ELECTRONIC SEALED-BID AUCTION WITH THE EFFICIENT COMMUNICATION COMPLEXITY USING TOURNAMENT OPENING-METHOD

Transcription

1 ELECTRONIC SEALED-BID AUCTION WITH THE EFFICIENT COMMUNICATION COMPLEXITY USING TOURNAMENT OPENING-METHOD Yong-Sor Hr Graduat school of Information Scinc and Elctrical Enginring, Kyushu Univ., 6-0-,Haozai, Higashi-u, Fuuoa, 8 858, Japan yshr@itslab.csc.yushu-u.ac.p Ja-Chol Ryou Division of Elctrical and Computr Enginring, Chungnam National Univrsity 0 Gung-dong, Yusung-u, Daon, , Kora, cryou@hom.cnu.ac.r Kouichi Saurai Faculty of Computr Scinc and Communication Enginring, Kyushu Univ., 6-0-,Haozai, Higashi-u, Fuuoa, 8 858, Japan saurai@csc.yushu-u.ac.p ABSTRACT Rcntly, an lctronic sald-bid auction using cryptography tchniqus has bn proposd. An lctronic sald-bid auction is a typ of lctronic auctions. Th aim of an auction including an lctronic sald-bid auction is to dcid th pric of goods fairly. So, th dcision mthod of th pric on goods in an lctronic auction is vry important schm. In this papr, w propos th lctronic sald-bid auction with fficint communication complxity using a tournamnt opning-mthod. A tournamnt gam mthod is usd to dcid th winnr in sports gam. W apply a tournamnt gam to th dcision of th winning pric. That is, an auctionr plays a rol as a rfr, and th bidding pric tas part in a tournamnt gam. In our schm, a tournamnt opning-mthod plays a rol as mix-nt anonymous channl. Our -auction schm can p anonymity and scurity of all biddrs including th winnr, and gt mor fficint communication complxity than othr schms [OM00][AS0-]. Kyword: Sald-bid auction, Mix-nt anonymous channl, Scurity, Privacy, Cryptography. INTRODUCTION ) Motivation An auction is a ind of trad for spcial goods which hav not a fixd pric. In ral world, a various typ auctions hav bn nforcd for dcision of pric. Rcntly, many -auctions using cryptography tchniqus hav bn proposd. Gnrally, E-auction is dividd by thr typs. On is an English auction schm (including Dutch auction), anothr is a first-pric sald-bid auction schm, and th othr is a scond-pric sald-bid auction schm. In th English auction schm, sing th bidding pric, a biddr rpatdly placs a bid in ral tim. Aftr th bidding tim is ovr, th bidding pric is dcidd as th highst pric. During bidding, all biddrs can s th bidding pric in th English auction. In cas of a first-pric sald-bid auction, it nds only th highst pric and a biddr should not now th bidding pric of othr biddr. Th mthod of a scond-pric sald-bid auction is th sam with that of a

2 first-pric sald-bid auction. But, th winnr in a scond-pric sald-bid auction gts a good in th scond highst pric. In this papr, w concntrat on th first-pric sald-bid auction schm. In cas of -auction, it nds only on rsult such as th highst pric or th lowst pric. It should p scurity on th winning pric as wll as loosing prics. It is vry important schm to dcid th pric of goods in -auction. Th schm of th pric dcision has an influnc on th communication and computation complxity. In this papr, w propos -auction with fficint communication complxity using a tournamnt opning-mthod. ) Rlatd wors Thr ar many schms for sald-bid auction. Kiuchi, Haravy and Tygar proposd th mthod that dals with ti-braing in sald-bid auctions [KHT98]. Omot and Miyai proposd sald-bid action with binary trs which is mphasizd fficincy and ntrtainmnt [OM00] [OM0]. Naor, Pinas and Sumnr introducd a sald-bid auction that uss two-srvr auction systm in ordr to nsur privacy and corrctnss [NPS 99]. Juls and Szydlo improvd th schm of [NPS99] in aspct of th amount of computation and communication [JS0]. Baudron and Strn proposd a sald-bid auction basd on circuit valuation using homomorphic ncryption [BS0]. Ab and Suzui proposd M+-st pric auction using homomorphic ncryption [AS0-]. L, Kim and Ma proposd public auction with on-tim rgistration and public vrifiability [LKM0]. Ab and Suzui [AS0] proposd th first rcipt-fr schm for -auction. Chn, L and Kim proposd lctronic auction schms with rcipt-frnss using homomorphic ncryption [CLK03]. 3) Our rsults Many -auction schms hav bn proposd for scur and convnint auction. Th goal of -auction is to dcid th pric goods. So, th schm of th pric dcision is vry important schm in -auction, bcaus th schm of th pric dcision can affct th communication and computation complxity. In cas of first-pric sald-bid auction, th winnr is th biddr who bids th highst pric. To b fficint -auction, it nds th fficint opning mthod. In this papr, w concntrat on th fficint opning mthod for -auction. Also, our schm can p th scurity of th winnr as wll as loosing biddrs. To satisfy th abov schm, w apply a tournamnt gam to th dcision of th winning pric. In conclusion, our -auction schm has O(m) in communication complxity, whil [OM00] has 5O(m), and [AS0-] has 3O(m)+ O(b) as Tabl. Also, th usd tournamnt in our -auction schm plays a rol as mix-nt anonymous channl. In our -auction schm, an auctionr plays a rol as a rfr, and th bidding pric tas part in a tournamnt gam. A biddr dos not now who is a rfr on his own bidding pric. So, a biddr can p anonymity and scurity. Tabl Comparison of communication complxity Volum Our schm O(m) [OM00] 5O(m) [AS0-] 3O(m)+ O(b) ( m: th numbr of bidding prics, b: th numbr of biddrs)

3 This papr is organizd as follows: In Sction, w introduc prliminaris for our -auction schm. W propos -auction schm using a tournamnt opning-mthod in Sction 3. W prov scurity on th proposd -auction in Sction 4. W compar th communication complxity of our protocol to othr schms in Sction 5. In Sction 6, w conclud th papr.. PRELIMINARY ) Homomorphic ncryption VS. Tournamnt mthod Homomorphic ncryption for opning stag In this sction, w xplain th pric dcision using homomorphic ncryption for -auction. Lt M and M dnot a plaintxt, and Z dnots a homomorphic ncryption function, th following quation holds. Z M ) Z( M ) = Z( M + ) ( M Bcaus homomorphic ncryption has th computational asinss, it usd to counting or opning of -voting and -auction [HS00][AS0-][CLK03]. But, homomorphic ncryption uss with ZKIP (Zro Knowldg Intractiv Protocol) to confirm th scurity of a y or a random numbr. Thrfor, th computation and communication complxity of -auction basd on homomorphic ncryption ar incrasd in opning stag. Tabl shows th computational complxity of [CLK03] schm basd on homomorphic ncryption. Tabl Computational complxity in homomorphic ncryption Volum On biddr Sllr A and AI n ncryptions and proofs mn vrifications and proofs at most mn multiplications, n dcryptions and vrifications ( n: th numbr of bidding prics, m: th numbr of biddrs, A : Auctionrs, AI : Auction issur) Tournamnt mthod Usually, a tournamnt mthod is usd to dcid th winnr in sports gam, and is a ind of binary tr structur. In cas of binary tr structur, bidding points ar, and thn is th siz of th rprsntation of bids. In [OM00], Omot and Miyai proposd -auction using binary trs. But, thir schm is not a tournamnt mthod. In thir schm, a biddr gnrats a bid vctor M i as follows. M i =[class, class,, class, ID i ] Th bid vctor M i consists of th valu xprssing 0 or in ach class. If th class valu of all biddrs is, all biddrs go to class. That is, class is a ti. Th numbr of bidding pric dos not dcras in class. But our schm using a tournamnt mthod is diffrnt from [OM00]. In ach class of binary trs, an auctionr compars with bidding prics. So, th numbr of bidding prics is dcrasd by half in class. Tabl 3 shows th computational complxity of our schm. Tabl 3 Computational complxity in our schm Volum n biddr n ncryptions Bidding (gams) (n-) vrifications(gams)

4 opning dcryption for winnr ) Rquirmnts of sald-bid auction In this sction, w xplain th following rquirmnts for sald-bid auction [KHT98][OM00][LKM0]. Privacy of bid : No bid is rvald to anyon xcpt th winnr and th winning bid. Proof of winnr : Evryon can vrify th winnr and th winning pric which ar dcidd corrctly. Non-rpudiation : Th winnr cannot rpudiat his/hr bidding at th winning pric. Accountability of biddr : Any auctionr can vrify that biddrs follow a protocol to cast thir bids. Bid Scurity : Nobody can forg (falsify) and tap a bid. Robustnss : Evn if a biddr snds an invalid bid, th auction procss is unaffctd. 3) Our mix-nt anonymous channl by a tournamnt mthod Figur Anonymous channl of mix-typ by a tournamnt mthod Th aim of -auction is to dcid goods as th highst pric (or th lowst pric). Aftr a biddr bids, vryon dos not now a flow of a tournamnt gam. Morovr, a biddr pric is mixd in th first tournamnt gam. During a tournamnt gam in ordr to dcid th pric, a biddr dos not now th progrssing of a tournamnt gam. Also, a biddr dos not now who is a rfr on his own bidding pric. Figur shows anonymous channl of mix-nt typ by a tournamnt mthod. Aftr our tournamnt gam is ovr, th winnr is dcidd only by a bidding pric, and th last auctionr dcrypts th ncryptd biddr s ID in ordr to publish th winnr. 3. PROTOCOL DESCRIPTION ) Ovrviw Thr ar mainly thr ntitis in our auction as follows. - Auctionr ( A i ): Thy dcid th winnr in ach lvl of a tournamnt opning-mthod, and play a rol as a rfr. - Biddr ( B ): Thy want to buy th spcial goods. - Bulltin Board ( BB ): Evryon can s th contnt of BB and can not ras/modify it. Figur shows th tournamnt mthod of our schm and is dividd two typs by th numbr of biddr. That is, on is that th numbr of biddr is an vn numbr, and th

5 othr is an odd numbr. In cas of an odd numbr, it can b happnd an unarnd win. In sports gams (.g. soccr, basball and so on) using a tournamnt mthod, th tam which has an unarnd win is lucy. But, it has not good luc in -auction. In cas of sports gams using a tournamnt mthod, th numbr of gam has an influnc on victory or dfat. But, th numbr of gam is not rlatd in -auction. ) Proposd sald-bid auction Notations Notations ar dfind as follows. - A i : An auctionr ( i is th numbr of auctionr, whr i = / tournamnt) - B : A biddr ( is th numbr of biddr) - { p i ( ),q i ( ),d i ( )},{ p i ( ),q i ( ),d i ( )} A i - { i ( ), N i ( )},{ i ( ), N i ( )} ( i,q i. is a lvl of : Two privat-y pairs of auctionr : Two public-y pairs of th auctionr A i p : larg random prims, i p i q i i d i = modφ i ) -,q, d -, N - i - - i - i N =, φ = p )( q ), i ( i i p : Privat-y of th last auctionr A to ncrypt a biddr s ID : Public-y of th last auctionr A to dcrypt a biddr s ID r : a random numbr of an auctionr A i l : Bidding pric of biddr B CB : Th ncryptd bidding pric by th public y of th auctionr A i Z : Th ncryptd biddr s ID by th public y of th last auctionr A - : Concatnation Each auctionr has two public-y pairs and two privat-y pairs bcaus ach auctionr dcids two bidding prics as following Tabl 4. Tabl 4 Two public-y pairs and privat-y pairs of ach auctionr. Auctionr -lvl Kys Auctionr -lvl Kys A Privat p (), q (), -y () d () Public -y () ( ), N () Privat p (), q (), -y () d () Public ( ), N () -y () A i Privat p i (), q i (), -y () d i () Public i (), N i () -y () Privat p i(), q i(), -y () d i() Public i (), N i () -y () A Privat p (), q (), -y () d () Public -y () ( ), N () Privat p (), q (), -y () d () Public -y () ( ), N ()

6 Figur Th tournamnt structur of our protocol for lctronic sald-bid auction Dcision of th highst pric t Lt { A i i =,,..., a and = t,,..., } b auctionrs and { B =,,...,b } b biddr. In ordr to ma public th winnr and th winning pric, anyon should now th rlation of th winnr and th winning pric. Th last auctionr A ( -lvl) plays th rol that publishs th winnr and th winning pric. Othrs auctionrs xcpt th last auctionr A don t now th rlation of th winnr and th winning pric during bidding. Th dtaild procdur is as follows. - Biddr B rcivs public y from th last auctionr A. - Biddr gnrats on s ID ID and ncrypts ID with th public y of th last auctionr. - Biddr dcids his/hr bidding pric l. - Auctionr A i { i =,...,a } ( -lvl) compars ach two bidding prics and dcids th winnr. But, Auctionr A i ( -lvl) can not now biddr s ID bcaus biddr s ID is

7 ncryptd by th last auctionr A ( -lvl). - Auctionr A i gnrats a random numbr r i and ncrypts th winnr data with a random numbr r i. - As incrasing th auctionr s lvl, it is itratd such as th abov procdur till -lvl of A. Mix-nt anonymous channl using a tournamnt mthod Th ncryption procdur of auctionrs is as follows. - -lvl : Auctionrs is from A to A i, th numbr of i is /, whr is th numbr of biddr. Each auctionr gnrats two privat-y pairs and public-y pairs for ncrypting biddr s pric. - -lvl : Auctionrs is from A to A i /. Each auctionr gnrats two privat-y pairs and public-y pairs for auctionr of -lvl. t - From 3-lvl to - -lvl : In ach lvl, auctionr is dcrasd to. Each auctionr in ach lvl gnrats two privat-y pairs and public-y pairs for auctionrs of th lowr lvl. - -lvl : Th last auctionr A dcids th winnr and th winning pric. Each bidding pric should b chcd by auctionr of ach lvl. Th highst pric is flown till th last auctionr of -lvl. During th highst pric flows, th highst pric is chcd -tim. That is, if on of auctionrs is trust, nobody nows th rlation of th biddr and th bidding pric during bidding. This is mix-nt anonymous channl. 3) Procdur Rgistration stp - Biddr B gnrats on s ID ID. - Biddr B rcivs th public y <, N > from th last auctionr A and ncrypts ID as follows. Z = ID mod N Bidding stp - Biddr B dcids his/hr bidding pric l Opning stp Th first gam (by -lvl auctionrs) - Biddr B rcivs th public-y i ( ), N i ( ) of th auctionr A i. - Biddr B ncrypts his/hr bidding pric l as follows. - Biddr B snds CB i = ( l Z ) i ( ) CB i to Bulltin Board BB. mod N - Auctionrs A i of -lvl gt CB i from BB and dcrypt CB i auctionrs of -lvl can not now th biddr s ID. A i i ( ). But, - Auctionrs i A of -lvl chc th bidding pric as Tabl 5. Th boxd variabl rprsnts winnrs of th l-lvl gam in Tabl 5.

8 Auctionrs of l-lvl Th ncryptd bidding pric Winnrs of -lvl Tabl 5 Th chcd bidding prics by auctionrs A i of -lvl. A A A i A i l l l 3 l 4 i 3 l 3 l i l l i l i l i l l i - For winnrs of -lvl, th chcd auctionr gnrats a random numbr i - Auctionr A i for winnrs in -lvl ncrypts with r i and th public-y i ( ), N i ( ) of th auctionr A i /. CB i = ( r i l Z ) i ( ) mod N i ( ) - Auctionr A i of -lvl snds CB i to Bulltin Board BB. - If two bidding prics ( l,l' ) ar sam, auctionr A i ncrypts as follows. CB i = ( r i l' Z' l Z ) i ( ) mod N i ( ) Th scond gam (by -lvl auctionrs) - Auctionrs A i of -lvl gt CB i from BB and dcrypt CB i. But, Auctionrs A i of -lvl also can not now th biddr s ID. - Auctionrs A i of -lvl chc th bidding pric and dcids winnrs as -lvl - For winnrs of -lvl, th chcd auctionr gnrats a random numbr r i. - Auctionr A i for winnrs in -lvl ncrypts with r i and th public-y 3 i ( ), N i ( ) 3 of th auctionr i A 3. 3 CB i = ( r i l Z ) 3 i ( ) 3 mod N i ( ) - Auctionr A i of -lvl snds CB 3 i to Bulltin Board BB. From 3-lvl to - -lvl (by 3-lvl - - -lvl auctionrs) 3 - Auctionrs ( A i A i ) from 3-lvl to - lvl comput as th first and th scond gams. Th last gam ( by lvl auctionr) - Th last auctionr A dcids th highst pric, and dcrypt Z - Th last auctionr announcs th winnr and th winning pric. 4. SECURITY ON THE PROPOSED E-AUCTION Our schm satisfis th following rquirmnts for lctronic sald-bid auction. Privacy of bid : Our schm provids mix-nt anonymous channl using a tournamnt. Mix-nt anonymous channl provids th privacy of bid. A biddr dos not now that his/hr own bidding pric is lost in any bidding point. Also, if on of participating auctionrs is trust, our schm provids privacy which nobody nows th rlation of th winnr and th winning pric. Proof of winnr : During bidding, auctionrs xcpt th last auctionr can not now a biddr s ID, bcaus biddr s ID is ncryptd by th public-y <,N >of th last auctionr. For proof of winnr, th participatd auctionrs can vrify thir random numbrs. Morovr, to prvnt th chatd bidding pric by th last r.

9 auctionr, auctionrs which ta part in gams of th winnr can vrify whthr th highst pric is changd or not. Non-rpudiation : Th bidding pric is ncryptd by all auctionrs. Th ncryptd bidding pric is snt to bulltin board. If a biddr dnis on s bidding pric, w can confirm th bidding pric from th ncryptd bidding pric of bulltin board. Mor-ovr, to prvnt th fabrication of th bidding pric by participatd auctionrs, w can vrify th bidding pric using th ncryptd bidding pric by th participatd auctionrs. Accountability of biddr : Each auctionr now two bidding prics that ta part in tournamnt gam. Aftr th bidding tim is ovr, a biddr can vrify his/hr own gam. Bid scurity : It ps bid scurity by th participating auctionrs using tournamnt opning-mthod. Robustnss : Evn if a biddr snds an invalid bid, our auction procss is unaffctd. 5. COMMUNICATION COMPLEXITY Tabl 6 shows communication complxitis of [OM00], [AS0-] and our schm. Th numbr of auctionrs A i, biddrs B and bidding prics is a, b, m rspctivly. Also, th numbr of cntr and bulltin board is ach. mans both-dirction communication, mans on-way dirction., and B A i mans th on-way untappabl channl from B to A i. Tabl 6 Th communication complxity Phas Pattrn Round Volum Bidding (a random numbr) Bidding (a bid) B C b O(m) B C b O(m) [OM00] [AS0-] Our Bidding (a bid vctor) Opning (y) Opning (pric) Bidding (commit) Bidding (Proof) Bidding (Scrt Shar) Opning Rgistration (ID) B C b O(m) B C b O(m) B C b O(m) B BB b O(m) B, Ai BB 3b O(m) B Ai b a O(m) A i BB a m O(b) B Ai b O(m) schm Bidding/Opning B BB b (b/) (b/4) O(m) 6. CONCLUSIONS

10 In -auction, it is vry important how to us th pric dcision for th winnr. Th problm of th pric dcision has an influnc on fficincy of communication and computation complxity in -auction. In this papr, w concntrat on th fficincy of -auction in aspct of communication and computation complxity. For fficincy of -auction, w us tournamnt opning mthod. Also, th tournamnt opning-mthod can play a rol as mix-nt anonymous channl. So, our schm can p anonymity and scurity on th winnr as wll as loosing biddrs. Morovr, th usd tournamnt opning-mthod contributs to b dcrasd th computation and communication complxity. ACKNOWLEDGEMENT Th first author was partly supportd by th Grant-in-Aid for Crativ Scintific Rsarch No.4GS08 (Had of Rsarchrs : Prof. Hiroto Yasuura, Systm LSI Rsarch cntr, Kyushu Univrsity) of th Ministry of Education, Scinc and Cultur (MEXT) and by th st Cntury COE Program Rconstruction of Social Infrastructur Rlatd to Information Scinc and Elctrical Enginring, and by th Cor Univrsity Program (Sponsors: Japan Socity for th Promotion of Scinc and Kora Scinc and Enginring Foundation). REFERENCES [KHT98] H.Kiuchi, M.Haravy and J.D.Tygar, Multi-round Anonymous Auction Protocols, Procding of Third USENIX Worshop on Elctronic Commrc, pp6-74, 998 [NPS99] M.Naor, B.Pinas and R.Summr, Privacy Prsrving Auctions and Mchanism Dsign, Procding of ACM confrnc of E-commrc, pp9-39, 999 [OM00] K.Omot and A.Miyai, An anonymous auction protocol with a singl non-trustd cntr binary trs, Information scurity worshop-proc. of ISW000, LNCS 975, Springr-Vrlag, pp08-0, 000 [LKM0] B.C.L, K.J.Kim and J.S.Ma, Efficint Public Auction with On-Tim Rgistration and Public Vrifiability, Indocrypt 00. [OM0] K.Omot and A.Miyai, An Anonymous Sald-bid Auction with a Fatur of Entrtainmnt, Transactions of Information Procssing Socity of Japan, Vol.4, No.8, Aug. 00 [BS0] O.Baudron and J.Strn, Non-intractiv Privat Auctions, Proc. of Financial Cryptography 00, 00 [AS0-] M.Ab and K.Suzui, M+-st Pric Auction using Homomorphic Encryption, Proc. of Public Ky Crytpography 00, LNCS 74, pp.5-4, 00 [AS0-] M.Ab and K.Suzui, Rcipt-Fr Sald-Bid Auction, ISC00, LNCS433, pp9-99,00 [Bra0] F.Brandt, Scur and Privat Auctions without Auctionrs, Tchnical Rport FKI-45-0, Fb. 00 [JS0] A.Juls and M.Szydlo, A Two-Srvr, Sald-Bid Aucion Protocol, Proc. of Financial Cryptography 00, 00 [CLK03] X.Chn, B.C.L and K.G.Kim, Rcipt-fr Elctronic Auction Schms Using Homomorphic Encryption Th Intrnational Confrnc on Information Scurity and Cryptology 003, pp 75-90, 003