Evaluation of an E-Voting Device based on a Common Criteria Protection Profile Roland Vogt, DFKI GmbH Dr. Sönke Maseberg, datenschutz nord GmbH 8th ICCC, Rome

Agenda  E-Voting device to be used for the Hamburg state parliament election in February 2008  Pros and Cons  Election Principles and Security Policy  Crucial decisions and their implications  Challenges of the evaluation  Conclusion

E-Voting device dotVote ® I  Digital Election Pen

E-Voting device dotVote ® II  Stand-alone laptops  Electronic ballot box

E-Voting device dotVote ® III  Automatic as well as manual validation of votes  Calculation of results Product info (german):

Pros & Cons Pros  Traditional vote casting  No artificial invalidation  Voter verifiable audit trail  Standard platform Cons  Difficult validation of votes  Accidental invalidation  Resolution of counting problems  Digital election pens with limited security features

Election Principles and Security policy  CC 2.3 Protection Profile „Digital Pen Election System“ (BSI-PP-0031; german)  Votes must not be intercepted nor modified  Votes must not be known before the official ballot reading  Only registered voters should be able to vote  Each voter should have one and only one vote  Vote secrecy is guaranteed: it never will be possible to link a voter to his/her vote  All critical events should be auditable

Crucial decisions and their implications I  Trustworthy scrutineers  OSPs vs. Threats  In analogy to traditional election  Voters as attackers  Votes are the target of attack  Standard platform  No network connections, i.e. election districts are isolated

Crucial decisions and their implications II  Paper ballots as emergency backup  Destruction of storage media is an accepted risk  EAL3  How to demonstrate correct implementation of unlinkability mechanism?  Code Review?

Challenges I  Authenticity/Integrity of pens  SOF claim for seals  Unlinkability while storing on a standard file system  SOF claim & vulnerabilities

Challenges II  Analysis/ Validation of votes  Insufficient amount of labelled training/evaluation data  Correctness vs. Effectiveness vs. Performance  Should the voter considered as an attacker here?

Conclusion  E-Voting is one of the challenging applications of CC evaluation  Protection Profile (BSI-PP-0031) is existing  Currently the digital election pen system dotVote ® is in evaluation based on this PP  Experience are expected in February 2008