Secret Ballot Receipts True Voter-Verifiable Elections Richard Carback Kevin Fisher Sandi Lwin CMSC 691v April 3, 2005
Introduction System Features Magic receipt Vote visible in voting booth Vote invisible, verifiable outside voting booth Trusted voting machines unnecessary Provisional ballots are ballots, too Vote from anywhere Adjudicate today, adjudicate tomorrow Deeper, more restful sleep Eliminates common indoor allergens Even pet dander! Boosts gas mileage up to 13%
System from Voter’s Perspective Input with touch screen or other input means Register printer generates printout List names of candidate party affiliations office sought others
System from Voter’s Perspective Print votes before the final inch Printer prints simultaneously both layers Review printout Indicate layer to keep Printer prints final inch
System from Voter’s Perspective Printer cuts both layers off, still laminated together and releases them Neither layer readable on its own Light passing through sandwiched layers without printings on either layers makes choices visible
Example of Ballot Printout Figure 1. An example part of a ballot printout listing a candidate selected. In addition to being able to include the candidate’s name, party affiliation, and office sought, the printout can also include other types of contests and various graphics options.
Example of Final Inch Together Figure 2. Last inch of the printout before the two laminated layers are separated.
Final Inch Separated Figure 3. Last inch of the printout after it’s separated: (a) the receipt (the layer the voter selects to keep) and (b) the layer that’s shredded before the voter leaves the polling place.
Leaving the Polling Booth Voter gives up the layer marked for surrender Layer gets shredded by poll worker Same layers get shredded “electronically” Only physical layer voter kept and digital version of that same image remains
Election Web Site Enter receipt’s serial # to check vote has been counted Print image on website and check against the actual receipt
Resistance to Attack Posted Receipt == Proper Tabulation (Most likely) Votes are private (unless code is broken) Malicious Software can only hope: –user will choose one layer –noone will check serial numbers –tally will not be audited
Weaknesses to Attack Subliminal Channels Selectively Malicious DRE Discarded Receipts Malicious Tally Software
Visual Cryptography 101 Typography + = Newsprint e + = Ballot Receipt
Visual Cryptography 101 Pixels NewsprintBallot Receipt = 0 = 1 01 = = = = = = = =
Visual Cryptography 101 Message Encoding + = Random White Sheet = + ][ +
Visual Cryptography 101 White Sheet Vulnerability Single encoded message yields multiple plaintext images.
Visual Cryptography 101 Mixing Red and White Sheets + = = +
Tabulation All receipts are posted Each trustee decodes a batch Batches randomized to protect privacy
Russian Nesting Dolls Voted Ballot == Set of dolls (or one big doll) Each trustee opens one size of dolls Smallest doll is plaintext ballot
Coded Sheets How you do this with computers Big doll is the summation of the smaller permutations Each trustee subtracts their permutation mod 2 Original permutation revealed at smallest doll
Tabulation Integrity Need to maintain privacy Each trustee is video-taped doing 2 batches 1 tape is released –chosen afterwards (auditor or political parties)
Formal Receipt Process Voting Phase – Step 1 Ballot image B President: Lincoln Senator: Kennedy milk eggs LINCOLN General Election Senator: President: KENNEDY Ballot Number Separate layers before leaving booth. Plaintext receipt
Formal Receipt Process Voting Phase – Step 2 Printed 4-tuples Ballot Number Separate layers before leaving booth. General Election q: serial number L Z : ballot layer D t : top doll D b : bottom doll Ballot Number Separate layers before leaving booth. General Election
Formal Receipt Process Voting Phase – Step 3 Visual XOR function LINCOLN General Election Senator: President: KENNEDY Ballot Number Separate layers before leaving booth. = Mathematical XOR function
Formal Receipt Process Voting Phase – Step 5 Bottom layer: x=b Ballot Number Separate layers before leaving booth. General Election Ballot Number Separate layers before leaving booth. General Election Top layer: x=t
Formal Receipt Process Voting Phase – Step 5 Bottom layer: x=b Seed: s x (q) Ballot Number Separate layers before leaving booth. General Election Overall: o x (L x,q,D t,D b,s x (q)) “Last Inch” Digital Signature
Formal Receipt Process Voting Phase – Step 6 Part 1 s x (q) Ballot Number Separate layers before leaving booth. General Election Consistency Check (s x ) -1 hash q
Formal Receipt Process Voting Phase – Step 6 Part 2 s x (q) Ballot Number Separate layers before leaving booth. General Election o x (L x,q,D t,D b,s x (q)) Consistency Check (o x ) -1 hash q hash DbDb DtDt LxLx
Formal Receipt Process Red and White Matrices Ballot Number Separate layers before leaving booth. General Election m n n/2 WZWZ RZRZ
Formal Receipt Process Red and White Matrices Ballot Number Separate layers before leaving booth. General Election Ballot Number Separate layers before leaving booth. General Election Top LayerBottom Layer W t = L t i,[2j – ([i+1] mod 2)] R t = L t i,[2j – (i mod 2)] R b = L b i,[2j – ([i+1] mod 2)] W b = L b i,[2j – (i mod 2)] WtWt RtRt RbRb WbWb
Formal Receipt Process Red and White Matrices Ballot Number Separate layers before leaving booth. General Election Ballot Number Separate layers before leaving booth. General Election Top LayerBottom Layer B x = R x W y WtWt RtRt RbRb WbWb
Formal Receipt Process Cryptographic Pseudorandom Number Generators Ballot ID Key Ciphertext AES N bits
Formal Receipt Process Calculating the Noise Matrix W Z i,j = (d Z k d Z k-1 … d Z 1 ) [mj–m]+1 d Z k = h ’ (d ’Z k ) d ’Z k = h(s Z (q), k) s Z (q) Pseudorandom sequence h’h d Z k = k Cryptographic pseudorandom number generators m*n/2 bits W Z i,j = n/2 m
Formal Receipt Process Doll Construction d ’Z k = doll k s Z (q) Pseudorandom sequence h’h d Z k = k Cryptographic pseudorandom number generators d ’Z 1 )e1(e1(e 2 (d ’Z 2,))D Z k = e k (d ’Z k, …
Formal Receipt Process Tally Phase: Doll Processing D L-1 DLDL dLdL DLDL dLdL d’ L-1 eLeL h’ d’ L-1 d L-1 D L-1 d L-1 d Z L-1 = h ’ (d ’Z L-1 )
Formal Receipt Process Tally Phase: Auditing Stagekk-1k-2k-3k-4 Audit batches
Formal Receipt Process Tally Phase: Auditing Stagekk-1k-2k-3k-4 Audit batches
Cryptography Computationally secure –breakable with enough computing power applied Unconditionally secure –cannot be broken even with applying infinite computing power
Cryptography Receipt system uses: –Computationally secure encryption to form layers Digital signatures: –last inch contains digital signature for authentication –scanners used to verify signature
Cryptography Privacy –Protects privacy using computationally secure encryption.
Cost of System Reduces cost of integrity while raising its level dramatically Hardware cost lower than current black box system –Government buy at price of open platform PC Cost of suitable printers in volume is less than hardware cost saving Savings in maintenance and upgrades
Similarities in Punchscan Splitting the ballot is the same idea –Destroy half the information Tabulation is more complicated, but similar to that of Punchscan –privacy is kept in a similar manner (only choose half of the process to look at)
Similarities in Punchscan Definitely an advancement Has some security problems at the system level –not insurmountable Kind of complicated Not expandable –rank-order would be hard –Not the most scalable