\\ From: "How to obtain full privacy in auctions" (2006) by Felix Brandt pages 19-20


\\\\\\\\\\\\
\\ Adapt the following values to your needs
\\\\\\\\\\\\

\\ amount of bidders
n = 4
\\ amount of possible prices
k = 2^4
\\ randomize bids (change to something static, if you like)
bid = vector(n,i,random(k)+1)
\\bid = vector(n,i,n-i+1)     \\ first bidder wins
\\bid = vector(n,i,i)         \\ last bidder wins
\\bid = vector(n,i,(i+1)%2)   \\ second bidder wins (with ties)

\\ prime finite field setup (result may be ambiguous if your prime is too small, 4*n*k seems to work fine)
\\q = prime(4*n*k)
\\ 2048bit prime:
\\q = 31905233907400964621684499856844075173802000556075101303613351426740101897961025481077892281365444367883091980681462491724119317344478120131982416132058173572772607966572720945691237876256074322291459510766147107539260048324345382562673904236506104922357079761457605045674628331006193183908801308817507027556440703972646885207099302085383887085776295396030033300833460743425162726394704256227108175491673135830378272029374848904772902525385997099641162537271298634032011458617811670193865244028195169383991286227040469186123958053863978710424421008752927011390777187889943940479064193231486057910586526439884046593027
\\ 3072bit prime:
q = 5175054779340588353586849786144680366505563673837334790820581054294754700842534366479020240016540005621125885927641963390708863183739793208880756653713659686139600715884857385144475261507869935694699816011948585170171332029002674283854825650901258017026965486602158722052719421343475066067509485302858041368266332080773331946039572497794442067057597327877030322029413318847025776818839927761556478107499002213648377029201340152459685610920194363099878398871001275336711869213616313858200583491913270052111910410231060407633125816386053759634073500319223989240814564691163285769745840521560940666058800931070258886096469889796899266014106833050284032035948051974659796051419431527095503586817863043771919051402039741075037010264761045992285666560487072740505566408086913711094879155498223636912657852688296081316652278801546924079650897913388978423388839346058027184069633227966507908979049369500450630036982661231208087459099

\\\\\\\\\\\\
\\ SETUP
\\\\\\\\\\\\

\\ p not needed? wat?
\\p = 47

\\ get generator / primitive element for Z_q
\\ var = 'x                                                    \\ copy pasta from internet
\\ pe=ffgen(minpoly(ffprimroot(ffgen(ffinit(q,1))),var),var)   \\ get primitive element
\\ 1/(fforder(pe) == q-1)                                      \\ error out, if ord(pe) is wrong
\\ g = Mod(eval(Str(pe)), q)                                   \\ dirty hack to convert t_FFELEM to t_INT
g = Mod(2, q)

\\\\\\\\\\\\
\\ PROLOG
\\\\\\\\\\\\

\\ private keys of agents
x = vector(n,i,random(q))
\\ public keyshares of agents
yshares = vector(n,i,g^x[i])
\\ shared public key
y = prod(X=1,n,yshares[X])

\\ first index level = owning agent id (additive share)
\\ second index level = agent id, price id
m = vector(n,i,matrix(n,k,a,b,random(q)))

\\ index = owning agent id, price id
r = matrix(n,k,i,j,random(q))
\\ bid matrix
b = matrix(n,k,i,j,g^(bid[i]==j))

\\\\\\\\\\\\
\\ ROUND1
\\\\\\\\\\\\

\\ encrypted bids
alpha = matrix(n,k,i,j, b[i,j]*y^r[i,j])
beta  = matrix(n,k,i,j,        g^r[i,j])

\\\\\\\\\\\\
\\ ROUND2
\\\\\\\\\\\\

\\ multiplicative shares
\\ first index level = owning agent id (multiplicative share)
\\ second index level = agent id, price id
Gamma = vector(n,a,matrix(n,k,i,j, ( prod(h=1,n,prod(d=j+1,k,alpha[h,d])) * prod(d=1,j-1,alpha[i,d]) * prod(h=1,i-1,alpha[h,j]) )^m[a][i,j] ))
Delta = vector(n,a,matrix(n,k,i,j, ( prod(h=1,n,prod(d=j+1,k, beta[h,d])) * prod(d=1,j-1, beta[i,d]) * prod(h=1,i-1, beta[h,j]) )^m[a][i,j] ))

\\\\\\\\\\\\
\\ ROUND3
\\\\\\\\\\\\

\\ multiplicative shares (decryption)
\\ first index level = owning agent id (multiplicative share)
\\ second index level = agent id, price id
Phi = vector(n,a,matrix(n,k,i,j, prod(h=1,n,Delta[h][i,j])^x[a] ))

\\\\\\\\\\\\
\\ EPILOG
\\\\\\\\\\\\

\\ winner matrix
v = matrix(n,k,a,j, prod(i=1,n,Gamma[i][a,j]) / prod(i=1,n,Phi[i][a,j]) )
vi = lift(v)

print("bids are: ", bid)
for(X=1,n, if(vecmin(vi[X,])==1, print("And the winner is ", X) ))