finished.

7
Secure S-Bid Attacks

• Auctioneer winning bid alteration
• This is made detectable by the 2 phase system,
  whereby bids are made public in the first phase.
• A/S collusion can lead to auction cancellation if
  seller is unhappy.
• This is mutable by declaring the winner.

8
Secure S-Bid Bid Table
9
Sealed-Bid Two-Servers

• Each bidder may send his bid to any one of the
  servers.
• Use oblivious transfer between the two server to
  verify the validity of the bids from the bidders.
• Oblivious transfer assures that output of the
  servers is fair, even if one of them is cheating.

10
Sealed-Bid Two-Servers

• Non-interactivity
• Bidders can place bid and learn outcome at a
  later time.
• Auction adaptability
• Can be applied to Vickery, highest-price
  auctions, etc.
• Full privacy
• Adversary can learn no more than the winning bid
  and the winners identity.
• Correctness
• Assuming the servers do not collude, any bidder
  can be assured of auction correctness.

11
Bibliography

• F. Stajano and R. Anderson, The Cocaine Auction
  Protocol On the Power of Anonymous Broadcast,
  http//www.cl.cam.ac.uk/rja14/cocaine.pdf
• A. Juels and M. Szydlo, A Two-Server, Sealed-Bid
  Auction Protocol, http//www.rsasecurity.com/rsal
  abs/node.asp?id2039
• F. Brandt, Cryptographic Protocols for Secure
  Second-Price Auctions, http//www7.in.tum.de/bra
  ndtf/papers/cia2001.pdf
• M. Yokoo and K. Suzuki, Secure Genrealized
  Vickrey Auction without Third-party Servers,
  http//lang.is.kyushu-u.ac.jp/yokoo/PDF/fc2004.pd
  f