Efficient Receipt-Free Ballot Casting Resistant to Covert Channels - - PowerPoint PPT Presentation

Efficient Receipt-Free Ballot Casting Resistant to Covert Channels

Ben Adida

• C. Andrew Neff

EVT / WOTE August 11th, 2009 Montreal, Canada

Andy uses a voting machine to prepare a ballot. Andy wants to verify that the machine properly encrypted the ballot.

2

Neff’s MarkPledge and Moran-Naor. Two Problems.

1) 2 ciphertexts per challenge bit (40-50) 2) machine can use ballot to leak plaintext.

3

MarkPledge2

efficient ballot encoding: 2 ciphertexts for any challenge length covert-channel resistance: no leakage via the ballot. voting machine is significantly simplified.

➡ simpler voting machine = less chance of errors.

4

Voter Experience

5

Voter Experience

5

Voter Check-in

Andy _________ Ben _________

Voter Experience

5

Voter Check-in

Andy _________ Ben _________

VHTI

Voter Experience

5

Hillary Barack John Bill

Voter Check-in

Andy _________ Ben _________

VHTI

Voter Experience

5

Hillary Barack John Bill

Voter Check-in

Andy _________ Ben _________

VHTI

Voter Experience

5

Hillary Barack John Bill

Barack 8DX5

Voter Check-in

Andy _________ Ben _________

VHTI

Challenge?

Voter Experience

5

Hillary Barack John Bill

Barack 8DX5

Voter Check-in

Andy _________ Ben _________

VHTI

Challenge?

Voter Experience

5

Hillary Barack John Bill

Barack 8DX5 VHTI

Voter Check-in

Andy _________ Ben _________

VHTI

Challenge?

Voter Experience

5

Hillary Barack John Bill

Barack 8DX5

Receipt

Hillary Barack John Bill MCN3 8DX5 I341 LQ21

Challenge

VHTI

VHTI

Voter Check-in

Andy _________ Ben _________

VHTI

Challenge?

Voter Experience

5

Hillary Barack John Bill

Barack 8DX5

Receipt

Hillary Barack John Bill MCN3 8DX5 I341 LQ21

Challenge

VHTI

VHTI

Voter Check-in

Andy _________ Ben _________

VHTI

Challenge?

Voter Experience

5

Hillary Barack John Bill

Barack 8DX5

Receipt

Hillary Barack John Bill MCN3 8DX5 I341 LQ21

Challenge

VHTI

VHTI

Voter Check-in

Andy _________ Ben _________

VHTI

Special Bit Encryption

6

Hillary Barack John Bill

1

Encrypt a 0 or 1 for each candidate Special proof protocol

➡ for bit b=1 ➡ meaningful short strings

as part of the commitment

➡ short challenge strings

for real and simulated proofs

Special Bit Encryption

6

Hillary Barack John Bill

1

Encrypt a 0 or 1 for each candidate Special proof protocol

➡ for bit b=1 ➡ meaningful short strings

as part of the commitment

➡ short challenge strings

for real and simulated proofs

<ciphertexts>, "8DX5"

Special Bit Encryption

6

Hillary Barack John Bill

1

Encrypt a 0 or 1 for each candidate Special proof protocol

➡ for bit b=1 ➡ meaningful short strings

as part of the commitment

➡ short challenge strings

for real and simulated proofs

<ciphertexts>, "8DX5" "VHTI"

Special Bit Encryption

6

Hillary Barack John Bill

1

Encrypt a 0 or 1 for each candidate Special proof protocol

➡ for bit b=1 ➡ meaningful short strings

as part of the commitment

➡ short challenge strings

for real and simulated proofs

<ciphertexts>, "8DX5" "VHTI" reveal enc factors

Voter Experience (II)

7

Hillary Barack John Bill

1

Voter Experience (II)

7

Hillary Barack John Bill

1

<ciphertexts>, "8DX5" <ciphertexts>, <ciphertexts>, <ciphertexts>,

Voter Experience (II)

7

Hillary Barack John Bill

1

"VHTI" "VHTI" "VHTI" "VHTI" <ciphertexts>, "8DX5" <ciphertexts>, <ciphertexts>, <ciphertexts>,

<ciphertexts>, "MCN3" <ciphertexts>, "I341" <ciphertexts>, "LQ21"

Voter Experience (II)

7

Hillary Barack John Bill

1

"VHTI" "VHTI" "VHTI" "VHTI" <ciphertexts>, "8DX5"

<ciphertexts>, "MCN3" <ciphertexts>, "I341" <ciphertexts>, "LQ21"

Voter Experience (II)

7

Hillary Barack John Bill

1

"VHTI" "VHTI" "VHTI" "VHTI" reveal enc factors reveal enc factors reveal enc factors reveal enc factors <ciphertexts>, "8DX5"

<ciphertexts>, "MCN3" <ciphertexts>, "I341" <ciphertexts>, "LQ21"

Voter Experience (II)

7

Hillary Barack John Bill

1

"VHTI" "VHTI" "VHTI" "VHTI" reveal enc factors reveal enc factors reveal enc factors reveal enc factors

MCN3 8DX5 I341 LQ21

<ciphertexts>, "8DX5"

MarkPledge & Moran-Naor

8

BitEnc(1) 0 0 1 1 0 0 ... Pledge 1 ...

unique

BitEnc(0)

that fits the challenge

1 1 0 0 1 ... Challenge 1 1 ... 0 0 1 1 ... Reveal

Markpledge 2

9

different bit encryption

➡ isomorphic to ➡ operation is rotation (matrix mult.)

Designate 1-, 0-, and T-vectors

➡ any pair of a 1-vector and 0-vector

bisected by a test vector

➡ dot-product with test vector.

SO(2, q) (α, β) ∈ Z2

q , with α2 + β2 = 1

Same pattern emerges

10

BitEnc(1) 0 0 1 1 0 0 ... Pledge 1 ...

unique

BitEnc(0)

that fits the challenge

1 1 0 0 1 ... Challenge 1 1 ... 0 0 1 1 ... Reveal xi yi i xC,yC xCxi + yCyi

xi,yi chal m0,i

MarkPledge MarkPledge2

Covert Channel

Raised by Karloff, Sastry & Wagner If the voting machine chooses the random factor, it can embed info Can we make the voting machine fully deterministic given a voter ID and a selection in a given race?

11

Covert Channel

Pre-generate ciphertexts with trustees Rotate them on voter selection

12

1 1 1 1 2, r'1 1, r'2 4, r'3

Voting Machine Trustee #1 Trustee #2 Trustee #3

7 = 2 mod 5

r'1 + r'2 + r'3 Ballot #42

Bulletin Board

1

Ballot #42 Ballot #42

Why is this receipt-free?

What can the coercer ask the voter to do that affects the ballot / receipt? Only the challenge, which is selected before the voter enters the booth. All proofs will look the same, whether real or simulated.

13

Questions?

14