Votebox: a Tamper-Evident, Verifiable Electronic Voting System
Total Page：16
File Type：pdf, Size：1020Kb
VoteBox: a tamper-evident, verifiable electronic voting system Daniel Sandler Kyle Derr Dan S. Wallach Rice University {dsandler,derrley,dwallach}@cs.rice.edu Abstract many states are now decertifying or restricting the use of DRE systems. Commercial electronic voting systems have experienced Consequently, DREs are steadily being replaced with many high-profile software, hardware, and usability fail- systems employing optical-scan paper ballots. Op-scan ures in real elections. While it is tempting to abandon systems still have a variety of problems, ranging from ac- electronic voting altogether, we show how a careful ap- cessibility issues to security flaws in the tabulation sys- plication of distributed systems and cryptographic tech- tems, but at least the paper ballots remain as evidence niques can yield voting systems that surpass current sys- of the voter’s original intent. This allows voters some tems and their analog forebears in trustworthiness and us- confidence that their votes can be counted (or at least re- ability. We have developed the VoteBox, a complete elec- counted) properly. However, as with DRE systems, if er- tronic voting system that combines several recent e-voting rors or tampering occur anywhere in this process, there is research results into a coherent whole that can provide no way for voters to independently verify that their ballots strong end-to-end security guarantees to voters. VoteBox were properly tabulated. machines are locally networked and all critical election Regardless, voters subjectively prefer DRE voting sys- events are broadcast and recorded by every machine on tems [15]. DREs give continuous feedback, support many the network. VoteBox network data, including encrypted assistive devices, permit arbitrary ballot designs, and so votes, can be safely relayed to the outside world in real on. Furthermore, unlike vote-by-mail or Internet voting, time, allowing independent observers with personal com- DREs, used in traditional voting precincts, provide privacy, puters to validate the system as it is running. We also protecting voters from bribery or coercion. We would ide- allow any voter to challenge a VoteBox, while the election ally like to offer voters a DRE-style voting system with ad- is ongoing, to produce proof that ballots are cast as in- ditional security properties, including: tended. The VoteBox design offers a number of pragmatic 1. Minimized software stack benefits that can help reduce the frequency and impact of poll worker or voter errors. 2. Resistance to data loss in case of failure or tampering 3. Tamper-evidence: a record of election day events that can be believably audited 1 Introduction 4. End-to-end verifiability: votes are cast as intended and counted as cast Electronic voting is at a crossroads. Having been aggres- sively deployed across the United States as a response The subject of this paper is the VB, a complete to flawed paper and punch-card voting in the 2000 U.S. electronic voting system that offers these essential prop- national election, digital-recording electronic (DRE) vot- erties as well as a number of other advantages over exist- ing systems are themselves now seen as flawed and un- ing designs. Its user interface is built from pre-rendered reliable. They have been observed in practice to pro- graphics, reducing runtime code size as well as allow- duce anomalies that may never be adequately explained— ing the voter’s exact voting experience to be examined undervotes, ambiguous audit logs, choices “flipping” be- well before the election. VBes are networked in a fore the voter’s eyes. Recent independent security reviews precinct and their secure logs are intertwined and repli- commissioned by the states of California and Ohio have cated, providing robustness and auditability in case of fail- revealed that every DRE voting system in widespread use ure, misconfiguration, or tampering. While all of these has severe deficiencies in design and implementation, ex- techniques have been introduced before, the novelty of posing them to a wide variety of vulnerabilities; these sys- this work lies in our integration of these parts to achieve tems were never engineered to be secure. As a result, our architectural security goals. USENIX Association 17th USENIX Security Symposium 349 Notably, we use a technique adapted from Benaloh’s day, possibly erasing votes. More recently, in the Jan- work on voter-initiated auditing [4] to gain end-to-end uary, 2008 Republican presidential primary in South Car- verifiability. Our scheme, which we term immediate bal- olina, several ES&S iVotronic systems were incorrectly lot challenge, allows auditors to compel any active voting configured subsequent to pre-election testing, resulting in machine to produce proof that it has correctly captured those machines being inoperable during the actual elec- the voter’s intent. With immediate challenges, every sin- tion. “Emergency” paper ballots ran out in many precincts gle ballot may potentially serve as an election-day test of and some voters were told to come back later [11]. a VB’s correctness. We believe that the VB ar- All of these real-world experiences, in conjunction with chitecture is robust to the kinds of failures that commonly recent highly critical academic studies, have prompted occur in elections and is sufficiently auditable to be trusted a strong backlash against DRE voting systems or even with the vote. against the use of computers in any capacity in an elec- In the next section we will present background on the tion. However, computers are clearly beneficial. electronic voting problem and the techniques brought to Clearly, computers cannot be trusted to be free of tam- bear on it in our work. We expand on our design goals pering or bugs, nor can poll workers and election officials and describe our VB architecture in Section 3, and be guaranteed to always operate special-purpose comput- share details of our implementation in Section 4. The pa- erized voting systems as they were intended to be used. per concludes with Section 5. Our challenge, then, is to reap the benefits that computers can offer to the voting process without being a prisoner to 2 Background their costs. 2.1 Difficulties with electronic voting 2.2 Toward software independence While there have been numerous reports of irregularities Recently, the notion of software independence has been with DRE voting systems in the years since their introduc- put forth by Rivest and other researchers seeking a way tion, the most prominent and indisputable problem con- out of this morass: cerned the ES&S iVotronic DRE systems used by Sarasota A voting system is software-independent if an County, Florida, in the November 2006 general election. undetected change or error in its software can- In the race for an open seat in the U.S. Congress, the mar- not cause an undetectable change or error in an gin of victory was only 369 votes, yet over 18,000 votes election outcome. [41] were officially recorded as “undervotes” (i.e., cast with no selection in this particular race). In other words, 14.9% Such a system produces results that are verifiably cor- of the votes cast on Sarasota’s DREs for Congress were rect or incorrect irrespective of the system’s implementa- recorded as being blank, which contrasts with undervote tion details; any software error, whether malicious or be- rates of 1–4% in other important national and statewide nign, cannot yield an erroneous output masquerading as a races. While a variety of analyses were conducted of the legitimate cast ballot. machines and their source code [18, 19, 51], the official Conventionally, the only way to achieve true software loser of the election continued to challenge the results independence is to allow the voter to directly inspect, and until a Congressional investigation failed to identify the therefore confirm to be correct, the actual cast vote record. source of the problem [3]. Whether the ultimate cause Since we cannot give voters the ability to read bits off was mechanical failure of the voting systems or poor hu- a flash memory card, nor can we expect them to men- man factors of the ballot design, there is no question that tally perform cryptographic computations, we are limited these machines failed to accurately capture the will of in practice to paper-based vote records, which can be di- Sarasota’s voters [2, 14, 20, 25, 34, 36, 37, 50]. rectly inspected. While both security flaws and software bugs have re- Optical-scan voting systems, in which the voter marks ceived significant attention, a related issue has also ap- a piece of paper that is both read immediately by an elec- peared numerous times in real elections using DREs: op- tronic reader/tabulator and reserved in case of a manual erational errors and mistakes. In a 2006 primary election audit, achieve this goal at the cost of sacrificing some in Webb County, Texas—the county’s first use of ES&S of the accessibility and feedback afforded by DREs. The iVotronic DRE systems—a number of anomalies were dis- voter-verifiable paper audit trail (VVPAT) allows a DRE to covered when, as in Sarasota, a close election led to le- create a paper record for the voter’s inspection and for gal challenges to the outcome [46]. Test votes were acci- use in an audit, but it has its own problems. Adding print- dentally counted in the final vote tallies, and some ma- ers to every voting station dramatically increases the me- chines were found to have been “cleared” on election chanical complexity, maintenance burden, and failure rate 350 17th USENIX Security Symposium USENIX Association of those machines. A report on election problems in the in Section 3 applies the PRUI technique to reduce its own 2006 primary in Cuyahoga County, Ohio found that 9.6% code footprint.