Scantegrity: Enditoiend Voteriverifiable
Total Page：16
File Type：pdf, Size：1020Kb
E-voting Scantegrity: end-to-End Voter-Verifiable optical- Scan voting Scantegrity is a security enhancement for any optical scan voting system. It lets voters verify that their ballots were correctly recorded and counted, but doesn’t change how voters mark their ballots. DAVID CHAUM oter confidence in the US electoral process lot format—for is eroding as a steady stream of reports con- example, Punch- ALEKS ESSEX tinue to expose fundamental security flaws scan ballots4 require two sheets of paper, and Prêt à University of in certified electronic voting machines.1,2 Voter ballots5 randomize candidate name order. Ottawa VSimilar voting technology is used outside of the US, The Scantegrity voting system combines E2E and resistance to electronic voting has spread to other systems’ cryptographic ideas with the familiarity of RICHArd democracies. Although proposals such as stricter de- a widely used vote-counting system. It thus provides CARBACK sign standards, more open systems (preferably open the strong security guarantees of E2E systems but is AND ALAN source), and independent verification methods (such unobtrusive to the voter, has a minimal cost for wide- SHERMAN as paper audit trails) are improvements, they don’t go scale deployment, and doesn’t interfere with existing University of far enough. In any voting system, with or without procedural requirements such as paper audit trails and Maryland, an electronic component, the core security problem is manual recounts. Scantegrity is designed for use with Baltimore chain of custody. An attacker who breaks chain of cus- optical scan voting systems, which are the most wide- County tody could stuff the ballot box, delete or switch votes, ly used election technology in the US and are being or add votes to contests that the voter left empty. adopted in other countries as well.6 Scantegrity can be JEREMY CLARK Whether the attacker accomplishes this by inserting readily deployed in precincts with existing optical scan University of malicious code or altering paper ballots, such attacks systems because it adds minimal requirements to the Waterloo go undetected even with a manual vote recount. underlying optical scan process and doesn’t introduce Recently proposed end-to-end (E2E) verification any new polling place equipment. It only requires ex- STEFAN voting systems have focused on minimizing voting tra information to be printed on the ballots during POPOVENIUC systems’ reliance on chain of custody.3 These E2E production and system access to the raw scan results AND POORVI systems typically provide cryptographic checks indi- after the election. In summary, Scantegrity minimally VORA cating that ballots have been recorded as cast and tal- impacts election procedures and is the first indepen- The George lied as recorded. Voters can check that their votes are dent E2E verification mechanism that preserves opti- Washington recorded accurately using a receipt, and any observer cal scan as the underlying voting system and doesn’t University can verify that the tally is correctly constructed, all interfere with a manual recount. without compromising ballot secrecy. In these sys- tems, any chain-of-custody break causes a detectable Independent E2E alteration of the public record. In particular, erroneous verification voting systems voting machine software or voting machine malfunc- E2E systems, sometimes called receipt-based or uni- tion doesn’t dilute the voting systems’ integrity. How- versally verifiable voting systems, don’t derive security ever, using these systems in real elections has been a from any specific type of voting equipment. Instead, challenge. They typically require a special type of bal- they generally produce an encrypted representation of 40 PUBLISHED BY THE IEEE COMPUTER SOCIETY ■ 1540-7993/08/$25.00 © 2008 IEEE ■ IEEE SECURITY & PRIVACY E-voting ballot choices that functions as a receipt. This receipt 1234 doesn’t reveal the voter’s identity or choices, so the 1234 A voter can take home a signed or stamped copy of his Choose one: Choose one: or her receipt. Election officials publicly post the re- B Alice B Alice ceipts of all the ballots they received, and voters can check this record to see that their ballot was included A Bob A Bob and is unmodified. If a voter’s receipt doesn’t appear or was modified, the signature or stamp on the receipt gives the voter proof of a discrepancy that he or she Figure 1. The Scantegrity ballot. Scantegrity uses an optical scan ballot with can use to dispute the record. randomly assigned code letters next to each choice. The perforated chit Election officials can only decrypt the receipts to in the corner contains a serial number written in human- and computer- recover the final tally by using a method that hides readable forms. which decrypted ballots correspond to which receipts. They then perform a mandatory audit to prove math- ematically that the public record was decrypted prop- also make a copy of the receipt and give it to third par- erly and that the votes were unmodified—whether ties, who can also check the public record. The more by a software error, the election officials, a hacker, or receipts checked, the higher the chance of detecting a some other entity. Any independent party can author problem with the public record.11 the software used to verify the election outcome using Correct letters indicate to voters that the officials a public specification. Under this model, we expect properly scanned and recorded their votes. However, that several independent entities will make their soft- if the public record contains a letter that’s different ware tool version freely available to the public, miti- from what a voter recorded, the voter can challenge gating the issue of software error. the record through a dispute-resolution process. Other E2E systems include VoteHere’s Mark- Pledge,7,8 Votegrity,9 Punchscan,4 Prêt à Voter,5 and Dial “0” Voter Initiated Auditing.10 Scantegrity is closely re- for independent verification lated to Punchscan, but unlike its predecessors, it can Anyone can use the public record to verify the tally— also serve as an add-on to existing voting technol- that is, that the results were counted as recorded. Tally ogy without interfering with the underlying system’s verification is challenging because the system must not tabulation procedures or paper audit trails. It also uses directly reveal the links between code letter and candi- a new, simpler mechanism to replace the basic vote date to preserve ballot secrecy. tallying mechanism of other E2E schemes. Although Scantegrity isn’t the first system to pro- vide counted-as-recorded integrity verification,4,5,7–9 Voter experience its solution is the simplest. The importance of solution The voter experience in Scantegrity is identical to simplicity can’t be overemphasized in voting—it lets that of regular optical scan systems (that is, the voter the widest possible audience understand how the vot- marks the optical scan ballot and feeds it into an opti- ing system works. cal precinct scanner), except the voter can take home Some E2E solutions use a mix network12 to cre- a privacy-preserving receipt. To create the receipt, a ate an anonymous but verifiable link between receipt voter tears off a perforated corner of the ballot, called and vote. The mix network applies a cryptographic a ballot chit, that contains a serial number. In addition, operation at each node to obscure the path of mes- as Figure 1 shows, the voter writes down the random- sages through the network. This is especially im- ly assigned code letter listed next to the selected can- portant for identifiable (that is, unique) data such as didate. Note that in the ballot in Figure 1, the letter email messages. Some E2E systems provide encrypted A is beside Bob’s name, but it might be beside Alice’s information on the ballot receipt (this information is name on other ballots. Thus, knowing that someone sometimes called an “onion”) to let the mix network voted for a particular code letter doesn’t tell you which perform the correct cryptographic operations to count candidate that person voted for. the vote correctly. Punchscan, Scantegrity’s direct an- After the underlying optical scan system tallies the cestor, uses a simplified two-stage mix network with election results, election officials post a public record efficient cryptographic operations. It also doesn’t use containing the Scantegrity serial numbers and cho- an onion on the ballot. sen code letters of all the scanned ballots, but not the Election data doesn’t necessarily need to be ex- candidate associated with the letter on each ballot. plicitly encrypted. Under the familiar plurality voting Voters can retrieve this public record, look up their system (also known as “first-past-the-post”), voters serial number, and verify that the code letters they express their intent by making a mark beside their wrote match those in the posted record. Voters can chosen candidate. A cast ballot therefore can be ex- www.computer.org/security/ ■ IEEE SECURITY & PRIVACY 41 E-voting Serial Code voters’ workstation transmits the state of each markable region number letter marks Switchboard Results on each ballot in the election through the switch- Bob A Alice board to votes for the corresponding candidates in 002 Alice B Alice the election results. Finally, the public must be able to verify indepen- Alice A Alice dently that marks are being transmitted to the correct 005 Bob B Alice candidate without exposing both of the circuit’s end points (receipt and vote). Alice A Bob 007 Bob B Bob Auditing the switchboard To ensure voter confidence in the switchboard’s Bob A Bob 008 ability to produce a correct tally, Scantegrity must Alice B Bob reveal some information for verification purposes.