4 ms·

Because there's no proof that can be made for the winning bid on its own. The property that needs to be proven (with ZK) is that "all losing bids were strictly

Because there's no proof that can be made for the winning bid on its own. The property that needs to be proven (with ZK) is that "all losing bids were strictly worse than the winning bid". That can't be shown (or even stated) without referring to the losing bids. The one-proof-per-losing-bid itself is probably just an implementation detail, but ultimately all the losing bids must be considered.

mycall 6y ago
Isn't a losing bid simply a winning bid of 0 items?
- eddieoz 6y ago
  I understand the system can create proofs for all participants, but that's the point: a losing bid does not receive the reward (or it is 0). Then I think it could be easier to spend resources to prove just the winner (who got something). It is an implementation detail and performance tuning. The whole thing is very interesting overall.
  - ivanbakel 6y ago
    I don't think you understood. You need a proof for all participants, because otherwise the statement you are trying to prove is meaningless. There is no statement involving just the winner that verifies the authenticity of the auction. You cannot say "the winner won", because "the winner" is a term that only makes sense in terms of all the auction losers. There must be proofs involving all the participants, because you at the very least need to show that all the losing bids were strictly worse than the winning bid. "prov[ing] just the winner" doesn't make any sense, or really mean anything.
    - eddieoz 6y ago
      Yes, I got the point. The approach is every bidder doing the zkproof to create a receipt of their bid because the auction will end at some point in the future. I understand it works very well, and it is the most used approach. I was wondering about the possibility of another approach and my point was creating just the winner zkproof on the auction side (not bidder side), at the end of the auction. If all the bidders used some stealth method plus homomorphic encryption, the bids could be hidden and maybe they could receive the 'winner zkproof bid receipt' and check it against their very own bid. Then the winner could be able to prove it being the owner of the keys who delivered the stealth bid which won the auction. I read the paper again and understood their approach. It is clear why they are doing the zkproof for every participant in that context.

mycall 6y ago

Isn't a losing bid simply a winning bid of 0 items?

eddieoz 6y ago
I understand the system can create proofs for all participants, but that's the point: a losing bid does not receive the reward (or it is 0). Then I think it could be easier to spend resources to prove just the winner (who got something). It is an implementation detail and performance tuning. The whole thing is very interesting overall.
- ivanbakel 6y ago
  I don't think you understood. You need a proof for all participants, because otherwise the statement you are trying to prove is meaningless. There is no statement involving just the winner that verifies the authenticity of the auction. You cannot say "the winner won", because "the winner" is a term that only makes sense in terms of all the auction losers. There must be proofs involving all the participants, because you at the very least need to show that all the losing bids were strictly worse than the winning bid. "prov[ing] just the winner" doesn't make any sense, or really mean anything.
  - eddieoz 6y ago
    Yes, I got the point. The approach is every bidder doing the zkproof to create a receipt of their bid because the auction will end at some point in the future. I understand it works very well, and it is the most used approach. I was wondering about the possibility of another approach and my point was creating just the winner zkproof on the auction side (not bidder side), at the end of the auction. If all the bidders used some stealth method plus homomorphic encryption, the bids could be hidden and maybe they could receive the 'winner zkproof bid receipt' and check it against their very own bid. Then the winner could be able to prove it being the owner of the keys who delivered the stealth bid which won the auction. I read the paper again and understood their approach. It is clear why they are doing the zkproof for every participant in that context.