Efficient Maximal Privacy in Boardroom Voting and Anonymous Broadcast Jens Groth BRICS, University of Aarhus Cryptomathic A/S.

Slides:

Advertisements

Similar presentations

Mix and Match: A Simple Approach to General Secure Multiparty Computation + Markus Jakobsson Bell Laboratories Ari Juels RSA Laboratories.

Advertisements

Secret Sharing Protocols [Sha79,Bla79]

Perfect Non-interactive Zero-Knowledge for NP

Short Pairing-based Non-interactive Zero-Knowledge Arguments Jens Groth University College London TexPoint fonts used in EMF. Read the TexPoint manual.

Simulation-sound NIZK Proofs for a Practical Language and Constant Size Group Signatures Jens Groth University of California Los Angeles Presenter: Eike.

Non-interactive Zero- Knowledge Arguments for Voting Jens Groth UCLA.

A Verifiable Secret Shuffle of Homomorphic Encryptions Jens Groth UCLA On ePrint archive:

Efficient Zero-Knowledge Argument for Correctness of a Shuffle Stephanie Bayer University College London Jens Groth University College London.

Spreading Alerts Quietly and the Subgroup Escape Problem Aleksandr Yampolskiy (Yale) Joint work with James Aspnes, Zoë Diamadi, Kristian Gjøsteen, and.

RPC Mixing: Making Mix-Nets Robust for Electronic Voting Ron Rivest MIT Markus Jakobsson Ari Juels RSA Laboratories.

Vote privacy: models and cryptographic underpinnings Bogdan Warinschi University of Bristol 1.

Talk by Vanessa Teague, University of Melbourne Joint work with Chris Culnane, James Heather & Steve Schneider at University of.

1 e-voting (requirements & protocols) 1) Aggelos Kiayias, Moti Yung: Self-tallying Elections and Perfect Ballot Secrecy 2) Jens Groth: Efficient Maximal.

Requirements for a Secure Voting System  Only authorized voters can vote  No one can vote more than once  No one can determine for whom anyone else.

Civitas Verifiability and Coercion Resistance for Remote Voting University of South Alabama August 15, 2012 Michael Clarkson The George Washington University.

Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)

A Pairing-Based Blind Signature

Efficient Zero-Knowledge Proof Systems Jens Groth University College London.

On the Security of Ballot Receipts in E2E Voting Systems Jeremy Clark, Aleks Essex, and Carlisle Adams Presented by Jeremy Clark.

Efficient Two-party and Multiparty Computation against Covert Adversaries Vipul Goyal Payman Mohassel Adam Smith Penn Sate UCLAUC Davis.

1 Receipt-freedom in voting Pieter van Ede. 2 Important properties of voting  Authority: only authorized persons can vote  One vote  Secrecy: nobody.

From: Cryptographers’ Track of the RSA Conference 2008 Date: Reporter: Yi-Chun Shih 1.

Computer Science Dr. Peng NingCSC 774 Adv. Net. Security1 CSC 774 Advanced Network Security Topic 5 Group Key Management.

Computational Security. Overview Goal: Obtain computational security against an active adversary. Hope: under a reasonable cryptographic assumption, obtain.

1 Asynchronous Broadcast Protocols in Distributed System Oct. 10, 2002 JaeHyrk Park ICU.

Sub-linear Zero-Knowledge Argument for Correctness of a Shuffle Jens Groth University College London Yuval Ishai Technion and University of California.

Efficient Zero-Knowledge Proof Systems Jens Groth University College London.

Efficient Zero-Knowledge Proof Systems Jens Groth University College London FOSAD 2014.

Improving the Round Complexity of VSS in Point-to-Point Networks Jonathan Katz (University of Maryland) Chiu-Yuen Koo (Google Labs) Ranjit Kumaresan (University.

Receipt-free Voting Joint work with Markus Jakobsson, C. Andy Neff Ari Juels RSA Laboratories.

Research & development A Practical and Coercion-resistant scheme for Internet Voting Jacques Traoré (joint work with Roberto Araújo and Sébastien Foulle)

Randomized Algorithms for Reliable Broadcast (IBM T.J. Watson) Vinod Vaikuntanathan Michael Ben-OrShafi GoldwasserElan Pavlov.

Jens Groth BRICS, University of Aarhus Cryptomathic

CS426Fall 2010/Lecture 351 Computer Security CS 426 Lecture 35 Commitment & Zero Knowledge Proofs.

1 Authenticated key agreement without using one-way hash functions Harn, L.; Lin, H.-Y. Electronics Letters, Volume: 37 Issue: 10, 10 May 2001 Presented.

Ring Signatures of Sub- linear Size without Random Oracles Nishanth Chandran Jens Groth Amit Sahai University of California Los Angeles TexPoint fonts.

Secure Multi-party Computations (MPC) A useful tool to cryptographic applications Vassilis Zikas.

Proactive Secure Mobile Digital Signatures Work in progress. Ivan Damgård and Gert Læssøe Mikkelsen University of Aarhus.

Dissuasive Methods Against Cheaters in Distributed Systems Kévin Huguenin Ph.D. defense, December 10 th 2010 TexPoint fonts used in EMF. Read the TexPoint.

A Secure Fault-Tolerant Conference- Key Agreement Protocol Wen-Guey Tzeng Source : IEEE Transactions on computers Speaker ： LIN, KENG-CHU.

CMSC 414 Computer and Network Security Lecture 19 Jonathan Katz.

Cryptography in Subgroups of Z n * Jens Groth UCLA.

UMBC Protocol Meeting 10/01/03 Universal Re-encryption: For Mix-Nets and Other Applications (to appear CT-RSA ’04) Paul Syverson NRL Markus Jakobsson Ari.

Linear Algebra with Sub-linear Zero-Knowledge Arguments Jens Groth University College London TexPoint fonts used in EMF. Read the TexPoint manual before.

Civitas Toward a Secure Voting System AFRL Information Management Workshop October 22, 2010 Michael Clarkson Cornell University.

WISA An Efficient On-line Electronic Cash with Unlinkable Exact Payments Toru Nakanishi, Mitsuaki Shiota and Yuji Sugiyama Dept. of Communication.

Andrew Lindell Aladdin Knowledge Systems and Bar-Ilan University 04/09/08 CRYP-202 Legally-Enforceable Fairness in Secure Two-Party Computation.

Optimistic Mixing for Exit-Polls Philippe Golle, Stanford Sheng Zhong, Yale Dan Boneh, Stanford Markus Jakobsson, RSA Labs Ari Juels, RSA Labs.

Efficient Zero-Knowledge Proofs Jens Groth University College London.

Masked Ballot Voting for Receipt-Free Online Elections Sam Heinith, David Humphrey, and Maggie Watkins.

Unified, Minimal and Selectively Randomizable Structure-Preserving Signatures Masayaki Abe, NTT Jens Groth, University College London Miyako Ohkubo, NICT.

A Linear Lower Bound on the Communication Complexity of Single-Server PIR Weizmann Institute of Science Israel Iftach HaitnerJonathan HochGil Segev.

Threshold PKC Shafi Goldwasser and Ran Canetti. Public Key Encryption [DH] A PKC consists of 3 PPT algorithms (G,E,D) - G(1 k ) outputs public key e,

6. Esoteric Protocols secure elections and multi-party computation Kim Hyoung-Shick.

An ID-Based Mutual Authentication and Key Exchange Protocol for Low- Power Mobile Devices Authors: Tsu-Yang Wu and Yuh-Min Tseng Source: The Computer Journal.

Evoting using collaborative clustering Justin Gray Osama Khaleel Joey LaConte Frank Watson.

1 Reasoning about Concrete Security in Protocol Proofs A. Datta, J.Y. Halpern, J.C. Mitchell, R. Pucella, A. Roy.

The Paillier Cryptosystem

New Techniques for NIZK Jens Groth Rafail Ostrovsky Amit Sahai University of California Los Angeles.

10/25/04 Security of Ad Hoc and Sensor Networks (SASN) 1/22 An Attack on the Proactive RSA Signature Scheme in the URSA Ad Hoc Network Access Control Protocol.

Almost Entirely Correct Mixing With Applications to Voting Philippe Golle Dan Boneh Stanford University.

Secure Computation (Lecture 9-10) Arpita Patra. Recap >> MPC with honest majority in i.t. settings > Protocol using (n,t)-sharing, proof of security---

1 An Ordered Multi-Proxy Multi-Signature Scheme Authors: Min-Shiang Hwang, Shiang-Feng Tzeng, Shu-Fen Chiou Speaker: Shu-Fen Chiou.

Usable Security Lab Crypto Lab Efficiency Comparison of Various Approaches in E-Voting Protocols Oksana Kulyk, Melanie Volkamer.

Cryptographic Shuffles Jens Groth University College London TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAAAAAAAAAAA.

Linear Algebra with Sub-linear Zero-Knowledge Arguments

Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces

Round-Optimal and Efficient Verifiable Secret Sharing

Short Pairing-based Non-interactive Zero-Knowledge Arguments

Presentation transcript:

Efficient Maximal Privacy in Boardroom Voting and Anonymous Broadcast Jens Groth BRICS, University of Aarhus Cryptomathic A/S

Election Privacy Ballot box V1V1 V2V2 V3V3 Result Vote1 = Result – Vote2 – Vote3

Properties  Perfect ballot secrecy coalition information = own votes and result  Self-tallying result reveals itself  Dispute-freeness dishonest behavior detectable

Assumptions  Bulletin board system  Semi-synchronous adversary: phases and activations  Static corruption  Group order q, decision diffie-hellman  Random oracle model, NIZK arguments BBS V2V2 V3V3 V1V1

Protocol  Public keys: h 1  g x1,..., h n  g xn private keys: x1,..., xn  Votes: V 1 : (u,v)  (g r1,(h 2 ···h n ) r1 g v1 ) V 2 : (u,v)  (ug r2,vu -x2 (h 3 ···h n ) r2 g v2 ) = (g r1+r2,(h 3 ···h n ) r1+r2 g v1+v2 ).. V n : (u,v)  (ug rn,vu -xn g vn ) = (g r1+...+rn,g v1+...+Vn )  Result: v1+...+vn

Complexity  Key generation: O(1) expos verification of proofs: O(n) expos  Voting: O(log c) expos verification of proofs: O(n log c) expos Previous protocols:  Key generation: O(n) expos verification of proofs: O(n 2 ) expos  Voting: O(log c) expos verification of proofs: O(n log c) expos c = number of candidates

Security V2V2 V3V3 V1V1 V2V2 V3V3 V1V1 v1 v2 w2 v3 Partial result: v1+v3 Reveal:last honest vote (u,v) result cont s result cont s

Anonymous Broadcast  Public keys: h 1  g x1,..., h n  g xn private keys: x1,..., xn  Messages: P 1 : (u 1,v 1 )  (g r1,(h 2 ···h n ) r1 m 1 ) P 2 : (u 2,v 2 )  (g r2,(h 2 ···h n ) r2 m 2 ) shuffle (u 1,v 1 ), (u 2,v 2 ) (u 1,v 1 )  (u 1,v 1 u 1 -x2 ) (u 2,v 2 )  (u 2,v 2 u 2 -x2 )...

Anonymous Broadcast  P n : (u n,v n )  (g rn,h n rn m n ) shuffle (u 1,v 1 ),...,(u n,v n ) (u 1,v 1 )  (u 1,v 1 u 1 -xn )... (u n,v n )  (u n,v n u n -xn )  {v 1,...,v n } = {m 1,...,m n } Output: m 1,...,m n

Complexity  Key generation: O(1) expos verification of proofs: O(n) expos  Message submission: O(n) expos verification of proofs: O(n 2 ) expos