1. The Punchscan Voting System Refinement and System Design Rick Carback Kevin Fisher Sandi Lwin May 8, 2006

2. New and Significant Punchscan implementation with current technology –requirements of hardware and software –Verification of software Data flow Interfaces Security properties of the system

3. Outline Punchscan Revisited System Design Data Flow Hardware and Software Components Interfaces Security Properties Conclusion

4. Punchscan Revisited

5. Mark the hole with the character matching your choice. Split the two sheets. Scan one, shred one.

6. The Punchboard Before the election, tables are generated like the ones above.

7. The Punchboard Before the election, this is posted on the bulletin board. The grey boxes cover up how the ballots look and are decoded.

8. The Punchboard Next, the auditor chooses half the rows.

9. The Punchboard After the election, officials fill the tables and release receipt halves.

10. The Punchboard Auditors choose to reveal the left or right half of Decode.

11. System Design

12. Meet the Weebles!

13. Stage 1: Initialize Election

14. Stage 2: Pre-Election

15. Stage 3: Election Day

16. Stage 4: Post-Election

17. Data Flow

19. Hardware and Software

20. Ballot Authoring Software Operation –Defines how Ballot looks –Gives questions in required languages Low security –Works only with public data –Output independently verified on webserver –Access to webserver should be turned off after data is uploaded

21. Printer Must use secure paper Cannot keep ballot information –data fed to printer must also be destroyed/erased. Must fold the paper and punch the hole in the top page.

22. Scanner Must be properly calibrated Only sends positions to the web server, nothing else.

23. Shredder Must completely destroy the half of the ballot the voter discards –Crosscut shredder –Incinerator

24. Web Server Needs load balancing to avoid DoS Needs strict access controls – Essentially all the things you would do to secure any web server on the Internet Database should be protected Has implications to voter confidence…

25. Diskless Workstation Permutation generation Generate printable ballots Encrypted with printer’s key Ballot counting Software verification Boots and runs software from Linux Live CD Use hashing Computer with no hard drive Does not save data between meetings

26. Interfaces

27. XML USB SQL Queries

28. Security Properties

29. Subliminal Channels Scanner only records positions Social Engineering Simplicity is the Key Denial of Service Scanner Calibration Attack Destroy Vote before Scanning Phase Destroy equipment (scanner / Internet connection) Destroy paper ballots Spoil Punchboard Spoil Printed Materials

30. Future Work

31. Implement defined elements with modern hardware and software Expand security discussion into formal attack tree Invite discussion, analysis from e-voting community

32. The End