Link to paper

The full paper is available here.

You can also find the paper on PapersWithCode here.

Abstract

Mechanism design allows for commitment to rules of a mechanism
Commitment is achieved through public declaration
Public declaration can reveal information the mechanism designer would prefer to keep private
A new approach to commitment is proposed that does not require a mediator
Framework is based on zero-knowledge proofs
Applications include non-mediated bargaining with hidden offers

Mechanism-design paradigm relies on designer’s ability to commit to a mechanism
Mechanism must be public to allow players to inspect and verify properties
Players can infer information from mechanism that designer may not want revealed
Trusted mediator can guarantee incentive properties and keep mechanism secret
Goethe’s lawyer leaked reserve price to publisher
Protocol with three messages to commit to mechanism and run it
Too-good-to-be-true protocol with cryptographic approach
Cryptographic commitment to mechanism and zero-knowledge proof of incentive properties
Player can verify outcome is consistent with mechanism
Mechanism never disclosed to anyone
Self-policing commitment to never-observed mechanism
Hiding and committing guarantees under certain conditions
Examples to demonstrate protocol and what can be deduced from outcome
Novel simple zero-knowledge proof techniques tailored to examples
Protocols feasibly computable and can be implemented in practice

Seller commits to a hidden price s
Seller sends commitment (C1, …, C log2H) to buyer
Buyer discloses value v
If s ≤ v, seller discloses s and trade takes place
If s > v, seller must prove to buyer that this is the case without disclosing any additional information about s
Seller must prove knowledge of discrete logarithm base h of at least one of Cj (j = i ∨ (j < i ∧ vj = 0))
Seller must do this without revealing which of the numbers she knows the discrete logarithm of
Seller must do this with negligible probability of getting discovered
Seller must do this with modest computational power and communication
Procedure for proving knowledge of discrete logarithm is given in Appendix A.1
Full details of construction and proof of properties in Appendix A
General framework avoids interaction and proof of correct evaluation consists of single message sent by seller

Seller offers two items to a unit-demand buyer
Buyer has private value for each item
Seller commits to two prices
If item is sold, mechanism is fully revealed
If no trade takes place, buyer learns nothing except that prices are higher than their values
If trade takes place, buyer learns price of unsold item is high enough
Seller commits to 2 log2H bits
Seller has to prove price of unsold item is greater than some known value
Interactive procedure used to prove this

Simplifying feature of Illustrative Examples 1 and 2 is that every mechanism is inherently IC and IR
Illustrative Example 3 is an auction setting with two prices, s1 and s2
Lemma 2.1 states that the mechanism is IC if and only if s1 is less than or equal to s2
Seller must prove that s1 is less than or equal to s2 and what s1 + s2 is without revealing any additional information
Seller commits to each bit of s1 and s2 and uses a new extension of the procedure to prove the statement
Seller must prove that the outcome is the result of the committed mechanism
Illustrative Example 4 is an auction setting with a hidden price s
Seller must prove that the payment is the result of a fair draw
Seller draws a random number x and sends a commitment to x and 1-x
Buyer draws a random number y and sends it to the seller
Seller calculates z = x + y mod 2 and has buyer pay H if z < s and 0 otherwise
Seller must prove to buyer whether or not z < s