eVoting System Proposal Michael Baswell, Chris Cabuzzi, Grant Cahill, Beaux Sharifi, Donovan Thorpe

Introduction Overview Pre-Election Election Post-Election Analysis Other Issues For the introduction, I’d like to give a quick overview of what we’ll be talking about…. - Pre-Election: Eligibility, non-repudiation, and ballot creation and validation - Election: The steps taken to ensure each vote is valid and securely accounted for - Post-Election: Auditing, intrusion detection and verification of data - Analysis: Ensure the design meets criteria of a safe and effective eVoting system - Other issues: …such as server overload and any other technical difficulties

Pre-Election Process Definitions: Validator = Authenticator Tallier = Counter Certificates Digital certificates for servers and the voters Certificates will be distributed through web page or manually (via walk-up or mail). In any case you must ensure each voter gets only one certificate. Registered voters A list of registered voters is compiled and stored on the validator. This list is used to check the credentials of users attempting to vote. This ensures only voters who are eligible and who have not voted can proceed to vote. Ballot An electronic ballot is created and digitally signed by the tallier. The tallier hands out the ballot during the election process. Certificate (both clients, possibly attribute certificate) Ballot creation Roles that can vote Must show up in person to present ID or call. to prevent multiples Definitions: Validator = Authenticator Tallier = Counter Ballot creation (signed by tallier) Both validator and tallier must have server certificates Validator has a database of eligible registered voters.

Election Process Blind Signature Voting Protocol (Source: Electronic Voting by Lorrie Cranor [3]) Step 1: Voter receives and authenticates signed official ballot. Voter fills in ballot. Voter encrypts (with a special one-time private key), blinds, and signs ballot. Voter sends encrypted, blinded, signed ballot to validator. Step 2: Validator and voter perform mutual authentication. Validator verifies that voter has not already voted. Validator authenticates voter-signed ballot. Validator marks the voter as having voted. Step 3: Validator signs the encrypted and blinded ballot and returns to voter. Step 4: Validator authenticates validator signed ballot. Voter removes blinding layer revealing encrypted ballot with validator’s signature. Voter authenticates tallier (but not vice-versa). Voter sends validator signed and encrypted ballot to tallier. Step 5: Tallier authenticates validator signed encrypted ballot. Tallier places encrypted ballot on list to be published at end of election. Tallier signs encrypted ballot and returns to voter as receipt. Step 6: Voter authenticates tallier signed encrypted ballot and saves it as a receipt. Voter can use receipt later to prove he voted. Voter sends tallier special public key used to decrypt ballot. Step 7: Tallier decrypts ballot using special public key from voter. Tallier adds vote to the tally. After the election, the tallier publishes the entire list of encrypted ballots along with corresponding keys to the public. Public can verify that their votes were counted and dispute any discrepancies. Tallier publishes final tally and announces winners.

Post-Election Process Audit Occurs during election and post-election IDS (intrusion detection system) Tripwire Auditor monitors software running and verifies hash Audit voter signatures

Post-Election Process Publish all encrypted ballots with keys Tally up votes Publish decrypted ballots Publish results Web Email

Analysis of Design Criteria from EVS2004 presentation Requirements of a secure election: Completeness: All voters are counted correctly. Soundness: A dishonest voter cannot disrupt voting Privacy: All votes must be secret Unreusability: no voter can vote twice Eligibility: no one who isn’t allowed to vote can vote Fairness: nothing must affect the voting (DDoS?) Verifiability: no one can falsify the result of voting. ADDED: Ease of Implementation Validator and Counter

Analysis

Other Issues Overloading server Too much legitimate traffic to a server can cause an overload. Distributing the load across multiple servers DNS Round Robin A traffic manager that redirects or rewrites the request A traffic shaper can be used in front or on the server A simple a quick response like "server is busy, please try again later" could be used.

Conclusion Summary Pre-Election: Ensuring the system is available to eligible voters Election: Collecting votes in the most valid and secure way Post-Election: Tallying the results and checking for tampering Analysis: Ensuring system meets a pre-defined standard Other Issues: Possibility of server overload, etc To summarize, we talked about the e-voting process, through all it’s stages. We talked about methods required to ensure the process is confidential, secure and only available to eligible voters. We also considered the possibility of technical issues such as server overload and auditing. We hope you enjoyed our presentation… don’t forget to vote!

References [1] Jujioka, A, Okamoto, T., and Ohta, K. A practical secret voting scheme for large scale elections. In Advances in Cryptology - AUSCRYPT ’92, Springer-Verlag, Berlin. 1993, pp.244-251. [2] Cranor, L. Design and Implementation of a Practical Security-Conscious Electronic Polling System. http://lorrie.cranor.org/voting/sensus/ssp/ssp.html [3] Cranor, L. Electronic Voting. http://www.acm.org/crossroads/xrds2-4/voting.html To summarize, we talked about the e-voting process, through all it’s stages. We talked about methods required to ensure the process is confidential, secure and only available to eligible voters. We also considered the possibility of technical issues such as server overload and auditing. We hope you enjoyed our presentation… don’t forget to vote!

Questions?