Coercion-Resistant Internet Voting with Everlasting Privacy Rolf Haenni (Philipp Locher, Reto E. Koenig) FC’16, Bridgetown, Barbados, February 26, 2016 Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 1
Outline Introduction Protocol Overview Cryptographic Preliminaries Detailed Protocol Description Properties and Performance Conclusion Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 2
Coercion-Resistance Strategy 1: Fake Credentials First proposed by Juels, Catalano, Jakobsson (WPES’05) Under coercion, use (indistinguishable) fake credential Submit real vote at any time during the voting period Strategy 2: Deniable Vote Updating First proposed by Achenbach et al. (JETS, 2:26–45, 2015) Under coercion, follow the coercer’s instructions Update vote shortly before the end of the voting period Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 3
Everlasting Privacy Strategy 1: Everlasting Privacy Towards the Public First proposed by Demirel et al. (EVT/WOTE’12) Publish perfectly hiding commitments to allow public verifiability Send decommitment values privately to trusted authorities Strategy 2: Efficient Set Membership Proof First proposed by Locher and Haenni (VoteID’15) Submit vote over anonymous channel Prove eligibility using perfectly hiding commitment and zero-knowledge proofs Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 4
Adversaries Present adversary . . . tries to manipulate the election outcome, e.g. by coercing voters acts before, during, or shortly after an election is polynomially bounded Future adversary . . . tries to break vote privacy acts at any point in the future has unlimited computational power Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 5
Outline Introduction Protocol Overview Cryptographic Preliminaries Detailed Protocol Description Properties and Performance Conclusion Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 6
Involved Parties Election administration Voters Public bulletin board Trusted authorities (threshold decryption, mixing) Verifiers (the public) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 7
Step 1: Registration The voter . . . creates a pair of private and public credentials sends the public credential to the election administration (over an authentic channel) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 8
Step 2: Election Preparation The election administration . . . sends the list of public voter credentials to bulletin board Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 9
Step 3: Vote Casting The voter . . . creates ballot consisting of commitment to public credential commitment to private credential encrypted ’election credential’ (used to detect duplicates) encrypted vote Non-interactive zero-knowledge proofs that commitments and encryptions have been formed properly sends ballot to bulletin board (over an anonymous channel) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 10
Step 4: Tallying The trusted authorities . . . retrieve ballots from bulletin board drop ballots with invalid proofs detect and eliminate updated votes threshold decrypt remaining encrypted votes drop ballots with invalid votes compute election result in a verifiable manner Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 11
Outline Introduction Protocol Overview Cryptographic Preliminaries Detailed Protocol Description Properties and Performance Conclusion Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 12
Cryptographic Setup Group G p of prime order p Sub-group G q ⊂ Z ∗ p of prime order q | ( p − 1) Independent generators g 0 , g 1 ∈ G p and h 0 , h 1 , h 2 ∈ G q Assume that DL is hard in G p and DDH is hard in G q Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 13
Set Membership Proof Goal: prove that a committed value belongs to a given set NIZKP [( u , r ) : C = com ( u , r ) ∧ u ∈ U ] Secret inputs u , r ∈ Z p Public inputs Commitment C = com ( u , r ) ∈ G p Set U = { u 1 , . . . , u N } of values u i ∈ Z p Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 14
Polynomial Evaluation Proof Let P ( X ) = � N i =1 ( X − u i ) satisfying P ( u i ) = 0 for all u i ∈ U NIZKP [( u , r ) : C = com ( u , r ) ∧ u ∈ U ] ⇐ ⇒ NIZKP [( u , r ) : C = com ( u , r ) ∧ P ( u ) = 0] Efficient protocol by Bayer and Groth (2013) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 15
DL-Representation Proof Goal: prove that a commitment contains a DL-representation of another committed value C = com ( u , r ) � NIZKP [( u , r , v 1 , . . . , v n , s ) : D = com ( v 1 , . . . , v n , s ) ] u = h v 1 1 · · · h v n n Secret inputs u , r ∈ Z p v 1 , . . . , v n , s ∈ Z q Public inputs Values h 1 , . . . , h n ∈ G q Commitment C = com ( u , r ) ∈ G p Commitment D = com ( v 1 , . . . , v n , s ) ∈ G q For n = 2, efficient protocol by Au, Susilo, Mu (2010) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 16
Verifiable Shuffle General verifiable shuffle: ( E ′ , π ) = shuffle φ f ( E , k 1 , . . . , k n ) Input list E = ( E 1 , . . . , E n ) Random permutation φ Keyed one-way function f Keys k 1 , . . . , k n Output list E ′ = ( E ′ 1 , . . . , E ′ n ), where E ′ φ ( i ) = f ( E i , k i ) Proof of shuffle π In our protocol, we use two shuffle instances Exponentiation: f ( E , k ) = E k Re-encryption: f ( E , k ) = reEnc pk ( E , k ) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 17
Outline Introduction Protocol Overview Cryptographic Preliminaries Detailed Protocol Description Properties and Performance Conclusion Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 18
Step 1: Registration The voter . . . creates a pair of private and public credentials sends the public credential to the election administration (over an authentic channel) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 19
Step 1: Registration The voter . . . creates a pair of private and public credentials α, β ∈ R Z q u = h α 1 h β 2 ∈ G q sends the public credential u to the election administration (over an authentic channel) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 20
Step 2: Election Preparation The election administration . . . sends the list of public voter credentials to bulletin board Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 21
Step 2: Election Preparation The election administration . . . defines the list of public voter credentials U = { ( V 1 , u 1 ) , . . . , ( V N , u N ) } computes coefficients A = ( a 0 , . . . , a N ) of polynomial N N � � a i X i P ( X ) = ( X − u i ) = i =1 i =0 selects fresh independent election generator ˆ h ∈ G q publishes ( U , A , ˆ h ) on bulletin board Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 22
Step 3: Vote Casting The voter . . . creates ballot consisting of commitment to public credential commitment to private credential encrypted ’election credential’ (used to detect duplicates) encrypted vote Non-interactive zero-knowledge proofs that commitments and encryptions have been formed properly sends ballot to bulletin board (over an anonymous channel) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 23
Step 3: Vote Casting The voter . . . creates ballot B = ( C , D , E , F , π 1 , π 2 , π 3 ) consisting of commitment to public credential C = com ( u , r ) commitment to private credential D = com ( α, β, s ) encryption of ’election credential’ E = enc pk (ˆ h β , ρ ) encrypted vote F = enc pk ( v , σ ) Non-interactive zero-knowledge proofs π 1 , π 2 , π 3 (see next slide) sends ballot B to bulletin board (over an anonymous channel) Bern University of Applied Sciences | Berner Fachhochschule | Haute ´ ecole sp´ ecialis´ ee bernoise 24
Recommend
More recommend
