Private Selective Payment Protocols

Abstract

We consider the following generic type of payment protocol: a server is willing to make a payment to one among several clients, to be selectively chosen; for instance, the one whose private input is maximum. Instances of this protocol arise in several financial transactions, such as auctions, lotteries and prize-winning competitions.

We define such a task by introducing the notion of private selective payment protocol for a given function, deciding which client is selected. We then present an efficient private selective payment protocol for the especially interesting case in which the function selects the client with maximum private input. Our protocol can be performed in constant rounds, does not require any interaction among the clients, and does not use general circuit evaluation techniques. Moreover, our protocol satisfies strong privacy properties: it is information-theoretically private with respect to all-but-one clients trying to learn the other client’s private input or which client is selected; and assuming the hardness of deciding quadratic residuosity modulo Blum integers, a honest-but-curious server does not learn any information about which client is selected, or about the private inputs of selected or non-selected clients. The techniques underlying this protocol involve the introduction and constructions for a novel variant of oblivious transfer, of independent interest, which we call symmetrically-private conditional oblivious transfer.