End-To-End Verifiable Voting with Prêt `A Voter
Total Page:16
File Type:pdf, Size:1020Kb
End-to-end verifiable voting with Pr^et `aVoter David Bismark Dissertation for the degree of Doctor of Philosophy Computing University of Surrey Department of Computing Declaration This thesis and the work to which it refers are the results of my own effort. Any ideas, data, images or text resulting from the work of others (whether published or un- published) are fully identified as such within the work and attributed to their originator in text, bibliography or in footnotes. This thesis has not been submitted in whole or in part for any other academic degree or professional qualification. I agree that the University has the right to submit my work to the plagiarism detection service Turniti- nUK for originality checks. Whether or not drafts have been so-assessed, the University reserves the right to require an electronic version of the final document (as submitted) for assessment as above. David Bismark October 2010 Cover-5 To Sophie, my beloved wife. And Lotus, the cat responsible for all the topos. End-to-end verifiable voting with Pr^et `aVoter David Bismark University of Surrey UK [email protected] 20th October 2010 Abstract Transparent and verifiable elections can be achieved by end-to-end veri- fiable electronic voting systems. The purpose of such systems is to enable voters to verify the inclusion of their vote in the final tally while keeping the votes secret. Achieving verifiability and secrecy at the same time is hard and this thesis explores the properties of verifiable electronic voting systems and describes a set of developments to the end-to-end verifiable electronic voting system Pr^et`aVoter to achieve these. Acknowledgements I would like to thank everyone at the University of Surrey for a wonderful few years | I had a great time from starting as an undergraduate to now finally managing to leave. First of all thanks to my [insert adjective here before printing thesis] supervisor Dr James Heather who, although far too similar in personality and work ethic to myself, has a hands-off approach to leading that somehow works with my own unwillingness to be led and utter inability to accomplish anything but the unexpected. Thanks to Professor Steve Schneider, especially if it was you who made my doctoral training grant go so far. Thank you Dr Helen Treharne who showed a thorough interest in electronic voting while supervising my MSc project, without that none of this would have happened. Thank you Professor Peter Y. A. Ryan who, although not based at Surrey, has been part of all our innovation and most of my papers would not have existed without your help. Many thanks to Zhe Xia for interesting discussions and access to your vast knowledge. Thank you Dr Vanessa Teague for being one of my examiners and spotting that contrary to public belief, Australia was not around in 1858. Thanks also to Dr Roger Peel for various things, including an encouraging speech that ensured that this thesis got in on time. Thank you Chris Culnane who, adamant he would never do an MSc and then adamant he would never do a PhD, has been the greatest of friends throughout our time together in Guildford. You were adamant you would never be an RA but at least you're now an RA on an electronic voting project. My heartfelt thanks to my beautiful wife Sophie Bismark for encouragement and for giving me her surname (my surname was previously Lundin) so that I could move up in the list of authors. Per unit of time this may well be the most efficient way to advance an academic career and I encourage anyone to give it a go. iii Further acknowledgements I confirm that the work presented in this thesis is my own, with the following exceptions: • In Chapter 3 An implementation of Pr^et`aVoter the work with the implementation was undertaken in a group consisting of James Heather, Roger Peel, Zhe Xia, Phil Howard and myself. My code contribution was specifically in the back-end as I programmed the web bulletin board, tellers, audit machine etc. The writing up of our findings in this chapter is mine, but I am very thankful to the whole group that I could be a part of this excellent project. Our experiences from this project has been published as [13]. • Chapter 6 A human readable paper audit trail originated in an idea I had based on Peter Ryan's existing human-readable paper audit trail [79]. At the time I had this idea, Peter and I were both at Schloss Dagstuhl, that wonderful, creative place. My idea was mainly regarding the linking of the two pages of the ballot form and the auditing properties this resulted in and I am very thankful to Peter for graciously lending the scheme his distributed pre-creation of the onions as well as the cryptographic detail of the scheme. The scheme detailed in this chapter has been published as [54]. • Chapter 7 Remote voting using paper-based schemes has its origin in an idea that Stefan Popoveniuc had and that we also discussed at Dagstuhl. Our thoughts on the subject went through a number of iterations and was eventually published as [69]. It is now hard to say exactly where the details come from so I would like to thank Stefan very much for developing these ideas with me. v Contents Table of Contents v 1 Introduction to Electronic Voting 3 1.1 End-to-end verifiability . .3 1.2 Contents . .4 1.3 Disposition . .5 2 State of the art 7 2.1 Introduction . .7 2.1.1 Security properties . .7 2.1.2 Using cryptography to achieve end-to-end verifiability . .7 2.2 Elections . .8 2.2.1 History of secret ballots . .8 2.2.2 Methods . .9 Plurality voting and first past the post (FPTP) . .9 Single Transferable Vote (STV) . 10 Alternative vote (AV) or instant-runoff voting (IRV) . 11 Range voting and approval voting . 11 2.2.3 Desired properties . 12 Individual verifiability . 13 Public verifiability . 14 Eligibility verifiability . 15 End-to-end verifiability . 15 Fairness . 16 Integrity . 17 Secrecy (aka Privacy) . 18 Receipt-freeness . 19 Coercion resistance . 20 The relationship between Secrecy, Receipt-freeness and Coercion resistance . 21 Robustness . 21 2.2.4 Stages . 22 Set-up phase . 22 Registration phase . 23 Voting phase . 23 Tallying phase . 23 vii Contents 2.2.5 Threats . 23 The coercer . 24 The trusted party . 24 The malicious voter . 25 2.3 Cryptography . 25 2.3.1 RSA . 26 2.3.2 Elgamal . 26 Generating a key pair . 27 Encryption . 27 Decryption . 27 Re-encryption . 28 Threshold Elgamal . 28 2.3.3 Paillier . 29 2.3.4 Digital signatures . 29 2.3.5 Threshold cryptography . 29 2.3.6 Mix networks . 30 Decryption mix networks . 30 Re-encryption mix networks . 32 Random partial checks (RPC) . 33 2.3.7 Zero-knowledge proofs . 33 2.4 Paper based electronic voting schemes . 34 2.4.1 Chaum's visual cryptography system . 34 2.4.2 Pr^et`aVoter . 35 The ballot form . 35 Voting ceremony and verifying the vote . 36 Pr^et`aVoter 2005 . 36 Pr^et`aVoter 2006 . 37 2.4.3 Punchscan . 39 The ballot form . 39 Voting ceremony . 40 Meeting of officials and the diskless workstation . 40 The mixing scheme and its initial audit . 43 The decryption of the votes . 45 2.4.4 Scantegrity . 46 The ballot form . 47 The voting ceremony and voter verifiability . 48 Challenging the election . 48 Discussion . 49 2.4.5 Scantegrity II . 49 The ballot form . 50 The voting ceremony . 50 Publishing auditing information . 50 Auditing a vote and resolving disputes . 51 Discussion . 51 viii Contents 2.4.6 Scratch & Vote . 51 The ballot form . 51 The onion . 52 The voting ceremony . 52 Auditing a ballot form . 53 Tabulation . 53 Discussion . 54 2.4.7 Problems in paper-based electronic voting schemes . 54 Authority knowledge . 54 Chain of custody . 55 Chain voting . 55 Randomisation attack . 56 Denial of service attack . 57 The Italian attack . 57 Everlasting privacy . 58 3 An implementation of Pr^et`aVoter 61 3.1 Introduction . 61 3.2 Requirements . ..