e-Voting Application using Internal Vtoken Bowo Prasetyo Isolated e-Voting System in a Precinct Secured with Vote Sealing and Paper Audit Trail December 10,

e-Voting Application ● e-Voting Application is an open source project aiming to create an e-voting system which complies to European e-Voting standard and EML specification. ● e-Voting Application is also used as basis to create an e-voting system which complies to Indonesian e-Voting standard which is being defined by Badan Pengkajian dan Penerapan Teknologi (BPPT).

Download and License ● e-Voting Application can be found here: – ● It is under the license GPL v3, basically means: – You may download, modify, use and redistribute it freely. – Derived works should be made open source too under the same license.

e-Voting Application Components ● Client side applications: – Vtoken Generating application (VG). – e-Voting Machine application (EVM). √ – Vote Counting application (VC). ● Server side systems: – e-Voting Tabulation system (EVT).

e-Voting Scenario ● Voting opening – Administrator opens voting process. ● Voting session – Administrator verifies voter. – Voters generate vtoken and cast vote using EVM. ● Voting closing – Administrator closes voting process. – EVM generates result in files. ● Result delivery – Administrator sends result to election body.

Voting Opening EV M Administrator opens voting in all EVM machines

Voting Opening ● Administrator opens voting process on the machine by pressing an open voting button on EVM. ● When opening voting process, EVM: – Activates and deactivates some functions. – Generates a pair of private key – public key for digital signature: ● EVM: private.bin and public.bin

Voting Opening ● Before administrator open voting process on the machine, EVM: – cannot be used to cast votes. – can be used to view result. – can be used to reset ballot box. ● After administrator open voting process, EVM: – can be used to cast votes. – cannot be used to view result. – cannot be used to reset ballot box.

Voting Session 1. Administrator verifies voter 3. Voter casts vote 5. Voter puts paper audit trail into audit box 4. Voter takes paper audit trail 2. Operator opens voting session

Voting Session ● Voter verification – Administrator verifies voter identity. ● Voting session opening – Operator open voting session for each voter as proof of right-to-vote. ● Vtoken generation – EVM generates vtoken internally before voting. ● Voting – Voter casts vote using EVM.

Voting Session ● Vote sealing – EVM seals “vtoken + vote” using digital signature. ● Vote collection – EVM collects sealed votes in ballot box electronic. ● Paper audit trail generation – Voter takes generated paper audit trail and puts into audit box.

Voter Verification ● Before voter casts a vote, administrator verifies for two things: – voter's identity, and – whether voter is eligible to vote. ● Administrator performs voter verification: – manually using traditional identity card, or – electronically using digital identity card, or – combination of both.

Voting Session Opening ● Voting session opening is a proof of right-to- vote for voter. ● It is done by EVM operator after visually confirmed voter verification by administrator. ● Operator uses remote keyboard connected to EVM with extended cable, to input “short” password to open voting session. – Long password is used by administrator to open administration page.

Vtoken Generation ● Before voter casts vote, EVM generates vtoken internally for each voter. ● Vtoken is randomly generated. ● Vtoken is unique for each voter. ● Vtoken cannot be associated with voter.

Voting ● Voter uses EVM to cast a vote by: – Choose a candidate with a touch. – Confirm the choice with a touch. – Take paper audit trail and put it in audit box.

Vote Sealing ● Each vote casted by voters is combined by their unique vtoken and sealed. ● By sealing it means: – Encrypts “vtoken + vote”. ● Makes it hard-to-read by bad guys. – Digitally signs the encrypted “vtoken + vote”. ● Makes it cannot be altered (integrity). ● Makes it cannot be denied as coming from the machine (non-repudiation).

Vote Collection ● Each sealed vote (encrypted and digitally signed) is collected into electronic ballot box. – Technically speaking, they are collected in a table in MySQL database. ● Sealed votes are collected in random order such that it cannot be traced down to the voter. – After each vote the table storage is physically reordered according to some random number.

Paper Audit Trail Generation ● EVM prints paper audit trail as soon as collected e-vote into electronic ballot box. ● Paper audit trail is a visual proof for voter that his/her choice is correctly accepted. – Hence paper audit trail should clearly print the voter's choice in human readable format. ● Paper audit trail is also counted as comparison to e-vote in the case of dispute. – Hence paper audit trail may also print additional machine readable barcode.

Voting Closing EV M Administrator closes voting in all EVM machines

Voting Closing ● Administrator closes voting process on the machine by pressing a close voting button on EVM. ● When closing voting process, EVM: – Activates and deactivates buttons. – Generates a result file: ● result.bin containing voting result.

Voting Closing ● Before administrator close voting process on the machine, EVM: – can be used to cast votes. – cannot be used to view result. – cannot be used to reset ballot box. ● After administrator close voting process, EVM: – cannot be used to cast votes. – can be used to view result. – can be used to reset ballot box.

Result Management ● Administrator sends voting results from each machine to election body. ● Each EVM machine generates voting result: – #-*-result.bin : a binary file containing all sealed votes casted by voters on the machine. – #-*-public.bin : a binary file containing key to verify and decrypt the sealed votes. ● Each EVM also generates audit result: – #-*-audit.log

Voting Result Management ● Files result.bin contains sealed votes which are encrypted and digitally signed. ● To verify and decrypt this sealed votes, the suitable public key is needed. ● Therefore each #-*-result.bin should always be accompanied by corresponding #-*- public.bin.

Audit Result Management ● Paper audit trails are physically collected and could be counted in case of dispute. ● Files #-*-audit.log contains record of all actions taken by user along with its timestamp. ● These are digitally signed by EVM, and could be verified using corresponding #-*-public.bin. ● These could be used to reconstruct all actions happened during evoting process for audit purpose. ● Since all sensitive information related to vote confidentiality is not recorded, these cannot be used to trace down voters and their choice.

Key Management ● Each EVM generated a pair of key: – #-*-private.bin – #-*-public.bin #: precinct no. *: room no.

Private Key Management ● Private key is used to digitally sign vtoken as well as sealed vote. ● After voting process finished, private key from all machines should be: – copied to external media, – deleted from each machine, and – guarded securely from being misused. ● Misuse of private key for example could generate forged votes as being genuine.

Public Key Management ● Public key is used to verify digital sign of vtoken and sealed vote. ● Public key is also used to decrypt sealed vote. ● After voting process finished, public key from all machines should be: – copied to external media together with corresponding result.bin – deleted from each machine, and – guarded securely from being misused. ● Misuse of public key for example to decrypt sealed vote by unauthorized person.

References ● “LEGAL, OPERATIONAL AND TECHNICAL STANDARDS FOR E- VOTING”, Recommendation Rec(2004)11 adopted by the Committee of Ministers of the Council of Europe on 30 September 2004 and explanatory memorandum.