JPH02118876A - Electronic bidding system - Google Patents

Abstract

PURPOSE:To hold the secret of the corresponding relation of a bidding price except a successful bid and a tenderer even when an identity confirming person who is the sponsor side of the bidder and a bidding opening person conspire by providing a random number preparing device, a stirrer, a random number component remover and the like. CONSTITUTION:A bidder supplies a random number R to a stirrer 120 by a random number preparing device 110 of a device 100 for a bidder and by using a bidding amount (m) and a publicized encipherment key N through an f-computer 121 and a multiplier 122 in the device 120, a stirred communication sentence m' is calculated. Next, the sentence m' is transmitted to a device 200 for an identity confirming person, a communication sentence s' with a signature corresponding to the sentence m' through a cirtifying device 210 is calculated, transmitted to the device 100, a signature value (s) corresponding to the amount (m) through a random component remover 130 is calculated and stored in a memory 140. Since the bidder supplies the amount (m) to a data compressor 150, a compression value (d) corresponding to the amount (m) is calculated, transmitted to the bidding opening person, the bidding opening person receives the compression value all bidders and after publicization, the bidder transmits the amount (m) to a device for opening a bidding, the unfair practice of a bidding promotor, the leakage of the bidding amount and the like can be prevented.

Description

Detailed Description of the Invention [Object of the Invention] (Industrial Application Field) The present invention relates to an electronic bidding system that realizes a protocol in which a plurality of bidders distributed over a communication network submit bids by electronic means. Regarding the method.

(Prior Art) In electronic bidding using a telecommunications system, that is, bidding protocols in which bidders distributed over a network bid competitively by electronic means, bid amounts are secretly disclosed to other bidders. It must be delivered to the bidder. As a countermeasure against this problem, encryption methods are used. In addition, in normal bidding, bidders and bid openers come together to bid and open bids, so it is considered difficult for bid openers to commit fraud. However, when telecommunications are used, the bidder and the bidder are physically separated, so there is a risk that the bidder may abuse his position and fraudulently manipulate the winning bid amount. As a countermeasure to this problem, a digital signature method is used to sign the bid amount.

Electronic bidding methods that have been proposed so far include, for example, Saburo Yamamura's ``A Bidding Method on the Network J'' (Proceedings of the 1988 Encrypted Color Information Security Workshop, WCl588-5.9p, 4l-50).
) has been disclosed.

Konoyama Villager's method solves the above-mentioned problems by combining encrypted communication, digital signatures, and broadcast communication.

(Problem to be Solved by the Invention) In normal bidding, the bid amount is known only to the bidder and is not known to others. Bid amounts other than the winning bid will affect future commercial activities, so it is preferable to keep the amount known to the minimum necessary. There is a problem with it.

The present invention has been made in view of the above, and its purpose is that even if there is collusion between the identification person who is the organizer of the bid and the bid opener, the bid amount other than the winning bid amount and the bidder's The object of the present invention is to provide an electronic bidding method that can keep correspondence relationships secret.

[Structure of the invention] (Means for solving the problem) In order to achieve the above object, the electronic bidding system of the present invention has the following features:
An electronic bidding method in which multiple bidders submit bids to a bid opener electronically using a communication network,
The bidder creates a compressed value α for the bid amount m using α=H(m) and sends it to the bid opener, and the bid opener receives the compressed value α from all bidders.
The bidder receives and publishes the compressed value α, and then transmits the bid amount m to the bid opener after publishing the compressed value α. When the bid opener receives the bid amount m from all bidders, the compressed value H(m ) and check that α=H(m) is satisfied, then publish all received bid amounts m and determine the successful bid amount,
As a result, the compressed value H(m) is
The gist is that by making the information public, bid openers are prevented from placing bids after viewing the bid amount.

Further, the electronic bidding method of the present invention is an electronic bidding method in which a plurality of bidders whose identities have been confirmed by an identification person make bids to a bid opener electronically via a communication network. creates a message m corresponding to the bid amount m obtained by disrupting the random number component from the random number generator and the bid amount m by a disruptor, and sends it to the identity verifier, and after the identity verifier verifies the bidder's identity, , the scrambled message m'' is manually input into a proving device to create a signed message D (m') and returned to the bidder, and the bidder extracts a random number component from the signed message D (m''). Bid amount m after removing the influence of
After obtaining the signature value D (m), the bid amount m
Create a compressed value α corresponding to α=H(m) and send it to the bid opener, the bid opener receives and publishes the compressed value α from all bidders, and the bidder publishes the compressed value α. Later, the bid amount m is sent to the bid opener, and when the bid opener receives the bid amount m from all bidders, it calculates the compression value H(m) for the bid amount m and satisfies α=H(m). The winning bid amount mo is determined by disclosing all the received bid amounts m after inspecting that the winning bid amount m is the same, and the bidder who bid the winning bid amount mo receives the signature value D(mo) that is the signed value of the winning bid amount mo. The bid opener verifies that the signature value D(mo) is the correct signature for the winning bid amount mo, so that the successful bidder's identity is approved by the identity verifier and the successful bidder is truly aware of the winning bid amount. The summary is that the bidder confirms that the bidder has placed a bid, and thereby prevents the bidder from knowing the correspondence between the bid amount and the bidder other than the successful bidder, even if the person confirming the identity colludes with the bidder. shall be.

Furthermore, the electronic bidding system of the present invention is an electronic bidding system in which a plurality of bidders whose identities have been verified by an identity verifier electronically bid to a bid opener via a communication network, The bidder sends the initial response text to the bidder, and the bidder creates query texts β and β′ for the received initial response text, the random number component from the random number generator, and the bid amount m, and sends them to the identity verifier. , the identity confirmer generates a response text corresponding to the initial response text and the received inquiry text using a proving device and sends it back to the bidder, and the bidder generates a response text corresponding to the initial response text and the received inquiry text, and sends it back to the bidder, and the bidder generates a response text corresponding to the initial response text and the received inquiry text, and sends it back to the bidder. Signature value 2 corresponding to bid amount m after removing the influence of random number component
After calculating the compression value α for the bid amount m, α=H(
m) and send it to the bidder, the bidder receives the compressed value α from all bidders and publishes it, and the bidder sends the bid amount m to the bidder after publishing the compressed value α, and When the bidder receives the bid amount m from all bidders, he calculates the compression value H(m) for the bid amount m, checks that α=H(m) is satisfied, and then calculates the compressed value H(m) for the bid amount m, and after checking that α=H(m) is satisfied, The bidder who made the successful bid amount mo sends the signature 2 and β corresponding to the successful bid amount mo to the bidder, and the bid opener confirms that the signature 2 β corresponds to the successful bid amount mo. Verify that the signature is correct to ensure that the successful bidder's identity is authorized by the identity verifier and that the successful bidder has bid the winning bid amount mo, thereby confirming that the identity verifier and the bid opener colluded. The gist of this system is that the bid opener is prevented from knowing the correspondence between the bid amount and the bidder other than the successful bidder.

(Operation) In the electronic bidding system of the present invention, a bidder creates a compressed value for the bid amount m and sends it to the bid opener, and after the bid opener receives and publishes the compressed values from all bidders, The bidder transmits the bid amount m to the bid opener, thereby preventing the bid opener from making a fraudulent bid after seeing the bid amount m.

The bid opener receives all the bid amounts m and determines the successful bid amount mo.

In addition, before transmitting the compressed value to the bidder, the bidder has an identity checker confirm his identity and obtains a signature value of the bid amount m, and the successful bidder transmits the signature value to the bidder, The Bid Opener verifies that the Successful Bidder's identity is approved by the Identifier. What the identity certifier signs is not the bid amount itself, but a value added with a random number component known only to the bidder, and the bidder removes the influence of this random number component to obtain a signature value for the bid amount.

(Example) Hereinafter, the present invention will be explained in detail using the drawings.

1, 2, and 3 show a bidder device 100 used in an electronic bidding system according to an embodiment of the present invention;
Block diagrams showing the configurations of an identification person device 200 and a bid opener device 300 are shown, respectively. These bidder devices 100, identification person devices 200, and bid opener devices 300 are each connected via communication lines as shown in FIG.

In the electronic bidding method shown in this embodiment, an identity checker confirms the bidder's identity, sends a signature proving this confirmation to the bidder, and the bidder obtains a data compression value H from the bid amount m. (m) to the bidder, and after the bidder discloses all compressed values H(m), the bidder transmits the bid amount m to the bidder, and the bidder discloses the value and the successful bid amount. mo is determined, the successful bidder presents the signature value for the successful bid amount mo to the bidder, and the bidder certifies the legitimacy of the successful bidder. Here, in order to keep the correspondence between the bidder and the bid amount secret even if the ID verification person and the bid opener collude, the identification ID is signed by the ID verification person while keeping the bid amount secret from the ID verification person. I try to do that.

The identity checker uses f (g (x) ) = g (f (
x) )=x, g (xXy)=g (x)Xg (y
), and a set of two functions (f.

g) to make the function [ public and make the function g secret.

Functions that satisfy this property include, for example, an encryption function and a decryption function of the R8A encryption. R8A cipher (Rlvest
, R,L,etal, -A Method
f'or Obtaining Digital S
ignatures and publlc-Key
Cryptosystems, Com5+u
nlcatlonsof' the ACM, Vo
l, 21. No, 2. pp, 120-
126. (1978)) is as follows.

The person confirming the identity has an encryption key (e, N) and a decryption key (d, N).
) is generated to satisfy N=PXQ eXdEl (modL) where L-LCM + (P-1), (Q-1)), the encryption key is made public, and the decryption key is secretly managed.

Here, LCM (a, b) represents the least common multiple of integers a and b, and P and Q are two different large prime numbers.

Further, a=b (mod L) represents that a−b is a multiple of L.

The R8A cipher is a cipher whose security is based on the fact that it is difficult to decompose N into prime factors when N is large. It is difficult.

If we define the encryption function f and the decryption function g as f (M) - M@ (mod N) g (C) = C' (+++od N), then g ( f (x) ) −f (g (x)
) = x can be shown to hold true. Here, a (
mod N) represents the remainder when a is divided by N. Furthermore, for integers x and y satisfying 0≦x, y<N, g
It can be shown that (xXy)-g (x)Xg (y) holds true.

In the following, function g is used as a signature function and function f is used as an authentication function. Efficient calculation methods for f and g calculators when using R3A encryption as f and g are described, for example, in Ikeno and Koyama, "Modern Cryptography Theory," Institute of Electronics and Communication Engineers, pp. 16-17, (1986). It is shown.

Next, a detailed explanation will be given with reference to the example communication order shown in FIG. 5 and FIGS. 1 to 4.

First, the bidder uses the random number generator 110 of the bidder device 100
is used to generate a random number R and supply it to the disruptor 120.

The disrupter 120 includes an f calculator 121 that calculates a function f.
is used to calculate f (R) for the random number R and supply it to the multiplier 122. Then, the bid amount m is input to this multiplier 122 . The multiplier 122 considers the bid amounts m and f (R) to be integers, and uses the published N to calculate the disturbed message m° according to the following equation.

m' = mX f (R) (mod N) and
This calculated message m° is transmitted to the identification person device 200 (step 110 in FIG. 5). In addition, at this time, it is preferable that a signature communication is performed between the bidder and the person confirming the identity.

When the identification person in the identification person device 200 receives the message m transmitted from the bidder device 100,
The bidder's identity is verified and the message m' from the bidder device 100 is then provided to the certifier 210. Prover 21
0 uses the g calculator 211 that calculates the function g to calculate the signed communication S° corresponding to the communication m° using the following equation.

s' = g (m') Then, this calculated signed message S° is transmitted to the bidder device 100 (step 120).

The bidder uses the bidder device 100 to send the signed message S from the identification person device 200 to the random number component remover 1.
Received at 30. Furthermore, since the random number component remover 130 is supplied with the random number R from the random number generator 110 and the publicized N, the random number component remover 130 receives the signed information from the identification person device 200. Correspondence S
A signature value S corresponding to the bid amount m is calculated from the random number R and the disclosed N using the following formula.

Ss'/R(shod N) Then, this calculated signature value S is stored in the memory 140.

Further, the bidder supplies the bid amount m to the data compressor 150, and calculates the compression value α corresponding to the bid amount m using the following equation.

α=H(m) This calculated compression value α is transmitted to the bidder (step 130).

The bid opener uses the bid opener device 300 to access the bidder device 1.
The compressed value α transmitted from 00 is sequentially received, and when the compressed value α from all bidders is received, the value is registered in the public file 310 and made public (step 140).

After all the compressed values α have been published, the bidder must make a bid of m
is transmitted to the bid opener device 300 (step 150).

When the bid opener receives the bid amount m from the bidder using the bid opener device 300, the bid opener supplies the bid amount to the data compressor 320, and the output result compressed by the data compressor 320 is stored in the public file 310. A comparator 325 compares and checks whether it matches any of the registered compression values α;
The bid amount is then published (step 160). Then, the winning bid amount mo is determined from all the registered bid amounts m.

The bidder whose winning bid amount mo has been determined (hereinafter referred to as the successful bidder) stores the signature value S corresponding to the winning bid amount mo in the memory 14.
0 and transmits it to the bid opener device 300 (step 170).

When the bid opener receives the signature value S from the bidder using the bid opener device 300, the bid opener supplies the signature value S to the tester 330, and calculates the f corresponding to the signature value S using the f calculator 331 of the test value 330. (s), this calculated f (s) is supplied to a comparator 332, and the comparator 332 compares it with the winning bid amount mo to check that they match, and the signature value S is the winning bid amount mo. certify that the signature value corresponds to

6, 7, and 8 show a bidder device 101 used in an electronic bidding system according to another embodiment of the present invention.
, block diagrams showing the configurations of the identification person device 201 and the bid opener device 301, respectively. Note that these devices 101, 201, and 301 correspond to the devices 100, 200, and 300 shown in FIGS. 1 to 3, respectively, and the common components with these devices are as follows. The illustration is omitted. Further, while the embodiment shown in FIGS. 1 to 3 described above uses the R8A encryption, the embodiment shown in FIGS. 6 to 8 uses the F
It uses the iat and Shamir authentication methods.

In this Fiat-3hamtr method, a reliable center generates secret information 5i (1≦j≦k) for a user who uses an ID as personal identification information in the following steps. Here, k is a parameter that determines safety, and has a value of 1 or more. Further, N is public information and can be expressed as N=PXQ using secret prime numbers P and Q. f is a one-way function and is public.

That is, first, using the one-way function f, v j=f
Calculate (ID, J) (1≦j≦k).

Then, using the prime factors P and Q of N for each vj, Calculate Sj=1/vj (modN).

That is, S j2 = 1/v j (modN).

Furthermore, sj is secretly issued to the user, and the one-way function f and composite number N are made public.

Calculation of the square root in (mod N) is the calculation of the square root in (mod N), which is a prime factor of N (
It can only be executed when P and Q) are known.

The method is described, for example, by Rabin, M.O.: “Dlgl
tallzedSignature and Pub
lic-Key Functionlons as 1nLr
“actable as F’actorIzaLIo”
, Tech, Rep, old T/LC3/TR-212
HIT Lab, Comput, Sc1.1979.

A specific example of the configuration of a square root calculation device is provided in the patent application filed in 1986-16.
9350 (Public Key Cryptography System).

Further, the user authentication method using the Fiat-8hamir method is as follows.

Prover A proves to verifier C that A is genuine using the following procedure.

First, A sends an ID to C.

Then, C calculates the following equation.

vj=f (ID, j) (1≦j≦k) Next,
The following procedure is repeated for i-1, . . . , t (t is a parameter that determines safety and has a value of 1 or more).

First, generate a random number r, xi-ri2 (modN) Calculate and send to C.

Then C is 0. Bit string of 1 (ell+...
...el,) is generated and sent to A.

Furthermore, A writes the signature yi as yi=ri U sj (modN)elj=
1 and send it to C.

Moreover, C is xi=y12U vj (mod N)elj
Check that =1 holds true.

From how to make yi y 12IIv i=r 12II
(seij=l elj-1, etc.), if all tests are passed, verifier C recognizes that A is genuine.

The user authentication method has been described above, but the message authentication method can be realized by changing the above procedure as follows.

The message (m) and (Xl,...,X,) are given a one-way function f(m, x,...
The first kxt bits of x, ) are converted into the bit string (e
, +), and as a signature sentence, (ID.

rT1+ (e II) + V l *...
..., y+) to the verifier as a signed message.

Next, a detailed explanation will be given with reference to an example of the communication order shown in FIG. 9 and FIGS. 6 to 8. In this embodiment, the Fiat-8hamir user authentication method is used between the identity confirmer and the bidder, and the Fiat-8hamir method is used between the bidder and the bid opener.
It uses the 3hamir message authentication method.

By keeping the information that correlates the two authentication methods secret from the bidder, even if the identity verifier and bid opener collude, the correspondence between the bidder and the bid amount can be kept secret.

i2
Furthermore, secret information S corresponding to the identification information ID of prover A is calculated and S is delivered to A. In the following explanation, the case where k=1 will be explained.

The bidder, with the help of the identity certifier, signs the bid amount m in the following steps.

First, the identity confirmer transmits the ID to the bidder device 101 and the bid opener device 301 (step 21 in FIG. 9).
0).

The identity verifier, bidder and bid opener then use the data compressors 220, 160 and 350 of the identity verifier device 201, bidder device 101 and bid opener device 301, respectively, to ).

Furthermore, the identity verifier uses the initial response sentence generator 230 to generate t initial response sentences x', (i=1.2°...
, B, and transmits this initial response sentence X° to the bidder device 101 (step 220).

Note that the initial response sentence generator 230 is composed of a random number generator 231 and a multiplier with remainder 232, and the random number generator 2
31, and using the multiplier with remainder 232, x' = XXr l (god N) (i
=1.2. ......, 1) Calculate X'l.

When the initial response text X° is received by the bidder device 101, the random number generator 170 is used to generate t pairs of bits e1 and random numbers u1, and the values are transmitted to the received t pieces of X''1. is input to the initial response sentence disrupter 175 along with the previously generated X, and the disturbed initial response sentences x°°1 are calculated and
“w (X t+1° . . . T X”t) is supplied to the query statement generator 180.

For example, if the initial response sentence disruptor 175 is configured with a multiplier with a remainder, t sets of el and ul generated by the random number generator 170,
The received t initial response sentences X and X are input to the multiplier with remainder 175, and
l (a+od N)(i-1,2,...
, B calculate t x"i.

Next, the bidder inputs the bid amount m and t pieces of x'' into the inquiry sentence generator 180 of the bidder device 101 to create inquiry sentences β and β', and β' is input to the inquiry sentence generator 180 of the bidder device 101. 20
1 (step 230), β is sent to the random number component remover 1.
Supply to 90.

For example, query statement generator 180 is
1 and an exclusive OR calculator 182, thereby (β1....., βl) ``'' f (m, X 1.'''''', X' + )β
1=β+ +e, (mod N)(i=1.
2. ......, B, find β=(β1.....,β1) and β'=(β゛1.....,β',).

Then, the identity verifier device 201 is connected to the bidder device 10.
When the inquiry sentence β' is received from the bidder 1, the proving device 240 calculates the response sentence 2 from the previously generated random number ri and the received inquiry sentence β', and sends it to the bidder device 101 (step 240 ).

For example, the prover 240 is configured with a secret information storage 241 and a multiplier with remainder 242, reads the secret information S from the secret information storage 241, and uses the random number r supplied from the initial response sentence generator 230 and the received response sentence. β'' is manually input to the multiplier with remainder 242, and z,=r,xs''' (mo
d N) (i=1.2......,1) Using zl calculated as
21).

When the bidder device 101 receives the response sentence 2, it inputs the response sentence 2 and the previously generated X and t pair (eu,) to the random number component remover 190, and calculates the response sentence z'. Then, the response sentence 2° and the inquiry amount β are stored in the memory 140 as a signature for the bid amount m.

For example, the random number component remover 190 is configured with a condition determiner 191 and a multiplier with remainder 192, and
1 x x -' (ffiod N)
'+).

Next, similar to steps 130 to 160 described above, the ninth
As shown in steps 250 to 280 in the figure, the bidder transmits the compressed value α corresponding to the bid amount m to the bidder device 301 (step 250), and the bidder publishes all compressed values α (step 260). ). Then, after all the compressed values α have been published, the bidder can enter the bid amount m on the bidder device 3.
01 (step 270). The bidder bids m
When it receives, it compares and checks whether it matches the published compression value α, and then publishes all bid amounts m (
step 280). Then, the successful bid amount mo is determined from all the bid amounts m.

The bidder for whom the successful bidder mo has been determined, that is, the successful bidder, reads the signature β, z° for the successful bid amount mo from the memory 140 and transmits it to the bid opener device 301 (step 2
90).

When the bid opener receives the messages β and z', he supplies the messages and the successful bid amount mo to the tester 360 to test their validity.

This tester 360 is composed of, for example, a multiplier with remainder 361, a data compressor 362, and a comparator 363, and calculates x゛°1 using X'', = Z', 2XXIβ' (mod N), and It is checked whether (m, X"1, . . . , X"t) holds true.

In the above embodiment, an authentication method based on the Fiat-3hamir method was explained.
The t-3hamir method is based on the fact that it is difficult to calculate the square root of (sod N) when it is difficult to factorize N into prime factors. A similar system can also be constructed based on an authentication method that takes advantage of the difficulty of discrete logarithm problems.

[Effects of the Invention] As explained above, according to the present invention, a bidder creates a compressed value from the bid amount m and sends it to the bid opener, and the bid opener receives compressed values from all bidders. Since the bid opener transmits the bid amount m to the bidder after the bid is made public, the bid opener cannot make a fraudulent bid after seeing the bid amount m. Further, since only the successful bidder sends the signature value to the bidder to approve the successful bidder's identity, the correspondence between the bid amount other than the winning bid amount and the bidder can be kept secret. In particular, what the identity verifier signs is not the bid amount itself, but a value with a random number component known only to the bidder, and the bidder removes the influence of the random number component to obtain the signature value for the bid value. Therefore, even if the identity confirmer who is the organizer of the bid colludes with the bid opener, the correspondence between the successful bidder, the bid amount m other than the winning bid amount, and the bidder can be kept secret, and fraud by the bid organizer can be prevented. It is possible to prevent acts, leakage of bid amounts, etc.

[Brief explanation of drawings]

FIG. 1, FIG. 2, and FIG. 3 are block diagrams showing the configurations of a bidder device, an identification person device, and a bid opener device, respectively, used in an electronic bidding system according to an embodiment of the present invention. , FIG. 4 is a diagram showing an identification person, a bidder, and a bid opener connected via a communication network in an electronic bidding system, and FIG. 5 is a diagram showing the communication order in the embodiment of FIGS. 1 to 3. The explanatory diagrams, FIG. 6, FIG. 7, and FIG. 8 show the configurations of a bidder device, an identification person device, and a bid opener device used in an electronic bidding system according to other embodiments of the present invention. The respective block diagrams and FIG. 9 are explanatory diagrams showing the communication order in the embodiments of FIGS. 6 to 8. 100.101...Bidder device 11.0...Random number generator 120...Disturber 170...Random number component remover 140...Memori 150...Data compressor 200.201...・Identification person device 210...Certification device 300゜301...Bid opener device 310...Public file 320...Data compressor 330...Testing device

Claims (3)

[Claims] (1) An electronic bidding system in which multiple bidders submit bids to a bidder electronically using a communication network, in which the bidder sets the compressed value α of the bid amount m by α=H(m). The bid opener receives the compressed value α from all bidders and publishes it. After the bidder publishes the compressed value α, the bidder sends the bid amount m to the bid opener, and all bid openers receive the compressed value α. When a bid amount m is received from a bidder, the compression value H(
m) and check that α=H(m) is satisfied, then publish all received bids m to determine the winning bid, and thereby apply the compression method before publishing the bid m. value H
An electronic bidding system characterized by disclosing (m) so that a bid opener cannot bid after seeing the bid amount m. (2) An electronic bidding method in which multiple bidders, whose identities have been confirmed by an identity certifier, make bids to a bid opener electronically via a communication network, in which the bidder receives a random number component from a random number generator. and creates a message m' corresponding to the bid amount m that has been disturbed by the disrupter, and sends it to the identity verifier, and after confirming the identity of the bidder, the identity verifier confirms the bidder's identity and then m' is input into the prover, a signed message D(m') is created and sent back to the bidder, and the bidder removes the influence of the random number component from the signed message D(m') and bids. After obtaining the signature value D(m) that is a signature on the bid amount m, create a compressed value α corresponding to the bid amount m using α=H(m) and send it to the bid opener. The bidder receives and publishes the compressed value α from the bidder, and after publishing the compressed value α, the bidder sends the bid amount m to the bidder. When the bidder receives the bid amount m from all bidders, the bidder receives the bid amount After calculating the compression value H(m) for m and checking that α=H(m) is satisfied, all received bid amounts m are disclosed to determine the winning bid amount mo, and the winning bid amount mo The bidder who made a bid sends the signature value D(mo) signed on the winning bid amount mo to the bid opener, and the bid opener checks that the signature value D(mo) is the correct signature for the winning bid amount mo. The successful bidder's identity is verified by the identity certifier, and the successful bidder is truly responsible for the winning bid amount mo.
The bidder confirms that the bidder has placed a bid, thereby preventing the bidder from knowing the correspondence between the bid amount of a person other than the successful bidder and the bidder even if there is collusion between the person confirming the identity and the bidder. Electronic bidding method. (3) An electronic bidding method in which multiple bidders whose identities have been confirmed by an identity certifier make bids to a bid opener electronically via a communication network, in which the identity certifier sends an initial response to the bidder. and the bidder creates inquiry sentences β and β′ for the received initial response text, the random number component from the random number generator, and the bid amount m, and sends them to the identity verification person, and the identity verification person and a response sentence corresponding to the received inquiry sentence are generated using a proving device and sent back to the bidder, and the bidder removes the influence of the random number component from the response sentence, the random number component, and the inquiry sentence. After finding the signature value z' corresponding to the bid amount m, create a compressed value α for the bid amount m using α=H(m) and send it to the bid opener, who then collects the compressed value α from all bidders. is received and published, and the bidder sends the bid amount m to the bid opener after publishing the compressed value α. When the bid opener receives the bid amount m from all bidders, the compressed value H( m) and α
After checking that =H(m) is satisfied, all received bid amounts m are disclosed to determine the winning bid amount mo, and the winning bid amount mo
The bidder who bids the signature z′, β corresponding to the winning bid amount mo.
is sent to the bid opener, and the bid opener receives the signatures z′ and β as the winning bid amount m.
verifying that the successful bidder's identity is authorized by the identity verifier and that the successful bidder bid the winning bid amount mo, thereby preventing collusion between the identity verifier and the bid opener. This electronic bidding method is characterized in that the bid opener cannot know the correspondence between the bid amount and the bidder other than the successful bidder even if the bidder bids the successful bidder.