An auction protocol which hides bids of losers

Many auction protocols using practical cryptographic means have successfully achieved capability of hiding the bids of each entity, but not the values of bids themselves. In this paper we describe an auction protocol which hides the bids of non-winners even from the bid-opening centers, and still makes it possible to publicly verify the validity of the winning bid, i.e. that it was the highest bid submitted. The first approach to such a protocol was made by Kikuchi et al in [KHT98]. However, several deficiencies have been pointed out regarding their protocol; for example, it is not well suited for handling tie bids. We present an auction protocol in which a bid will not be successfully decrypted unless it is the highest bid, thus ensuring bid privacy. In addition, it enables participants to verify that the winning bid is indeed the highest. Also in contrast to the previous work, our protocol can identify all the winners who submitted the winning bid. Our protocol allows for very compact representations for bids: a bid is represented by a single probabilistic encryption. In the protocol of [KHT98] a bid is represented by a vector of encryptions, of length linear in the number of possible bid values. We present two practical schemes based on the ElGamal cryptosystem and the RSA cryptosystems, respectively.