Secret Ballot Receipts True Voter-Verifiable Elections Richard Carback Kevin Fisher Sandi Lwin CMSC 691v April 3, 2005

Introduction System Features Magic receipt Vote visible in voting booth Vote invisible, verifiable outside voting booth Trusted voting machines unnecessary Provisional ballots are ballots, too Vote from anywhere Adjudicate today, adjudicate tomorrow Deeper, more restful sleep Eliminates common indoor allergens Even pet dander! Boosts gas mileage up to 13%

System from Voter’s Perspective Input with touch screen or other input means Register printer generates printout List names of candidate party affiliations office sought others

System from Voter’s Perspective Print votes before the final inch Printer prints simultaneously both layers Review printout Indicate layer to keep Printer prints final inch

System from Voter’s Perspective Printer cuts both layers off, still laminated together and releases them Neither layer readable on its own Light passing through sandwiched layers without printings on either layers makes choices visible

Example of Ballot Printout Figure 1. An example part of a ballot printout listing a candidate selected. In addition to being able to include the candidate’s name, party affiliation, and office sought, the printout can also include other types of contests and various graphics options.

Example of Final Inch Together Figure 2. Last inch of the printout before the two laminated layers are separated.

Final Inch Separated Figure 3. Last inch of the printout after it’s separated: (a) the receipt (the layer the voter selects to keep) and (b) the layer that’s shredded before the voter leaves the polling place.

Leaving the Polling Booth Voter gives up the layer marked for surrender Layer gets shredded by poll worker Same layers get shredded “electronically” Only physical layer voter kept and digital version of that same image remains

Election Web Site Enter receipt’s serial # to check vote has been counted Print image on website and check against the actual receipt

Resistance to Attack Posted Receipt == Proper Tabulation (Most likely) Votes are private (unless code is broken) Malicious Software can only hope: –user will choose one layer –noone will check serial numbers –tally will not be audited

Weaknesses to Attack Subliminal Channels Selectively Malicious DRE Discarded Receipts Malicious Tally Software

Visual Cryptography 101 Typography + = Newsprint e + = Ballot Receipt

Visual Cryptography 101 Pixels NewsprintBallot Receipt = 0 = 1 01 = = = =         = = = =

Visual Cryptography 101 Message Encoding + = Random White Sheet = + ][ +

Visual Cryptography 101 White Sheet Vulnerability Single encoded message yields multiple plaintext images.

Visual Cryptography 101 Mixing Red and White Sheets + = = +

Tabulation All receipts are posted Each trustee decodes a batch Batches randomized to protect privacy

Russian Nesting Dolls Voted Ballot == Set of dolls (or one big doll) Each trustee opens one size of dolls Smallest doll is plaintext ballot

Coded Sheets How you do this with computers Big doll is the summation of the smaller permutations Each trustee subtracts their permutation mod 2 Original permutation revealed at smallest doll

Tabulation Integrity Need to maintain privacy Each trustee is video-taped doing 2 batches 1 tape is released –chosen afterwards (auditor or political parties)

Formal Receipt Process Voting Phase – Step 1  Ballot image B President: Lincoln Senator: Kennedy milk eggs LINCOLN General Election Senator: President: KENNEDY Ballot Number Separate layers before leaving booth. Plaintext receipt

Formal Receipt Process Voting Phase – Step 2  Printed 4-tuples Ballot Number Separate layers before leaving booth. General Election q: serial number L Z : ballot layer D t : top doll D b : bottom doll Ballot Number Separate layers before leaving booth. General Election   

Formal Receipt Process Voting Phase – Step 3 Visual XOR function LINCOLN General Election Senator: President: KENNEDY Ballot Number Separate layers before leaving booth.  = Mathematical XOR function

Formal Receipt Process Voting Phase – Step 5 Bottom layer: x=b Ballot Number Separate layers before leaving booth. General Election Ballot Number Separate layers before leaving booth. General Election Top layer: x=t  

Formal Receipt Process Voting Phase – Step 5 Bottom layer: x=b Seed: s x (q) Ballot Number Separate layers before leaving booth. General Election    Overall: o x (L x,q,D t,D b,s x (q)) “Last Inch” Digital Signature

Formal Receipt Process Voting Phase – Step 6 Part 1 s x (q) Ballot Number Separate layers before leaving booth. General Election Consistency Check (s x ) -1 hash q

Formal Receipt Process Voting Phase – Step 6 Part 2 s x (q) Ballot Number Separate layers before leaving booth. General Election o x (L x,q,D t,D b,s x (q)) Consistency Check (o x ) -1 hash q hash DbDb DtDt LxLx

Formal Receipt Process Red and White Matrices Ballot Number Separate layers before leaving booth. General Election m n n/2 WZWZ RZRZ

Formal Receipt Process Red and White Matrices Ballot Number Separate layers before leaving booth. General Election Ballot Number Separate layers before leaving booth. General Election Top LayerBottom Layer W t = L t i,[2j – ([i+1] mod 2)] R t = L t i,[2j – (i mod 2)] R b = L b i,[2j – ([i+1] mod 2)] W b = L b i,[2j – (i mod 2)] WtWt RtRt RbRb WbWb

Formal Receipt Process Red and White Matrices Ballot Number Separate layers before leaving booth. General Election Ballot Number Separate layers before leaving booth. General Election Top LayerBottom Layer B x = R x  W y WtWt RtRt RbRb WbWb

Formal Receipt Process Cryptographic Pseudorandom Number Generators Ballot ID Key Ciphertext AES N bits

Formal Receipt Process Calculating the Noise Matrix W Z i,j = (d Z k  d Z k-1  …  d Z 1 ) [mj–m]+1 d Z k = h ’ (d ’Z k ) d ’Z k = h(s Z (q), k) s Z (q) Pseudorandom sequence h’h d Z k = k Cryptographic pseudorandom number generators m*n/2 bits W Z i,j = n/2 m

Formal Receipt Process Doll Construction d ’Z k = doll k s Z (q) Pseudorandom sequence h’h d Z k = k Cryptographic pseudorandom number generators d ’Z 1 )e1(e1(e 2 (d ’Z 2,))D Z k = e k (d ’Z k, …

Formal Receipt Process Tally Phase: Doll Processing D L-1 DLDL dLdL DLDL dLdL d’ L-1 eLeL h’ d’ L-1 d L-1  D L-1 d L-1 d Z L-1 = h ’ (d ’Z L-1 )

Formal Receipt Process Tally Phase: Auditing Stagekk-1k-2k-3k-4 Audit batches

Formal Receipt Process Tally Phase: Auditing Stagekk-1k-2k-3k-4 Audit batches

Cryptography Computationally secure –breakable with enough computing power applied Unconditionally secure –cannot be broken even with applying infinite computing power

Cryptography Receipt system uses: –Computationally secure encryption to form layers Digital signatures: –last inch contains digital signature for authentication –scanners used to verify signature

Cryptography Privacy –Protects privacy using computationally secure encryption.

Cost of System Reduces cost of integrity while raising its level dramatically Hardware cost lower than current black box system –Government buy at price of open platform PC Cost of suitable printers in volume is less than hardware cost saving Savings in maintenance and upgrades

Similarities in Punchscan Splitting the ballot is the same idea –Destroy half the information Tabulation is more complicated, but similar to that of Punchscan –privacy is kept in a similar manner (only choose half of the process to look at)

Similarities in Punchscan Definitely an advancement Has some security problems at the system level –not insurmountable Kind of complicated Not expandable –rank-order would be hard –Not the most scalable