Interleaving Cryptography and Mechanism Design: the Case of Online Auctions. Edith Elkind Helger Lipmaa

Transcription

1 Interleaving Cryptography and Mechanism Design: the Case of Online Auctions Edith Elkind Helger Lipmaa

2 Auctions: Typical Setting One seller, one object, n buyers. Buyers value the object differently private information. Main goal: maximize seller s s profit auction house gets percentage of sale. Auxiliary goals: Fast, easy to compute one s s best bid, efficient, preserves bidder s s privacy, etc.

3 Examples English auction (Christie s, s, Sotheby s). Vickrey (second price) auction: One-round, sealed bid; Highest bidder wins, pays second highest bid. First price auction One-round, sealed bid; Highest bidder wins, pays his bid. EBay (English auction with proxies). Etc., etc., etc.

4 Modeling Buyers: Valuations v i : value of the object to buyer i. s i : buyer i s s estimate of v i, or his signal known to buyer i only. Private values: v i = s i Example: buying a laptop on EBay. Common values: v 1 = v 2 = v n = f(s 1, Example: oil drilling. 1, s 2, 2,, s n )

5 Modeling Buyers (continued) General model: v i = f i (s (s 1, s 2, 2,, s n ) each bidder s value depends on all signals; dependency rule different for different bidders. Cognitive costs: v i = f i (s i ) = g i (s 1, s 2,, s n ); g i is much easier to compute than f i. Coin auctions (experts vs. amateurs) Is this coin genuine or fake? Do research (compute f i ); See what experts bid (compute g i ).

6 Privacy and Security Example 1: 2 nd price auction A bids $100 and wins; He is told that the 2 nd highest bid is $99; Does the seller cheat? Example 2: 2 nd price auction A really cute teddy bear is sold on EBay; You win and pay $20; Do you want everyone to know that you were willing to pay $150?

7 Running Time and Computation Example 1: 1 st price auction, private values if bidder i bids v i, his profit is 0 if he bids below v i, he risks losing the auction even if v 1,, v n are known, this is a hard problem Example 2: : English auction minimum increment $1,, final price $ rounds???

8 Tradeoffs Privacy vs. cognitive costs experts vs. amateurs in coin auctions if expert s s valuations are known, amateurs bid higher, so total profit is higher; experts avoid auctions that reveal their valuations, so total profit is lower. Cognitive costs vs. running time Sealed bid auctions: one round, no useful info; Multi-round auctions: many rounds, lots of info.

9 Tradeoffs (continued) Privacy vs. running time Any auction can be implemented securely Problem: general methods are slow. For some auctions, secure implementation is very fast (specialized techniques). Decide what to protect, then do it at all costs. vs. See what we can do, decide if useful.

10 New mechanism Idea: let users choose tradeoffs. Two parameters: ε, m (chosen by user). Multiple rounds of 2 nd price auctions: After each round, 2 nd to m th highest bids are revealed; Auction ends when the 2 nd highest bid stops changing; The highest bidder wins and pays 2 nd highest bid; In each round, every bidder proves (cryptographically) that his bid is within a fraction of 1/(1- ε) of his bid in the first round.

11 New Mechanism: Tradeoffs Cognitive costs vs. running time If ε is close to 0,, bidders have to do more homework, but the auction converges faster. Cognitive costs vs. privacy If m is small, privacy properties are better, but bidders get less information to compute their valuations. The auctioneer gets to choose ε, m depending on the application.

12 Cryptographic Subtleties It is easy to prove that new bid is within a certain factor of the old bid (without revealing either). It is easy to reveal 2 nd to m th bid of each round, while hiding the rest. Conclusion: auctions of this family can be implemented efficiently.

13 Conclusions First paper to explicitly consider the tradeoffs between privacy and cognitive costs; cognitive costs and running time. Our approach is to let the user decide what is best for him. Mechanisms we consider can be efficiently implemented.