Matters of Coercion-Resistance in Cryptographic Voting Schemes zur Erlangung des akademischen Grades eines Doktors der Naturwissenschaften von der Fakultät für Informatik des Karlsruher Instituts für Technologie (KIT) genehmigte Dissertation von Carmen Kempka (geb. Stüber) aus Karlsruhe Tag der mündlichen Prüfung: 3. Juni 2014 Erster Gutachter: Prof. Dr. Jörn Müller-Quade Zweiter Gutachter: Prof. Dr. Jeroen van de Graaf KIT – University of the State of Baden-Wuerttemberg and National Laboratory of the Helmholtz Association www.kit.edu Acknowledgement On the road which has led to this thesis, I have been inspired, motivated and sup- ported by many people, to whom I am grateful. First of all, I thank my thesis supervisor Prof. Dr. Jörn Müller-Quade, who has inspired me with his contagious enthusiasm for cryptography. I thank him for all his support, advice, patience and tolerance, especially for making it possible that I could bring my son to the office, and for being able to do research in maximal freedom. Many thanks go to Prof. Dr. Jeroen van de Graaf, who corefereed this thesis, for inviting me to join research on the taxonomy project, for invaluable input, and for inspiring discussions in an uncomplicated working atmosphere. Besides, without him, this work would be in much worse English. I express my gratitude to Jun. -Prof. Dr. Dennis Hofheinz, for granting me oracle access to his marvelous knowledge about all kinds of fancy encryption and signature primitives, for sanity-checking my crazy ideas and for all kinds of support. This work would not be what it is without my coworkers Dr. Christian Henrich, Bernhard Löwe and Dirk Achenbach. Thanks for being with me at all those paper deadline night shifts and especially in the thesis last minute panic period, for proof reading, invaluable discussions and feedback. I thank Víctor Mateu for taking away the mystery of pairing based cryptography and elliptic curves, and for helpful and inspiring discussions, especially about the ID-comparison with the Elgamal scheme. Thanks to Sven Krohlas for briefing me about delegated voting. Many thanks to everyone who has made the application of Bingo Voting in the election of the student’s parliament possible, especially Björn Tackmann and Michael Bär. Many thanks to Reiner SCT for providing the chip-card readers and the cus- tomized random number generators for this election. I offer my gratitude to Prof. Dr. Bernhard Beckert and Prof. Dr. Ralf Reussner for inviting me to discuss about my work and for important feedback. This work could be started thanks to Prof. Dr. Jaques Calmet, who welcomed me to IAKS and gave me freedom in my research. I would like to thank Prof. Dr. Thomas Beth (1949-2005), for his inspiring lectures, and for believing in me. Thanks to all my current and former colleagues at IAKS/IKS/EISS/ITI for the enjoyable working atmosphere, especially Hildegart Kühne for her friendship, Thilo Mie for discussions about basically everything, and Florian Böhl, who shared with me the pain and excitement of the last part of the road towards a doctorate. I could feel this enjoyable working atmosphere already as a student thanks to Stefan Röhrich, Dr. Jens-Matthias Bohli, Prof. Dr. Dominique Unruh, Prof. Dr. Rainer Steinwandt, Prof. Dr. Markus Grassl and many more. Thanks for making me feel welcome at IAKS right from the beginning. Special thanks to Jens and Stefan for iii iv the joint work on Bingo Voting improvements, and for motivating me to work on e-voting. For her tireless administrative support I would like to thank Carmen Manietta. No less I thank Holger Hellmuth, especially for not doing that server reboot on the day of my thesis deadline. I also thank Audrey Bohlinger for patiently answering all questions concerning the doctorate procedure. I would like to express my gratitude to Dr. Masayuki Abe for welcoming me to NTT as a postdoc, which gave me a lot of motivation and endurance during the last phase of this work. Thanks to my dear friends Makitaro, Reiko and Momo Arima for counter-balancing my worktime with their wonderful world of music. Not least at all I thank my family. I am in great debt to my parents Walter and Anne Stüber for all their support throughout my life, and especially for being there for my son Jonas. I thank my sister Tanja Mohr and her family Marlon, Luisa and Michael Mohr for all their support. I thank my dear husband Matthias Kempka for his love and all his support, and for shielding me from matters of real-life to give me the freedom and a clear head to finish this work. And I thank my son Jonas Nehemias Kempka for his love and patience, and especially for offering me to skip kindergarten to help me with my work instead. Abstract Electronic voting has gained more and more interest during the last decades. It promises less error-prone and faster tallying, while saving paper as well as working time. On top of this, voters can be supported by a vote casting interface, reduc- ing the amount of ballots which would otherwise be marked invalid unintentionally. Moreover, the introduction of electronic voting introduces the possibility of conduct- ing an election over the internet, which promises to increase voter turnout. However, voting machines do not offer the same obvious transparency as tradi- tional paper elections, since they are complex systems which are hard to verify. It became soon apparent that paper ballots cannot be substituted by computers without additional measures. Cryptographic voting schemes offer the possibility of publicly verifiable elections. This verifiability depends on cryptographic techniques and holds independently of the implementation of the voting computer. This is even more important if elec- tions are held over the internet, where ballots are recorded and counted on one or several distant servers, and the voter does not interact with most of the system components in person. However, the voter’s choice is to be secret and free – it should be cast uninfluenced by any adversarial impact. This in fact leads to an even stronger requirement than secrecy, namely coercion-resistance. Strongly related to this requirement is vote-buying. Coercion and vote-buying can be considered in an equivalent manner, since in both coercion and vote-buying situations the aim of the adversary is to find out if the voter followed certain instructions. Since cryptographic functions which prove correctness of the tally naturally get as input the cast ballots, care has to be taken that no information is revealed about the voter’s choices in any verification data. Verifiable correctness while preserving coercion-resistance becomes even harder to achieve in non-standard elections, like elections which allow write-in candidates or vote delegation. Elections held over the internet are a special challenge, since the privacy of a voting booth is not guaranteed. In this work, we take a look at cryptographic voting schemes, with focus on their coercion-resistance, from a wide viewpoint. First of all, verifiability and coercion- resistance are not the only design criteria for voting schemes. Measures to achieve those two requirements affect other criteria. The provability of a manipulation makes the voting scheme more robust than a mere detection. The early leakage of intermediate results makes an election unfair. A too high amount of published data for verification makes the election non-scalable. At the same time, there is a huge variety of voting schemes, based on different underlying models, using different cryptographic techniques. A consensus on a formal description of voting schemes is still missing. Therefore, it is hard to consistently analyze or compare this variety of voting schemes. This raises the question of a catalog of suitable design criteria. The first contribution of this work is a taxonomy which identifies such design v vi and analysis criteria, together with an analysis roadmap, with which the existing variety of voting schemes can easily be analyzed and compared. The taxonomy is written in natural language and can be applied to any voting scheme, regardless of its underlying model. The taxonomy makes strengths and potential weaknesses of an election scheme apparent rather quickly. Since the main focus of this work is coercion-resistance, we give an overview over existing definitions. After this, we describe real-world experiences with the voting scheme Bingo Voting, discuss its coercion-resistance and retrospectively analyze it with our taxonomy. We will see that Bingo Voting offers a great amount of flexibility since it provides vote-splitting and cumulative voting without weakening coercion- resistance. Further improvements of Bingo Voting are discussed, and to add to its flexibility, we provide Bingo Voting with support for write-in candidates, which means that instead of choosing a candidate from an existing candidate list, the voter can write in an arbitrary name. This brings up the first of three special cases considered in this work which offer particular challenges when trying to achieve coercion-resistance. Write-in candidates are problematic since the voter can always be coerced to “vote for” a certain name or even a random string which would otherwise most likely get no votes. In the final tally, the adversary sees if this candidate has gotten one or zero votes. Hence, it seems impossible to achieve coercion-resistance in elections with write-in candidates. We solve this problem by providing techniques to publish the tally in a controlled fuzzy way, such that the tally leak less information while being sufficiently verifiable. The second challenging case is the possibility to re-cast a vote: in internet voting schemes, it cannot be assumed that all voting processes take place in private. We have the problem of so-called shoulder voting: The voter might be observed during her voting process.