1. Jens Groth BRICS, University of Aarhus Cryptomathic
Evaluating Security of Voting Schemes in the Universal Composability Framework
Jens Groth
BRICS, University of Aarhus Cryptomathic

2. S Fvoting Ideal Voting Functionality vote vote V1 … Vm A1 … An result

3. Real Life
vote
vote V1 … Vm
voting A A1 … An
result
result

4. Z Z A S Fvoting Universal Composability Real Ideal vote vote vote vote… Vm V1 … Vm A S
Fvoting A1 … An A1 … An
result
result
result
result

5. Security Requirements
Privacy
Authentication
Accuracy
Robustness
Fairness
Availability
Verifiability
Incoercibility
Hacker protection

6. Homomorphic Threshold Encryption
Each voter: Epk(vote) + ZK proof + signature
Homomorphic property: Epk(result)= Epk(vote1) *…* Epk(voten)
Threshold decryption:
Authority 1
. .
Epk(result)
result
Authority n

7. Example
ElGamal-encryption: pk = (q,p,g,h), q|p-1, g,h order q in Zp* sk = x, h=gx mod p
yes-vote = 1, no-vote = 0
Each voter: (gr mod p, hrgv mod p) + ZK proof
Homomorphic property: (gr1+…+rm mod p, hr1+…+rmgv1+…+vm mod p) = (gri mod p, hrigvi mod p)
Threshold decryption: Lagrange interpolation  gv1+…+vm mod p, discrete log  v1+…+vm

8. A Fkey generation Key Generation Functionality public key public keyV1 … Vm
Fkey generation A A1 … An
public key secret share
public key secret share

9. A Fmessage board Message Board Functionality message message V1 … VmAn
Voters’ messages Authority’s message
Voters’ messages Authority’s message

10. Z Z A S Fvoting FKM Universal Composability Hybrid Ideal vote vote… Vm V1 … Vm A S
Fvoting
FKM A1 … An A1 … An
result
result
result
result

11. Z S A Fvoting FKM The Simulator
S simulates A,V1,…,Vm,A1,…,An, FKM and random oracle Z
vote
vote
vote V1 … Vm V1 … Vm S
Fvoting A
FKM A1 … An
result A1 … An
result
result

12. Results
Homomorphic threshold encryption voting securely realizes Fvoting in the FKM-hybrid model against non-adaptive adversaries
Homomorphic threshold encryption voting does NOT securely realize Fvoting in the FKM-hybrid model against adaptive adversaries
Modified homomorphic threshold encryption voting securely realizes Fvoting in the FKM-hybrid model against adaptive adversaries

13. Modified Voting Scheme
Each voter: Epk(vote) + ZK proof + signature Delete vote and coins
Threshold decryption:
Epk(result) -> Epk(result)’ -> result Delete coins

14. Thanks
Questions?