1. Secret Ballot Receipts True Voter-Verifiable Elections Richard Carback Kevin Fisher Sandi Lwin CMSC 691v April 3, 2005

3. Introduction System Features Magic receipt Vote visible in voting booth Vote invisible, verifiable outside voting booth Trusted voting machines unnecessary Provisional ballots are ballots, too Vote from anywhere Adjudicate today, adjudicate tomorrow Deeper, more restful sleep Eliminates common indoor allergens Even pet dander! Boosts gas mileage up to 13%

4. System from Voter’s Perspective Input with touch screen or other input means Register printer generates printout List names of candidate party affiliations office sought others

5. System from Voter’s Perspective Print votes before the final inch Printer prints simultaneously both layers Review printout Indicate layer to keep Printer prints final inch

6. System from Voter’s Perspective Printer cuts both layers off, still laminated together and releases them Neither layer readable on its own Light passing through sandwiched layers without printings on either layers makes choices visible

7. Example of Ballot Printout Figure 1. An example part of a ballot printout listing a candidate selected. In addition to being able to include the candidate’s name, party affiliation, and office sought, the printout can also include other types of contests and various graphics options.

8. Example of Final Inch Together Figure 2. Last inch of the printout before the two laminated layers are separated.

9. Final Inch Separated Figure 3. Last inch of the printout after it’s separated: (a) the receipt (the layer the voter selects to keep) and (b) the layer that’s shredded before the voter leaves the polling place.

10. Leaving the Polling Booth Voter gives up the layer marked for surrender Layer gets shredded by poll worker Same layers get shredded “electronically” Only physical layer voter kept and digital version of that same image remains

11. Election Web Site Enter receipt’s serial # to check vote has been counted Print image on website and check against the actual receipt

12. Resistance to Attack Posted Receipt == Proper Tabulation (Most likely) Votes are private (unless code is broken) Malicious Software can only hope: –user will choose one layer –noone will check serial numbers –tally will not be audited

13. Weaknesses to Attack Subliminal Channels Selectively Malicious DRE Discarded Receipts Malicious Tally Software

14. Visual Cryptography 101 Typography + = Newsprint e + = Ballot Receipt

15. Visual Cryptography 101 Pixels NewsprintBallot Receipt = 0 = 1 01 = = = = 0 0 1 1 0 1 0 1 0 1 1 0         = = = =

16. Visual Cryptography 101 Message Encoding + = Random White Sheet = + ][ +

17. Visual Cryptography 101 White Sheet Vulnerability Single encoded message yields multiple plaintext images.

18. Visual Cryptography 101 Mixing Red and White Sheets + = = +

19. Tabulation All receipts are posted Each trustee decodes a batch Batches randomized to protect privacy

20. Russian Nesting Dolls Voted Ballot == Set of dolls (or one big doll) Each trustee opens one size of dolls Smallest doll is plaintext ballot

21. Coded Sheets How you do this with computers Big doll is the summation of the smaller permutations Each trustee subtracts their permutation mod 2 Original permutation revealed at smallest doll

22. Tabulation Integrity Need to maintain privacy Each trustee is video-taped doing 2 batches 1 tape is released –chosen afterwards (auditor or political parties)

23. Formal Receipt Process Voting Phase – Step 1  Ballot image B President: Lincoln Senator: Kennedy milk eggs LINCOLN General Election Senator: President: KENNEDY Ballot Number 8675309 Separate layers before leaving booth. Plaintext receipt

24. Formal Receipt Process Voting Phase – Step 2  Printed 4-tuples Ballot Number 8675309 Separate layers before leaving booth. General Election q: serial number L Z : ballot layer D t : top doll D b : bottom doll Ballot Number 8675309 Separate layers before leaving booth. General Election   

25. Formal Receipt Process Voting Phase – Step 3 Visual XOR function LINCOLN General Election Senator: President: KENNEDY Ballot Number 8675309 Separate layers before leaving booth.  = Mathematical XOR function

26. Formal Receipt Process Voting Phase – Step 5 Bottom layer: x=b Ballot Number 8675309 Separate layers before leaving booth. General Election Ballot Number 8675309 Separate layers before leaving booth. General Election Top layer: x=t  

27. Formal Receipt Process Voting Phase – Step 5 Bottom layer: x=b Seed: s x (q) Ballot Number 8675309 Separate layers before leaving booth. General Election    Overall: o x (L x,q,D t,D b,s x (q)) “Last Inch” Digital Signature

28. Formal Receipt Process Voting Phase – Step 6 Part 1 s x (q) Ballot Number 8675309 Separate layers before leaving booth. General Election Consistency Check (s x ) -1 hash q

29. Formal Receipt Process Voting Phase – Step 6 Part 2 s x (q) Ballot Number 8675309 Separate layers before leaving booth. General Election o x (L x,q,D t,D b,s x (q)) Consistency Check (o x ) -1 hash q hash DbDb DtDt LxLx

30. Formal Receipt Process Red and White Matrices Ballot Number 8675309 Separate layers before leaving booth. General Election m n n/2 WZWZ RZRZ

31. Formal Receipt Process Red and White Matrices Ballot Number 8675309 Separate layers before leaving booth. General Election Ballot Number 8675309 Separate layers before leaving booth. General Election Top LayerBottom Layer W t = L t i,[2j – ([i+1] mod 2)] R t = L t i,[2j – (i mod 2)] R b = L b i,[2j – ([i+1] mod 2)] W b = L b i,[2j – (i mod 2)] WtWt RtRt RbRb WbWb

32. Formal Receipt Process Red and White Matrices Ballot Number 8675309 Separate layers before leaving booth. General Election Ballot Number 8675309 Separate layers before leaving booth. General Election Top LayerBottom Layer B x = R x  W y WtWt RtRt RbRb WbWb

33. Formal Receipt Process Cryptographic Pseudorandom Number Generators Ballot ID Key 12345 Ciphertext AES 12346 1010100..10 0100111..00 N bits

34. Formal Receipt Process Calculating the Noise Matrix W Z i,j = (d Z k  d Z k-1  …  d Z 1 ) [mj–m]+1 d Z k = h ’ (d ’Z k ) d ’Z k = h(s Z (q), k) s Z (q) Pseudorandom sequence h’h d Z k = 101010..110 k Cryptographic pseudorandom number generators m*n/2 bits W Z i,j = 101101 010010 110110.. n/2 m

35. Formal Receipt Process Doll Construction d ’Z k = doll k s Z (q) Pseudorandom sequence h’h d Z k = 101010..110 k Cryptographic pseudorandom number generators d ’Z 1 )e1(e1(e 2 (d ’Z 2,))D Z k = e k (d ’Z k, …

36. Formal Receipt Process Tally Phase: Doll Processing D L-1 DLDL dLdL DLDL dLdL d’ L-1 eLeL h’ d’ L-1 d L-1  D L-1 d L-1 d Z L-1 = h ’ (d ’Z L-1 )

37. Formal Receipt Process Tally Phase: Auditing Stagekk-1k-2k-3k-4 Audit batches

38. Formal Receipt Process Tally Phase: Auditing Stagekk-1k-2k-3k-4 Audit batches

39. Cryptography Computationally secure –breakable with enough computing power applied Unconditionally secure –cannot be broken even with applying infinite computing power

40. Cryptography Receipt system uses: –Computationally secure encryption to form layers Digital signatures: –last inch contains digital signature for authentication –scanners used to verify signature

41. Cryptography Privacy –Protects privacy using computationally secure encryption.

42. Cost of System Reduces cost of integrity while raising its level dramatically Hardware cost lower than current black box system –Government buy at price of open platform PC Cost of suitable printers in volume is less than hardware cost saving Savings in maintenance and upgrades

43. Similarities in Punchscan Splitting the ballot is the same idea –Destroy half the information Tabulation is more complicated, but similar to that of Punchscan –privacy is kept in a similar manner (only choose half of the process to look at)

44. Similarities in Punchscan Definitely an advancement Has some security problems at the system level –not insurmountable Kind of complicated Not expandable –rank-order would be hard –Not the most scalable