Privacy and trust affect our strategic thinking, yet have not been precisely modeled in mechanism design. In settings of incomplete information, traditional implementations of a normal-form mechanism--by disregarding the players' privacy, or assuming trust in a mediator--may fail to reach the mechanism's objectives. We thus investigate implementations of a new type. We put forward the notion of a perfect implementation of a normal-form mechanism : in essence, a concrete extensive-form mechanism exactly preserving all strategic properties of , without relying on trusted mediators or violating the players' privacy. We prove that any normal-form mechanism can be perfectly implemented by a verifiable mediator using envelopes and an envelope-randomizing device. Differently from a trusted mediator, a verifiable one only performs prescribed public actions, so that everyone can verify that he is acting properly, and that he never learns any information that should remain private.
