Lecture 10: Designs of Financial Infrastructure Utilizing Encryption
MIT OpenCourseWare
Encrypted Auctions Without Trusted Managers 0:00
Robert Townsend opens by outlining three examples he will cover: an encrypted auction, a hybrid credit and insurance scheme for balance sheet shocks, and a market implementation using encryption. He starts with auctions, noting that real-world auctions like Mortgage Capital Trading's trade auction manager rely on a trusted third party, and such trust is not always warranted. He describes a classic abuse where an auction manager, acting as seller, calls two buyers separately and falsely tells each that the other has bid higher, pushing up the price with no way for either buyer to verify the claim. A similar problem occurred with China's peer-to-peer lending platforms, where some prime assets were quietly kept out of pooled securities and given to favored investors while others were left uninformed, a practice that contributed to China eventually shutting the platforms down. The proposed fix is to run auctions without an auctioneer at all, using homomorphic encryption and multi-party computation so that bidders' messages go directly back and forth rather than through a trusted seller.
Two Schemes for Bidding 4:33
Townsend lays out two technical setups. In the first, each of two bidders runs their own server and exchanges encrypted bids directly, using public-private key pairs with no third-party server involved. In the second, a contract node, essentially code sitting on a third-party server, receives the encrypted bids but never sees the actual bid values, acting as what Townsend calls a pseudo-agent. Both schemes use the BFV encryption algorithm, a ring-learning-with-error method involving polynomials with integer coefficients, where public keys are shared values called a and delta, and private keys are individual values called s and e. A random noise term is added to protect the secret, since without it a system of equations could simply be solved by Gaussian elimination to reveal the hidden values.
Walking Through the Bid Exchange 12:00
Using two bidders, A and B, Townsend shows how each encrypts a bid and sends it to the other. The receiving side layers its own secret key onto the ciphertext it gets, and after this cross-matching the two transformed messages differ only by delta times the difference in the two bids. Since delta is public and each bidder knows their own bid, this scheme ends up fully revealing both bids to both parties once the comparison is made, which is a limitation specific to the two-agent case. With more agents, a subset of colluding bidders could similarly work out another agent's private bid, though the approach still generally holds.
Adding a Neutral Server 17:00
The second scheme introduces a third-party server holding the pseudo-agent code, to which bidders send their encrypted bids along with an encrypted sum of their private keys. This lets the server perform the same kind of arithmetic the agents did themselves in the first scheme, without the server ever accessing anyone's secret keys. Townsend notes a labeling error in his slide but says the mistake is instructive, since it highlights how the server effectively reconstructs the combined private key material without learning the individual pieces.
Generalizing to Many Agents 20:08
For more than two bidders, each agent generates a key pair, submits the public part to the server, and the server combines all public keys into one shared joint key that gets redistributed. Agents then encrypt their bids with this joint key and send the ciphertext to the server, which computes on the encrypted data and returns an encrypted result. Each agent partially decrypts this result using their own private key and sends that partial decryption back, and only once enough agents contribute their partial decryptions does the server obtain a fully decrypted answer. The number of agents required for this to work is a design parameter that limits how much collusion could break the scheme's secrecy.
Ranking Bids Efficiently 24:00
In response to a question about whether this reproduces standard second-price auction outcomes, Townsend confirms that any bidding rule, including Vickrey-style second-price rules, could in principle be implemented once bids can be rank-ordered. To manage the complexity of ranking many bids, he describes two approaches: one makes pairwise comparisons between all agents to deduce the highest bid, which grows costly as the number of agents rises, and the other divides agents into subgroups, computes each subgroup's average, discards bids below that average, and repeats, shrinking the pool of candidates each round. Asked whether this approach generalizes to more complex mechanisms with multi-dimensional types that cannot be simply ordered, Townsend admits he only has a partial answer and says what is possible depends on the specific context.
Balance Sheet Shocks Across Markets 28:00
Townsend introduces the second application, insurance against balance sheet shocks among dealers, with three real-world instances. In Kenya, M-Pesa agents hold both Kenyan shillings and Safaricom's e-credit, and researcher Tavneet Suri documented these agents informally helping each other by running physical gifts of cash or credit between one another to meet client demands. In Indonesia, commercial banks operating out of small kiosks face similar inventory shortages, struggling to find willing partners when they need to rebalance. In New York repo markets, broker-dealers exchange treasuries for cash reserves, and periodic liquidity shortages can push repo rates well above policy targets. The shared feature across all three is that each institution's balance sheet is randomly shocked, and revealing the state of that balance sheet to others is undesirable even though risk-sharing would be beneficial.
Concealment as the Key to Insurance 32:31
Townsend explains that ex ante insurance against idiosyncratic liquidity shocks is broadly beneficial, but revealing a shock immediately after it happens can undermine that benefit, because in a static setting the affected party would just wait until after the damage to seek insurance, and insurers would anticipate this and refuse to offer it. The resolution involves timing: concealing a loss from other agents for a period, even though the affected agent already knows it happened, allows insurance to still function. This leads toward a plan to encrypt the histories of these balance sheet shocks.
A Two-Agent, Two-Period Model 33:31
Townsend formalizes the problem with two agents, A and B, over two periods, where each has a utility function subject to privately observed shocks that can be thought of as a reduced-form version of a balance sheet shock, making an agent behave as if urgent or patient. Using the revelation principle, agents truthfully report their state to a planner, who observes the messages but is committed not to reveal them to others, with agent A reporting in the first period and agent B in the second. Because there is only one good and two periods, transfers that vary with reported urgency would always be gamed if reports were public, since everyone would claim to be in need, so concealing what happened in the first period is what makes second-period trade possible at all. The model assumes deterministic, commonly known endowments that can be placed in escrow, while each agent's preference shocks in both periods remain private, drawn from a commonly known distribution whose correlation structure Townsend says he will return to.
The Insurance Planner Setup 38:00
You have an insurance provider acting as a mediator, gathering reports from agents and deciding how to split a fixed endowment across periods based on what agents say. The design maximizes a weighted sum of the participants' objectives subject to resource constraints and truth-telling constraints, and the revelation principle applies as before. Each agent has a preference shock at date 0, and by date 1 the relevant state includes both what happened before and the new shock, because of correlation across time. The setup allows each agent to have shocks in every period, which is more general than the specific two-agent, two-period example that follows. A key concern is that simply distributing goods at date 0 reveals information through what each agent receives, since totals must add up, and this "inevitable" revelation can destroy the possibility of trade later. The design goal becomes concealing that information.
The Numerical Example Setup 40:35
Agent A and agent B have power-function utilities, where the exponent is sometimes known and sometimes an uncertain parameter. Agent A's date-0 parameter could be 0.2 or 0.9, while at date 1 it is known to be 0.3. Agent B's date-0 parameter is known to be 0.9, but B faces uncertainty at date 1 between 0.2 and 0.9. All combinations of these draws are possible with positive probability, while endowments are fixed and known, five units to each agent, ten in total, with a discount rate of 0.95 and equal weighting between agents.
Fully Revealed Communication Case 43:05
Under a scheme where messages about shocks are basically revealed to the other party, agent A faces a trade-off that makes truth-telling worthwhile, getting more in the second period when claiming patience than when claiming urgency. However, once agent B sees the outcome of agent A being urgent, the allocation for B becomes fixed regardless of B's own realized shock, meaning no real trade or insurance happens for B in that branch. A lottery is introduced so that if B lies and claims a high value when actually low, there is an eleven percent chance of getting nothing, which is enough to keep B honest, but the overall effect is that full revelation to the other party damages the possibility of insurance, especially for agent B.
Concealed Communication Improves Insurance 47:31
When the information is concealed instead, the same allocation that occurs when agent A is patient can also occur, with a small chance around three percent, when agent A is actually urgent. This means that seeing a given allocation no longer tells agent B for certain which underlying situation produced it. As a result, agent B can now receive more of the consumption good when reporting the high shock than the low one, creating real insurance. The deterrent against lying is a fourteen percent chance of getting nothing if B falsely claims the high value, which is enough to sustain honesty while still allowing beneficial randomization.
Replacing the Planner with Code 50:03
The next challenge is removing the central planner while preserving this kind of randomized, incentive-compatible allocation, using the same encryption scheme built earlier for the auction example. Agents enter a risk-pooling contract, place their endowments in escrow accessible to the contract code, and send encrypted messages about being urgent or patient. The code, called C, replaces the planner, and the system combines fully homomorphic encryption, where the code acts directly on encrypted messages, with multi-party computation, where agents exchange encrypted messages between themselves before anything is submitted to the code.
How the Encrypted Messaging Works 53:32
Agent A sends two encrypted values to agent B representing the urgent and low shock values, but in a random order that B cannot detect since both arrive as meaningless ciphertext. A also sends an encrypted vector indicating which order was chosen, itself unreadable to B. Agent B double-encrypts what was received and passes it to the code. Later, when the actual shock is realized, A encrypts and sends that value, B responds with an encrypted null reference, and further exchanges compute encrypted differences between the actual value and the two pre-play values. These encrypted objects eventually reach the code, having revealed nothing to either agent along the way, while giving the code enough information to determine, through algebraic properties like commutativity and distributivity, which of the two pre-play values matched the real one, effectively learning the ordering without learning the message itself.
Randomization Emerges From the Code 1:06:06
Through the properties of fully homomorphic encryption, terms in the computation cancel so that only the randomized amount or the correct liquidity amount survives, depending on which value was realized. This is how the code manages to produce both the deterministic allocation and the necessary randomization without ever seeing the underlying realized values directly, relying on a pseudorandom number generator it can access. The approach can be generalized beyond two possible shock values to three, low, medium, and high, by creating multiple pseudo-agents that handle pairwise comparisons among the possible values.
Order Book Matching Application 1:07:31
The final application concerns order book matching between two dealers, for instance in a repo market, where one side offers treasuries for money and the other offers money for treasuries, each submitting pointwise orders. The maximum quantity that could be matched on each side gets placed in escrow, and the code finds the common matching point, for example two units against two units, to execute the trade. These orders are encrypted, and the code performs a comparison operation on the encrypted messages to find matches without revealing the orders themselves, which protects against front-running.
Blockchain Encryption Still Developing 1:09:33
Running this kind of encryption directly on a full blockchain, rather than in layered or off-chain settings, remains a limitation, requiring careful use of multi-party computation to handle validation. Two companies, Zama and Sunscreen, claim to support encryption on the blockchain, and a paper evaluates their effectiveness in terms of multiplication, addition, and comparison operations, finding a mixed picture. Real progress has been made, and fully operational on-chain encryption schemes are expected in the near future, though not yet achieved, a gap that matters in practice, for example for Brazil's design of its wholesale central bank digital currency.
AI-generated summary. It can be wrong or incomplete - check anything that matters against the original.
