  Auctions have a long history, having been recorded as early as 500 B.C.
Nowadays, electronic auctions have been a great success and are increasingly
used. Many cryptographic protocols have been proposed to address the various
security requirements of these electronic transactions, in particular to ensure
privacy. Brandt developed a protocol that computes the winner using homomorphic
operations on a distributed ElGamal encryption of the bids. He claimed that it
ensures full privacy of the bidders, i.e. no information apart from the winner
and the winning price is leaked. We first show that this protocol -- when using
malleable interactive zero-knowledge proofs -- is vulnerable to attacks by
dishonest bidders. Such bidders can manipulate the publicly available data in a
way that allows the seller to deduce all participants' bids. Additionally we
discuss some issues with verifiability as well as attacks on non-repudiation,
fairness and the privacy of individual bidders exploiting authentication
problems.
