1. A Brief Intro to Aperio and Eperio Aleksander Essex University of Waterloo, *University of Ottawa SecVote 2010 Sept. 3, Bertinoro Italy

2. Aperio and Eperio Aperio (Essex, Clark and Adams, WOTE08) – Paper-based voting – Verifiable w/o crypto Eperio (Essex, Clark, Hengartner and Adams, EVT10) – Electronic Aperio – Optical scan ballots – Verifiable with some crypto

3. Cryptoless E2E-style voting 3-Ballot – Hard to mark but easy to check – Numerous Attacks long ballots short ballots (CEA07) Etc Farnel/Twin – Easy to mark, easy to check but, – Need chain-of-custody to be secure If you had it, do you need ?

4. Aperio Easy to mark Easy to tally Some repetitive paperwork to verify No CoC assumption

5. Aperio Ballot Assembly WU, Carol JONES, Alex SMITH, Bob # 002 R#: 923R#: 617

6. Aperio Ballot Assembly Sheets fused together (voter can’t see bottom sheets)

7. Reference Lists 450 251 556 051 … Wu, Jones, Smith Jones, Wu, Smith Smith, Wu, Jones Wu, Jones, Smith …

8. # 002 WU, Carol JONES, Alex SMITH, Bob Wu, Jones, Smith 002 #923

9. # 002 WU, Carol JONES, Alex SMITH, Bob #923 Wu, Jones, Smith 002 #617

10. Commitments (tamper-evident envelopes) Alice

11. Voting

12. Casting

13. Counting Σ

14. Coin toss reveals either – Pink Ballot, Goldenrod Receipt, or, – Pink Receipt, Goldenrod Ballot Decommitting Protocol Al ic e

15. Checking Receipts R#: 923 # 002 X X 002

16. WU, Carol JONES, Alex SMITH, Bob WU, Carol JONES, Alex SMITH, Bob WU, Carol JONES, Alex SMITH, Bob WU, Carol JONES, Alex SMITH, Bob B: 617 R: 922 X WU, Carol JONES, Alex SMITH, Bob R#: 617 X WU, Carol JONES, Alex SMITH, Bob X   Checking Tally

17. Cryptography in Elections Conflicting views: – Max-crypto Security at expense of simplicity – No-crypto Simplicity at expense of security Our goal: – Min-crypto  Balance security and simplicity

18. Eperio What it is – E2E election verification protocol What it means for verification – Fewer cryptographic primitives – Smaller datasets – Faster execution – Fewer lines of code

19. Bob Alice Bob #000#001 x x Pret-a-Voter style Ballots

20. Bubble IDMarked?Candidate Bob Alice #000 Trustees* copy ballots into a table Before the election…. *Done obliviously

21. Bubble IDMarked?Candidate #000-1 st Bob #000-2 nd Alice Bob Alice #000 Before the election…. Trustees* copy ballots into a table *Done obliviously

22. Bubble IDMarked?Candidate #000-1 st Bob #000-2 nd Alice #001-1 st Alice #001-2 nd Bob Alice Bob #001 Before the election…. Trustees* copy ballots into a table *Done obliviously

23. Bubble IDMarked?Candidate #000-1 st Bob #000-2 nd Alice #001-1 st Alice #001-2 nd Bob ……… ……… And so on… Before the election….

24. Bubble IDMarked?Candidate #000-1 st Bob #000-2 nd Alice #001-1 st Alice #001-2 nd Bob …… The Eperio Table: Remember: it’s just the ballots in table-form.

25. Trustees shuffle rows Bubble IDMarked?Candidate #001-2 nd Bob #003-2 nd Bob #007-1 st Bob #029-2 nd Alice #001-1 st Bob ……

26. Trustees mask columns Bubble IDMarked?Candidate #001-2 nd Bob #003-2 nd Bob #007-1 st Bob #029-2 nd Alice #001-1 st Bob …… Cryptographically committed and published

27. Bubble IDMarked?Candidate #001-2 nd Bob #003-2 nd Bob #007-1 st Bob #029-2 nd Alice #001-1 st Bob …… Bubble IDMarked?Candidate #001-2 nd Bob #003-2 nd Bob #007-1 st Bob #029-2 nd Alice #001-1 st Bob …… Bubble IDMarked?Candidate #001-2 nd Bob #003-2 nd Bob #007-1 st Bob #029-2 nd Alice #001-1 st Bob …… Bubble IDMarked?Candidate #001-2 nd Bob #003-2 nd Bob #007-1 st Bob #029-2 nd Alice #001-1 st Bob …… Many independent shuffled copies created More instances scales security assurance

28. Bubble IDMarked?Candidate #000-1 st YesBob #000-2 nd NoAlice #001-1 st YesAlice #001-2 nd NoBob ……… #000 #001 x x Ballots recorded by scanner During the election…

29. Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesAlice ……… After the election: Bubble IDMarked?Candidate #000-1 st YesBob #000-2 nd NoAlice #001-1 st YesAlice #001-2 nd NoBob ……… Trustees fill in middle columns

30. Bubble IDMarked?Candidate #001-2 nd YesBob #031-2 nd YesBob #001-1 st YesAlice #029-2 nd NoAlice #021-1 st YesBob ……… After the election: Bubble IDMarked?Candidate #000-1 st YesBob #000-2 nd NoAlice #001-1 st YesAlice #001-2 nd NoBob ……… Trustees fill in middle columns

31. The Audit Challenge Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ……… Bubble IDMarked?Candidate #001-2 nd YesBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ……… Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ……… Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd NoBob #007-1 st YesBob #029-2 nd YesAlice #001-1 st NoBob ……… Challenge Public coin toss One column from each instance challenged Response Trustees post decommitments

32. Checking receipts Bubble IDMarked?Candidate #001-2 nd YesBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ………

33. Checking receipts Bubble IDMarked?Candidate #007-1 st YesBob #006-2 nd YesBob #042-1 st YesBob #029-2 nd NoAlice #007-2 nd NoBob ……… Bubble ID column decommitted

34. Checking receipts Bubble IDMarked?Candidate #007-1 st Yes Bob #006-2 nd YesBob #042-1 st YesBob #029-2 nd NoAlice #007-2 nd No Bob ……… Voter looks up receipt. Checks for match. #007 x

35. Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ……… Tally audit

36. Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesAlice #007-1 st YesAlice #029-2 nd NoBob #001-1 st YesBob ……… Candidate column decommitted Tally audit

37. Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesAlice #007-1 st YesAlice #029-2 nd NoBob #001-1 st YesBob ……… Tally like any election Tally audit +

38. Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesAlice #007-1 st YesAlice #029-2 nd NoBob #001-1 st YesBob ……… Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ……… Repeat as necessary… Bubble IDMarked?Candidate #007-1 st YesBob #006-2 nd YesBob #042-1 st YesBob #029-2 nd NoAlice #007-2 nd NoBob ……… Bubble IDMarked?Candidate #001-2 nd NoAlice #003-2 nd YesBob #007-1 st YesBob #029-2 nd YesAlice #001-1 st NoBob ………

39. Review Bubble IDMarked?Candidate #001-2 nd NoBob #003-2 nd YesBob #007-1 st YesBob #029-2 nd NoAlice #001-1 st YesBob ……… Eperio table instance Just a copy of ballots Independently shuffled Committed Published Columns Right + middle = tally Left + middle = receipt info

40. How is Eperio different? Table structure Commitment scheme Implementation options What does this mean? Speed (10-100x faster) Data download (10-100x smaller) Small code size (50 lines of Python)

41. Bubble IDMarked?Candidate 004 B X Bob 008 B X Alice 007 A X Alice 002 ABob 004 AAlice 008 ABob 002 B X Alice 007 BBob Table structure: a comparison Eperio

42. Verification in a spreadsheet! Bubble IDMarked?Candidate 004 B X Bob 008 B X Alice 007 A X Alice 002 ABob 004 AAlice 008 ABob 002 B X Alice 007 BBob Bubble IDMarked?Candidate 004 B X Bob 008 B X Alice 007 A X Alice 002 ABob 004 AAlice 008 ABob 002 B X Alice 007 BBob

43. Open SSL Implementation options (for audits) Custom codeSmall script + Encryption utility Spreadsheet + Encryption utility Spreadsheet all- in-one?     Eperio 

44. eperio.org Find out more at