Fully Auditable Electronic Secret-Ballot Elections
Total Page:16
File Type:pdf, Size:1020Kb
Internet Technology Fully Auditable Electronic Secret-Ballot Elections Berry Schoenmakers “What could be easier than counting a bunch of votes!” is a natural thought when one first thinks of the problem of electronic voting. It does not seem very hard either to build an Internet-based system which enables people to vote conveniently from their PCs, WAP phones, or other personal devices. The problem gets much more difficult, however, if one wants to address ballot se- crecy in a serious way. The challenge then is to guarantee voters’ privacy and integrity of the election result at the same time. In this paper we show how special-purpose cryptographic protocols help to achieve this goal. Introduction code. Digital signatures can be used as a more ad- vanced form of authentication, as we will see later on in this paper. The apparent simplicity of electronic voting sys- tems is probably the reason for the large number of For Internet-based elections another simple security initiatives in this area. The Internet provides an ex- measure is to use a secure web server for collecting cellent environment for quick polls, which are easy the votes. In that case, the communication between to implement especially if people need not be pre- the voter’s client and the web server is protected vented from voting more than once. Cookies are by a protocol such as SSL (Secure Socket Layer). sometimes used by web servers to prevent inexpe- Once the communication between client and server rienced users from voting more than once, but this is protected by SSL, the information necessary for line of defense is easily circumvented: users may casting a vote (possibly including software such as simply remove the cookies, or set their browser to a Java applet) may be downloaded securely to the use ‘per-session cookies’ only—which is a good client, and the vote and authentication information idea anyway if one cares about privacy—and so on. may be uploaded securely to the server. The use Even inexperienced users will quickly realize that of SSL thus prevents the votes from being read or they should be able to cast multiple votes by using altered when traveling over the Internet. different computers. Recently, from March 7th to 11th 2000, the Ari- A more serious election will require people to first zona Democratic Party ran such an Internet-based register as a voter. The goal of the registration pro- election for its Presidential Preference Primary. The cess is to give each eligible person a unique iden- election involved several thousands of online voters, tity. Double voting is then prevented simply by ac- see [2]. The voting system has not been certified cepting at most one vote per identity. Clearly, there by the State of Arizona, however, since the election must also be a mechanism to authenticate the use was internal to the Democratic Party. For such a of such an identity. For this purpose a PIN code is system to be used in elections for public officials, sometimes used such that a vote is only accepted for such as the upcoming U.S. presidential elections in a given identity if it comes with the matching PIN November, the system needs to be certified by the July 2000 5 states where it is used. Next consider the situation described in Table 2. A major impediment to government certification of This time to encode a ‘no’ vote, the voter picks a such Internet-voting systems is that these systems random natural number of a sufficiently large size ! fail to satisfy the following two basic requirements: and sends to server and to server . For a " #%$ ‘yes’ vote, the voter sends to server and Ballot Secrecy To protect the voters’ privacy, only to server & . As a result, the individual views of the the voter may know which vote he/she cast. & servers (columns " and in Table 2) contain no Even when the system is audited (or, moni- information about the individual votes. However, tored), all voters should have their privacy pro- by adding the totals for the columns we still get tected. ('*)*+*,-#.'*)*,*$0/21 , which is the desired election Auditability The election results should be verifi- result. (Of course, it must be prevented that for in- able to independent observers (or any interested " #-$*1*+*, stance Alice sends ($*1*+*3 to server and party, for that matter). This means that it is pos- to server & , but we are not concerned with that in sible to check unambiguously that the published this example.) election result corresponds to the ballots cast by legitimate voters. We claim that achieving both of these properties at the same time is impossible when using a single Bulletin Board Model server (or rather a single party) to count the votes. Only by using multiple servers we are able to solve The example in the introduction shows the power this fundamental problem. of using multiple servers, or rather multiple talliers, to distribute the tallying of the votes. The example vote also shows that if both talliers collude they are still Alice yes 1 able to find every voter’s vote. Therefore, the actual Bob no 0 system involves a larger number of talliers such that Carol yes 1 Diane no 0 we may trust at least some of them not to collude. total 2 For instance, we could have a representative of each Table 1: One server learns all the voters’ votes. (major) Dutch political party, representatives of or- ganizations such as the Consumentenbond, and so Let us consider a very simple example to provide on. In this way we achieve a form of distributed some intuition why using multiple servers is use- trust. ful. First consider the situation described by Ta- The idea of distributed trust is incorporated in the ble 1. Each voter must choose between ‘yes’ and bulletin board model, a paradigm for verifiable elec- ‘no’, which are encoded as 1 and 0, respectively. tions set forth by Benaloh et al. (e.g., see [7, 6, 4]). Since the server must check whether the voter is al- Another important aspect of the model is that the lowed to vote, the server learns the identity of the bulletin board is assumed to behave as a broadcast voter. And, since the server must be able to count channel such that everybody is able to see what is the votes, the server learns the individual votes as posted in the bulletin board. well. Hence, there is no privacy, unless we are will- To discuss the bulletin board model we distinguish ing to trust this single server. four types of roles in the election process. ¢¡ ¤£ vote Officers operate the bulletin board server itself. ¦¨ Alice yes ¥§¦©¨ Voters cast their votes by sending electronic ballots ¦ Bob no ¥§¦© to the bulletin board. ¦ Carol yes ¥§¦ Talliers assist in computing the final tally from all ¦ Diane no ¥§¦© ¦ total ¥ correctly submitted ballots. £ Table 2: Two servers ¢¡ and learn none of the voters’ Scrutineers check whether the final tally corre- votes, unless they collude. sponds to the correctly submitted ballots. 6 XOOTIC MAGAZINE A person may play several roles during the same board. election. For example, each member of a nation’s 2. The officers freeze the contents of the voters’ parliament may play the role of voter, tallier, and sections on the bulletin board, and accumulate scrutineer at the same time. For large-scale elec- the valid ballots. tions, however, there are many more voters than tal- 3. The talliers produce their sub-tallies. liers, and the role of scrutineer is probably limited 4. The officers freeze the contents of the talliers’ to a small set of observers. Still, any interested party sections on the bulletin board. The final tally as other than the official observers is also able to play computed from the sub-tallies is also included. the role of scrutineer. 5. The scrutineers read the complete contents of Without going into cryptographic details at this the bulletin board, and check point, we may now outline the steps taken by a vot- 4 that all and only valid ballots are counted, ing system in the bulletin board model. and Before an election is conducted, the following steps 4 that the valid sub-tallies correspond to the are executed. final tally published on the bulletin board. 1. The officers do all the necessary preparations for The tricky part is in the way the scrutineers can do the election: their job without compromising the privacy of the (a) One or several bulletin board servers are set individual votes. Note that, unlike in some other up. In particular, this includes the genera- systems, voters are not anonymous when they cast tion and certification of public keys for these their votes. Instead it is kept secret what they are servers. voting throughout the entire election. Since the vot- (b) The officers determine the deadlines for the ers have to identify themselves as part of the vot- various phases of the election. ing protocol it is easy to prevent double voting. (c) The officers determine the list of eligible Also one knows exactly who voted and who didn’t, voters. which is useful in countries like Belgium where (d) The officers determine the list of talliers. people get a penalty if they don’t cast a vote. (e) The above information is distributed to all relevant parties. 2. The talliers register their public keys with the Cryptographic Protocols bulletin board. To achieve privacy and auditability it does not suf- 3. Eligible voters register their public keys with the fice to combine some off-the-shelf digital signatures bulletin board.