Individual Verifiability in Electronic Voting
Total Page:16
File Type:pdf, Size:1020Kb
Individual Verifiability in Electronic Voting Sandra Guasch Castell´o Universitat Polit`ecnicade Catalunya Supervisor: Paz Morillo Bosch 2 Contents Acknowledgements 7 Preface 9 1 Introduction 11 1.1 Requirements of electronic voting . 12 1.2 Electronic voting basics . 13 1.2.1 Basic approach . 13 1.2.2 Pollsterless or code voting . 14 1.2.3 Two agencies model . 16 1.2.4 Homomorphic tally systems . 17 1.2.5 Mixnet-based systems . 18 1.3 Cryptography introduction . 20 1.3.1 Symmetric key encryption schemes . 20 1.3.2 Public key encryption schemes . 21 1.3.3 Security notions for encryption schemes . 23 1.3.4 Homomorphic public key cryptosystems . 25 1.3.5 Signature schemes . 25 1.3.6 σ-protocols and proof schemes . 26 1.4 Motivation, organization and contributions of this work . 31 1.4.1 Motivation . 31 1.4.2 Organization and contributions . 32 2 Individual verifiability 35 2.1 Introduction . 35 2.2 Challenge-or-cast . 37 2.3 Verifiable Optical Scanning . 42 2.4 Verification with codes . 48 2.4.1 Code voting . 49 2.4.2 Return Codes . 52 2.5 Hardware-based verification . 55 2.6 Decryption-based verification . 57 3 Electronic Voting Model 59 3.1 Introduction . 59 3.2 Protocol Syntax . 59 3.3 Security Definitions . 63 3 4 CONTENTS 3.3.1 Trust model . 63 3.3.2 Ballot privacy . 64 3.3.3 Strong Consistency . 66 3.3.4 Strong Correctness . 67 3.3.5 Cast-as-Intended verifiability . 67 3.3.6 Coercion-resistant cast-as-intended . 69 4 Return Codes with Single Voting: Neuch^atel'sScheme 71 4.1 Introduction . 71 4.2 Improving the Norwegian solution . 72 4.2.1 Solution Overview . 74 4.3 Confirmation Phase . 75 4.4 Protocol description . 76 4.4.1 Workflow . 80 4.5 Security of the Protocol . 81 4.5.1 Ballot Privacy . 82 4.5.2 Strong Consistency . 84 4.5.3 Strong Correctness . 85 4.5.4 Cast-as-Intended Verifiability . 85 4.5.5 Coercion-resistant cast-as-intended . 86 4.6 Protocol implementation . 86 4.6.1 Performance . 87 4.7 Authentication, usability and correctness: implementation details . 89 4.7.1 Authentication and private keys provision . 89 4.7.2 Short Return Codes . 90 4.7.3 Vote correctness . 92 4.7.4 Ballot Box vs Bulletin Board . 93 4.8 Protocol extensions . 94 4.8.1 Supporting multiple entry points . 94 4.8.2 Distributed return code generation . 94 4.8.3 Support for multiple voting . 99 4.8.4 Assignation of verification cards . 99 5 Challenge-and-cast 101 5.1 Introduction . 101 5.2 Overview . 101 5.3 Related work . 102 5.4 Proof simulation . 103 5.4.1 A simulatable NIZK proof using chameleon hashes . 105 5.4.2 Simulatable NIZKPK scheme properties . 106 5.5 Core Protocol using Mixnets . 107 5.5.1 Security of the Protocol . 112 5.5.2 Concrete instantiation . 117 5.5.3 Performance . 119 5.6 Protocol for homomorphic tally-based systems . 119 5.6.1 Security Analysis . 120 5.6.2 Primitives . 120 CONTENTS 5 5.7 Multiple Trustees . 122 5.8 Voting Scheme . 123 5.9 Protocol extension for multiple voting . 125 6 Making Cast-as-Intended Universal 127 6.1 Introduction . 127 6.2 Motivation . 127 6.3 UCIV System description . 128 6.3.1 Overview . 128 6.3.2 Syntactical definition . 130 6.3.3 Security definitions . 132 6.4 Protocol based on NIZK proofs . 136 6.4.1 Protocol description . 136 6.4.2 Security analysis . 138 6.4.3 Implementation . 139 6.5 UCIV with return codes . 140 6.5.1 Overview of the solution . 140 6.5.2 Protocol description . 140 6.5.3 Security Analysis . 142 6.5.4 Implementation . 146 6.5.5 Extension to multiple voting . 147 6.6 Distributed generation of UCIV information . 147 6.7 Setup . 149 7 Conclusions 151 6 CONTENTS Acknowledgements I would like to thank my family and friends, who have being very patient with me and supportive while I was writing this thesis. I would also like to thank my colleagues at work, who have provided a lot of useful comments, specially when opining about the drawings! My English teacher, Ryan Jones deserves a special mention. He bravely read all the document and reviewed my English without crying or falling asleep (at least this is what he said) in a week. He is the best! A special thanks to my supervisor Paz Morillo, who is the most dynamic person I know, who has been always confident that I could do this, and who has helped me a lot, specially during the last months. My boyfriend, Guillem, took care that I did not starve during the last months while I was working full time and also writing this thesis. Thanks a lot! Thanks also to my external reviewers, Rolf Haenni and Francesc Seb´e,who provided great comments to this text. Finally, I would like to thank Jordi Puiggal´ıand Alex Escala, with whom I have make most of the research in this thesis. Working with you is great, and I hope I will continue doing it in the future. 7 8 CONTENTS Preface This PhD Thesis is the fruit of the job of the author as a researcher at Scytl Secure Electronic Voting, as well as the collaboration with Paz Morillo, from the Depart- ment of Applied Mathematics at UPC and Alex Escala, PhD student. In her job at Scytl, the author has participated in several electronic voting projects for national-level binding elections in different countries. The participa- tion of the author covered from the protocol design phase, to the implementation phase by providing support to the development teams. Since her participation on the Norwegian project (2009-2011), which pioneered the use of verifiable electronic voting systems on binding elections, the author has specialized in individual verifiability, which englobes the processes that can be done by the voter, in order to check that the system works correctly. Part of the author's work at Scytl has been to continue with the experience of the design and development of the electronic voting system used in Norway, and improve it. The result has been implemented and already been used in 2014 and 2015 elections in Neuch^atel,and it is planned to be used in the next years. The analysis of existing protocols, as well as the design of new ones, fulfilling the requirements of the different projects executed at Scytl, made the author realise that there is not a gold solution for everyone, when it comes to individual verifiability. This is due to the fact that the trust assumptions that can be made are different in each project or setup, and that individual verifiability strongly defines how the voter is going to interact with the system. For the latter, customers / electoral commissions may have very specific requirements, for example given their traditional voting process. Therefore, this thesis also contains proposals which did not emerge from the projects conducted at Scytl, but from the need of both the market and the academia of new protocols with new properties, and which work under different trust assump- tions. These proposals are intended to be a contribution to the state of the art of individual verifiability, both in academic and industrial environments, as well as being the basis for new systems that may be implemented in the future. In summary, this thesis has to be seen as the fruit of industrial research, while also contributing to the academic state of the art. 9 10 CONTENTS Chapter 1 Introduction Electronic voting systems have been around for a long time. The first optical scanners were first used in 1962, and Direct Recording Electronic Voting Machines (DREs) were introduced in 1975. Complex, time-consuming and error-prone count- ing processes have been made faster, easier and more reliable with electronic mech- anisms. New technologies also provide aids for disabled voters to independently cast a vote, and for regular voters to fill-in complex ballots without errors. Logistic costs derived, for example, from handling multiple-language ballots, long-term costs, or the time needed for setting up an election can also be reduced using electronic means. With the rise of Internet, and later on the widespread use of intelligent portable devices (such as smart phones) in our daily life, we have become used to performing a large proportion of our transactions remotely and at any time. Although, in more or less measure, the existence of attacks inherent to the remote nature of the Internet is known by everybody (identity impersonation, interception or observation of our communications, website impersonation or phishing, access to personal data, etc.), and this fact does not inhibit for the provision of multiple online services, some of them as sensitive as banking, paying taxes or buying flight tickets. One could say that the advantages overcome the drawbacks. Therefore, the implementation of Internet voting naturally emerges, together with other e-government solutions which are aimed to bring the administration closer to the citizens, and collaborates to improve the welfare of the society. Internet voting cannot only enable increased participation due to its convenience, but also provides the opportunity of voting to collectives which may otherwise not be able to vote: people who are abroad during the election day, military located in conflict regions, embarked fishermen, or people with decreased mobility due to disabilities. Usually, voters who cannot go to a polling station on election day can use the postal mail channel to cast their voters.