Due to the use of verifiable secret sharing, no coalition of at most t
auctioneers can determine any information about the bidding from their
shares of the bids. Similarly, the degree reduction steps preserve
secrecy against coalitions of at most t auctioneers. But what about
the polynomials which are revealed in the course of
determining the selling price? A single
is uniformly random
and independent of all other variables except for its free
coefficient. If
, then
. If
, then
is an element uniformly distributed over
. Note that
exactly when there are at least two
bids whose value is at least the speculative selling price (the
previously determined digits of
together with
digit
l).