Trust Model

We assume that the bidder does not trust the auctioneer; the seller does not trust the auctioneer; and the bidder and seller do not trust each other.

The correctness and the security of the auctions are only rely on the following factors:

• The secure coprocessor's tamper-resistance, code loading techniques, and outbound authentication API work correctly. (The FIPS validation helps us here.)
• The software components, auction controller and bids collector work correctly.