SLIDE 1
Cryptography and Voting
Ben Adida Harvard University EVT & WOTE August 11th, 2009 Montreal, Canada
“If you think cryptography is the solution to your problem....
2
Cryptography and Voting Ben Adida Harvard University EVT & - - PowerPoint PPT Presentation
Cryptography and Voting Ben Adida Harvard University EVT & - - PowerPoint PPT Presentation
Cryptography and Voting Ben Adida Harvard University EVT & WOTE August 11th, 2009 Montreal, Canada If you think cryptography is the solution to your problem.... 2 ... then you dont understand cryptography... 3 ... then you
SLIDE 2
SLIDE 3
... then you don’t understand cryptography...
3
SLIDE 4
... then you don’t understand cryptography...
3
... and you don’t understand your problem.”
- Peter, Butler, Bruce
SLIDE 5
Yet, cryptography solves problems that initially appear to be impossible.
4
SLIDE 6
There is a potential paradigm shift. A means of election verification far more powerful than other methods.
5
SLIDE 7
Three Points
6
- 1. Voting is a unique trust problem.
- 2. Cryptography is not just about secrets,
it creates trust between competitors, it democratizes the auditing process.
- 3. Open-Audit Voting
is closing in on practicality.
SLIDE 8
1. Voting is a unique trust problem.
7
SLIDE 9
“Swing Vote” terrible movie. hilarious ending.
8
SLIDE 10
Wooten got the news from his wife, Roxanne, who went to City Hall on Wednesday to see the election results. "She saw my name with zero votes by it. She came home and asked me if I had voted for myself or not."
9
SLIDE 11
10
SLIDE 12
11
SLIDE 13
12
Bad Analogies
Dan Wallach’s great rump session talk. More than that ATMs and planes are vulnerable (they are, but that’s not the point) It’s that voting is much harder.
SLIDE 14
13
Bad Analogies
Adversaries
➡ pilots vs. passengers (airline is on your side, I think.) ➡ banking privacy is only voluntary:
you are not the enemy.
Failure Detection & Recover
➡ plane crashes & statements vs. 2% election fraud ➡ Full banking receipts vs. destroying election evidence
Imagine
➡ a bank where you never get a receipt. ➡ an airline where the pilot is working against you.
SLIDE 15
Ballot secrecy conflicts with auditing, cryptography can reconcile them.
14
SLIDE 16
http://www.cs.uiowa.edu/~jones/voting/pictures/
15
SLIDE 17
16
SLIDE 18
Vendor
/* * source * code */ if (...
1
16
SLIDE 19
Voting Machine 2
Vendor
/* * source * code */ if (...
1
16
SLIDE 20
Voting Machine 2
Vendor
/* * source * code */ if (...
1 Polling Location 3
16
SLIDE 21
Voting Machine 2
Vendor
/* * source * code */ if (...
1 Polling Location 3 4
Alice
16
SLIDE 22
Voting Machine 2
Vendor
/* * source * code */ if (...
1 Polling Location 3 4
Alice
16
SLIDE 23
Voting Machine 2
Vendor
/* * source * code */ if (...
1 Polling Location 3 Ballot Box Collection 5 4
Alice
16
SLIDE 24
Voting Machine 2
Vendor
/* * source * code */ if (...
1 Polling Location 3 Ballot Box Collection 5 Results ..... 6 4
Alice
16
SLIDE 25
Voting Machine 2
Vendor
/* * source * code */ if (...
1 Polling Location 3 Ballot Box Collection 5 Results ..... 6 4
Alice
Black Box
16
SLIDE 26
Chain of Custody
SLIDE 27
Chain of Custody
SLIDE 28
Chain of Custody
SLIDE 29
Chain of Custody
SLIDE 30
Chain of Custody
SLIDE 31
18
Initially, cryptographers re-created physical processes in the digital arena.
SLIDE 32
19
Then, a realization: cryptography enables a new voting paradigm Secrecy + Auditability.
SLIDE 33
20
SLIDE 34
Bulletin Board
Public Ballots
Bob: McCain Carol: Obama
21
SLIDE 35
Bulletin Board
Public Ballots
Bob: McCain Carol: Obama
Alice
21
SLIDE 36
Bulletin Board
Public Ballots
Alice: Obama Bob: McCain Carol: Obama
Alice
21
SLIDE 37
Bulletin Board
Public Ballots
Alice: Obama Bob: McCain Carol: Obama
Tally Obama....2 McCain.... 1
Alice
21
SLIDE 38
Encrypted Public Ballots
Bulletin Board
Alice: Rice Bob: Clinton Carol: Rice
Tally Obama....2 McCain.... 1
Alice
22
SLIDE 39
Encrypted Public Ballots
Bulletin Board
Alice: Rice Bob: Clinton Carol: Rice
Tally Obama....2 McCain.... 1
Alice
Alice verifies her vote
22
SLIDE 40
Encrypted Public Ballots
Bulletin Board
Alice: Rice Bob: Clinton Carol: Rice
Tally Obama....2 McCain.... 1
Alice
Alice verifies her vote Everyone verifies the tally
22
SLIDE 41
End-to-End Verification
SLIDE 42
End-to-End Verification
Polling Location Voting Machine
Vendor
/* * source * code */ if (...
SLIDE 43
End-to-End Verification
Polling Location Voting Machine
Vendor
/* * source * code */ if (...
Ballot Box / Bulletin Board
Alice
SLIDE 44
End-to-End Verification
Polling Location Voting Machine
Vendor
/* * source * code */ if (...
Ballot Box / Bulletin Board
Alice
Results .....
SLIDE 45
End-to-End Verification
Polling Location Voting Machine
Vendor
/* * source * code */ if (...
Receipt 1 Ballot Box / Bulletin Board
Alice
Results .....
SLIDE 46
End-to-End Verification
Polling Location Voting Machine
Vendor
/* * source * code */ if (...
Receipt 1 2 Ballot Box / Bulletin Board
Alice
Results .....
SLIDE 47
Democratizing Audits
24
Each voter is responsible for checking their receipt (no one else can.) Anyone, a voter or a public org, can audit the tally and verify the list of cast ballots. Thus, OPEN-AUDIT Voting.
SLIDE 48
2. Cryptography is not just about secrets, creates trust between competitors.
25
SLIDE 49
NO! Increased transparency when some data must remain secret.
26
SLIDE 50
So, yes, we encrypt, and then we operate on the encrypted data in public, so everyone can see. In particular, because the vote is encrypted, it can remain labeled with voter’s name.
27
SLIDE 51
“Randomized” Encryption
28
SLIDE 52
“Randomized” Encryption
Keypair consists of a public key and a secret key .
sk pk
28
SLIDE 53
“Randomized” Encryption
Keypair consists of a public key and a secret key .
sk pk
"Obama" 8b5637
Encpk
28
SLIDE 54
“Randomized” Encryption
Keypair consists of a public key and a secret key .
sk pk
"Obama" 8b5637
Encpk
c5de34
Encpk
"McCain"
28
SLIDE 55
“Randomized” Encryption
Keypair consists of a public key and a secret key .
sk pk
"Obama" 8b5637
Encpk
c5de34
Encpk
"McCain"
a4b395
Encpk
"Obama"
28
SLIDE 56
Threshold Decryption
8b5637
Secret key is shared amongst multiple parties: all (or at least a quorum) need to cooperate to decrypt.
29
SLIDE 57
Threshold Decryption
8b5637 b739cb
Decsk1
Secret key is shared amongst multiple parties: all (or at least a quorum) need to cooperate to decrypt.
29
SLIDE 58
Threshold Decryption
8b5637 b739cb
Decsk1
261ad7
Decsk2
Secret key is shared amongst multiple parties: all (or at least a quorum) need to cooperate to decrypt.
29
SLIDE 59
Threshold Decryption
8b5637 b739cb
Decsk1
261ad7
Decsk2
7231bc
Decsk3
Secret key is shared amongst multiple parties: all (or at least a quorum) need to cooperate to decrypt.
29
SLIDE 60
Threshold Decryption
8b5637 b739cb
Decsk1
261ad7
Decsk2
7231bc
Decsk3
8239ba
Decsk4
Secret key is shared amongst multiple parties: all (or at least a quorum) need to cooperate to decrypt.
29
SLIDE 61
Threshold Decryption
8b5637 b739cb
Decsk1
261ad7
Decsk2
7231bc
Decsk3
8239ba
Decsk4
Secret key is shared amongst multiple parties: all (or at least a quorum) need to cooperate to decrypt.
"Obama"
29
SLIDE 62
Homomorphic Encryption
30
SLIDE 63
Homomorphic Encryption
30
Enc(m1) × Enc(m2) = Enc(m1 + m2)
SLIDE 64
Homomorphic Encryption
30
Enc(m1) × Enc(m2) = Enc(m1 + m2)
SLIDE 65
Homomorphic Encryption
30
Enc(m1) × Enc(m2) = Enc(m1 + m2)
gm1 × gm2 = gm1+m2
SLIDE 66
Homomorphic Encryption
30
then we can simply add “under cover” of encryption! Enc(m1) × Enc(m2) = Enc(m1 + m2)
gm1 × gm2 = gm1+m2
SLIDE 67
Mixnets
31
Each mix server “unwraps” a layer of this encryption onion.
c = Encpk1 (Encpk2 (Encpk3 (m)))
SLIDE 68
Proving certain details while keeping others secret. Proving a ciphertext encodes a given message without revealing its random factor.
32
SLIDE 69
Zero-Knowledge Proof
33
SLIDE 70
Zero-Knowledge Proof
Vote For: Obama
President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse
Vote For: Obama
33
SLIDE 71
Zero-Knowledge Proof
This last envelope likely contains “Obama”
Vote For: Obama
President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse
Vote For: Obama
33
SLIDE 72
Zero-Knowledge Proof
Open envelopes don’t prove anything after the fact.
President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse
Vote For: Obama
President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse President: Mickey Mouse
Vote For: Paul
34
McCain
SLIDE 73
Electronic Experience
35
Voter interacts with a voting machine Obtains a freshly printed receipt that displays the encrypted ballot Takes the receipt home and uses it as a tracking number. Receipts posted for public tally.
Alice Voting Machine
Encrypted Vote
SLIDE 74
Paper Experience
36
Pre-print paper ballots with some indirection betw candidate and choice Break the indirection (tear, detach) for effective encryption Take receipt home and use it as tracking number. Receipts posted for public tally.
q r m x Adam - x Bob - q Charlie - r David - m q r m x
8c3sw
Adam - x Bob - q Charlie - r David - m
8c3sw
q r m x
8c3sw
8c3sw
David Adam Bob Charlie _______ _______ _______ _______ David Adam Bob Charlie _______ _______ _______ _______
8c3sw
SLIDE 75
3. Cryptography-based Voting (Open-Audit Voting) is closing in on practicality.
37
SLIDE 76
Benaloh Casting
38
SLIDE 77
Benaloh Casting
38
Alice
SLIDE 78
Benaloh Casting
38
Alice "Obama"
SLIDE 79
Benaloh Casting
38
Alice
Encrypted Ballot
"Obama"
SLIDE 80
Benaloh Casting
38
Alice
Encrypted Ballot
Alice "Obama"
SLIDE 81
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice "Obama"
SLIDE 82
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot
"Obama"
SLIDE 83
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 84
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 85
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 86
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot
Alice
Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 87
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot
Alice "CAST"
Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 88
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot
Alice "CAST"
Signed Encrypted Ballot Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 89
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot
Alice "CAST"
Signed Encrypted Ballot
Alice
Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 90
Benaloh Casting
38
"AUDIT" Alice
Encrypted Ballot
Alice
Decrypted Ballot
Alice "CAST"
Signed Encrypted Ballot
Alice
Signed Encrypted Ballot Decrypted Ballot Encrypted Ballot VERIFICATION
"Obama"
SLIDE 91
Many more great ideas
Neff’s MarkPledge
➡ high-assurance, human-verifiable, proofs of correct encryption
Scantegrity
➡ closely mirrors opscan voting
ThreeBallot by Rivest
➡ teaching the concept of open-audit without deep crypto
STV: Ramchen, Teague, Benaloh & Moran.
➡ handling complex election styles
Prêt-à-Voter by Ryan et al.
➡ elegant, simple, paper-based
39
SLIDE 92
Deployments!
UCL (25,000 voters) Scantegrity @ Takoma Park SCV
40
SLIDE 93
Three Points
41
- 1. Voting is a unique trust problem.
- 2. Cryptography is not just about secrets,
it creates trust between competitors, it democratizes the auditing process.
- 3. Open-Audit Voting
is closing in on practicality.
SLIDE 94
My Fear: computerization of voting is inevitable. without open-audit, the situation is grim.
42
SLIDE 95
My Hope: proofs for auditing partially-secret processes will soon be as common as public- key crypto is now.
43
SLIDE 96
Challenge:
44
Ed Felten: “you have no voter privacy, deal with it.”
SLIDE 97
Challenge:
44
Ed Felten: “you have no voter privacy, deal with it.”
SLIDE 98
Questions?
45