Electronic Voting R. Newman

Topics Defining anonymity Need for anonymity Defining privacy Threats to anonymity and privacy Mechanisms to provide anonymity Metrics for Anonymity Applications of anonymity technology

Privacy Need anonymity to protect against retribution Need privacy to protect against coersion Authorization Need to ensure only enfranchised vote Need to prevent multiple voting Verifiability Need to make sure your vote was counted Need to be able to verify tally is correct Auditability is needed in case of disputes Voting Requirements

Data integrity and reliability - tamperproof Voter anonymity and data confidentiality Operator authentication Documentation and assurance Personnel integrity Specific Requirements

System accountability System disclosability System availability System reliability Interface usability Specific Reqs – the ”-ilities”

Plurality Voting One vote per voter Candidate with most votes wins Plurality with Run-off Plurality voting selects top two candidates Top two candidates have second election Approval Voting Voters can approve of multiple candidates Candidate with most votes wins Types of Voting

Instant Run-off Candidate with fewest votes eliminated Repeat until candidate with majority Pairwise Elimination Vote in tournament style Borda Voting Voters submit total order on candidates Candidate with most points wins Many more.... More Types of Voting

Secret Sharing Threshold systems Basic versions assume: Honest distribution Honest reconstruction PVSS resists Dealer distributing incorrect shares Anyone can verify correctness Participants submitting incorrect shares Publically Verifiable Secret Sharing

Voters Register and vote Registrar Validate voters Distribute ballots Ballot Box – Vote Certifier Allow voters to post anonymous, verifiable ballots Tallyer Collect valid ballots Post verifiable results Generic Approach - Players

Phase I – Registering Voter contacts Registrar, proves identity Registrar verifies identity, gives blank ballot Phase II – Voting Voter prepares ballot, submits to ballot box Ballot box validates ballot, posts ballots Public (including voters) verify ballots Phase III – Tallying Tallyer combines votes on ballots, publishes results Public verifies results Generic Approach - Phases

Registrar gets list of valid voters Voter sends Registrar proof of identity along with blinded ballots Public key signature on message Registrar verifies voter’s identity and validity Verifies signature Checks that name is on list of valid voters Registrar signs blinded ballots Typically uses cut-and-choose to detect cheating Blinding removes association with voter Registering

Voter unblinds ballots Voter selects ballot with candidate of choice Voter anonymously sends ballot to Ballot Box Ballot Box verifies ballot Signature from Registrar Ballot Box posts ballot Voter can see that her ballot has been cast Voting

Ballot Box closes polls when period is over Tallyer collects all valid ballots Tallyer computes results and posts Public can validate results Tallying

Registrar gets list of valid voters Voter sends Registrar proof of identity Public key signature on message Registrar verifies voter’s identity and validity Verifies signature Checks that name is on list of valid voters Registrar sends Voter blank ballot Keeps digest of voters, ballots Registering – Alternative 1

Voter marks signed ballot with choice(s) Voter sends blinded marked ballot to Certifier Voter signs blinded marked ballot Certifier validates ballot Checks signature vs. list of voters Does not know ballot number Signs blinded ballot Voter unblinds ballot, anonymously sends to Tallyer Tallyer anonymously sends receipt to voter Voting – Alternative 1

Tallyer counts valid votes Tallyer publishes results Counting – Alternative 1

Registrar gets list of valid voters Voter sends Registrar proof of identity along with blinded public key PK used as a pseudonym Registrar verifies voter’s identity and validity Verifies signature Checks that name is on list of valid voters Registrar signs blinded public key Blinding removes association with voter Voter has registrar’s signature on PK certificate Registering – Alternative 2

Voter produces ballot Uses proper format Signs balloot using pseudonym public key Voter sends signed ballot to Ballot Box Ballot sent anonymously BB can’t link ballot to sender or to signer BB verifies ballot Checks signature on ballot Checks that PK certificate signed by Registrar BB posts valid ballots Voting – Alternative 2

Tallyer closes election when time is up Tallyer combines validedated ballots Publishes results Tallying – Alternative 2

Obtaining marked ballot that is Not tied to the voter Verifiable Insuring that fraud cannot occur Voter can only vote once Nobody other than voter can use voter’s ballot Only valid voters can vote Auditability What about write-in ballots? Issues