Motivation. 1 Three Basic Paradigms to Cryptographic E-voting The - PDF document

E- -voting with Vector Ballots : voting with Vector Ballots : E Homomorphic Encryption with Encryption with Writeins Writeins Homomorphic and Shrink- and Shrink -and and- -Mix networks Mix networks Aggelos Kiayias Aggelos Kiayias University of Connecticut University of Connecticut joint work with Moti Yung Moti Yung Columbia University Columbia University Motivation. 1

Three Basic Paradigms to Cryptographic E-voting � The Mix The Mix- -net Approach net Approach � � D. D. Chaum Chaum, 1982. , 1982. � � The The Homomorphic Homomorphic Encryption Approach. Encryption Approach. � � J. J. Benaloh Benaloh, 1986. , 1986. � � The Blind Signature Approach. The Blind Signature Approach. � � Fujiyoka Fujiyoka, , Ohta Ohta, Okamoto, 1992. , Okamoto, 1992. � Three+2 Basic Properties � “ “Universal Verifiability Universal Verifiability” ” � � Anybody (the voters and any interested party) can Anybody (the voters and any interested party) can � verify that the tally includes all submitted votes. verify that the tally includes all submitted votes. (challenging even assuming robust voter- (challenging even assuming robust voter -system system interaction – – no matter how implemented). no matter how implemented). interaction � “ “Efficient Tallying Efficient Tallying.” .” � � Tallying (and tally verification) does not take “too Tallying (and tally verification) does not take “too � long.” [tallying = post- long.” [tallying = post -ballot ballot- -casting process] casting process] � “ “Writein Writein Capability Capability” ” � � Voters are allowed to cast ballots with any candidate of Voters are allowed to cast ballots with any candidate of � their choice. their choice. (also: Voter Privacy (also: Voter Privacy and prevention of and prevention of Double Voting Double Voting.) .) 2

Question: � How do the three basic approaches perform How do the three basic approaches perform � with respect to the three basic properties? with respect to the three basic properties? Mix-net Approach D. Chaum (1982) Mix-Servers Voters 3

Mix-net Approach, II � voter privacy and double voting ok. voter privacy and double voting ok. � � The mix The mix- -net approach allows net approach allows writeins writeins naturally. naturally. � � It achieves universal verifiability by employing a robust It achieves universal verifiability by employing a robust � mix: mix: � Everytime Everytime you apply a mixer, the mixer has to prove you apply a mixer, the mixer has to prove � that it didn’t remove or modify any ballot. that it didn’t remove or modify any ballot. � The bad news: mix The bad news: mix- -proofs are long / cumbersome to proofs are long / cumbersome to � verify. Recent works on “partial verifying” promising verify. Recent works on “partial verifying” promising but still not as efficient/ robust as non- -mix approaches. mix approaches. but still not as efficient/ robust as non Homomorphic Encryption Approach Bulletin Board Server J. Benaloh (1986) Voters Encrypted Tally Tally Homomorphic Property “Structured contributions” 4

Homomorphic Encryption, II Voter Privacy and Double Voting ok. Voter Privacy and Double Voting ok. � Efficient Tallying! Efficient Tallying! � � Compression operation very efficient. Compression operation very efficient. � � Universal Verifiability. Universal Verifiability. � � Based on voters’ proof and verification of the Based on voters’ proof and verification of the � compression operation + proof of opening the compression operation + proof of opening the ciphertext. . ciphertext � The Bad news: no The Bad news: no writeins writeins. . � � Problem is Problem is inherent inherent. . � information theoretic limitation of compressibility. information theoretic limitation of compressibility. Blind Signature Approach Fujioka Ohta Okamoto (1992) Voting Authority Tallier Blindly Signs Voter’s Ballot` Anonymous Channel 5

Blind Signature Approach, II � Double voting and voter privacy ok. Double voting and voter privacy ok. � � Writeins Writeins are naturally allowed (the scheme is are naturally allowed (the scheme is � quite generic). quite generic). � Tallying is efficient (e.g. anonymous channel Tallying is efficient (e.g. anonymous channel � implementation through the employment of a implementation through the employment of a non- -robust mix is reasonably efficient). robust mix is reasonably efficient). non � Bad news: universal verifiability is lacking… Bad news: universal verifiability is lacking… � � Relies on voter for verifiability. Relies on voter for verifiability. � � how do I know that other voters check how do I know that other voters check � their votes off- -line? line? their votes off The state of things. � No cryptographic e No cryptographic e- -voting approach beats voting approach beats � the other two w.r.t w.r.t. the properties of . the properties of the other two “efficient tallying”, “universal verifiability” “efficient tallying”, “universal verifiability” and “writein writein capability.” capability.” and “ 6

Our solution The present work: � Develops a new (cryptographic) e Develops a new (cryptographic) e- -voting approach voting approach � that achieves the three properties. that achieves the three properties. � Key issue: understand the existing machinery. Key issue: understand the existing machinery. � � Homomorphic Homomorphic encryption: good for fast encryption: good for fast � tallying. Limited in terms of writein writein capability. capability. tallying. Limited in terms of � robust mix robust mix- -nets: great for nets: great for writeins writeins votes but votes but � inefficient when applied to the total sum of inefficient when applied to the total sum of votes. votes. 7

Vector Ballots � Comprised out of three components: Comprised out of three components: � � The predetermined candidate component. The predetermined candidate component. � � The Flag component. The Flag component. � � The The writein writein component. component. � � All encrypted. All encrypted. � Vector Ballots, II anatomy Description of homomomorphic encryption function E EXAMPLE: Voting among c candidates 2 1 � { 1 , , ,..., c � } Choices M M M � # � M voters N Vote for j -th candidate Writein vote ( 0 ), ( 1 ), ( ) ( 1 ), ( 0 ), ( 0 ) E E E writein j � E M E E 8

Key Issues in Vector Ballots � Uniformity: Each vector Uniformity: Each vector- -ballot should be indistinguishable ballot should be indistinguishable � (independently on the way the voters goes, predetermined (independently on the way the voters goes, predetermined or writein writein). ). or � Ballot Consistency (verification) Ballot Consistency (verification) � � predetermined candidate component (PC) is in predetermined candidate component (PC) is in Choices Choices � � Make sure that in each ballot it is mutually exclusive Make sure that in each ballot it is mutually exclusive � for the voter to use the “” or the “writein writein” component. ” component. for the voter to use the “” or the “ � If the If the writein writein component is used the predetermined component is used the predetermined � candidate component must be 0. candidate component must be 0. � If the predetermined candidate component is used the If the predetermined candidate component is used the � writein component must be 0. writein component must be 0. � Also the flag Also the flag ciphertext ciphertext should be 1 should be 1 iff iff the the writen writen � component is used. component is used. � “0” is not a valid “0” is not a valid writein writein choice (sorry). choice (sorry). � How to deal with the key-issues: � For For uniformity uniformity we rely on the semantic we rely on the semantic � security of the underlying encryption security of the underlying encryption mechanism. mechanism. � For For consistency consistency we develop the appropriate we develop the appropriate � (NIHVZK) proofs of knowledge that the (NIHVZK) proofs of knowledge that the voter must append to his encrypted vector voter must append to his encrypted vector ballot. ballot. 9

E-Voting with Vector Ballots. Break Each ballot Into its Writein Three components Flag Submits vector Predetermined ballot and proof Candidate (PC) of ballot validity. Overview of procedure Vector Ballots� Shrinking� Voter� 1� 2� 3� 1� 2� 3� Using� Flag� 3� Ciphertexts� Voter� 1� 2� 3� 1� 2� 3� 3� Voter� 1� 2� 3� 1� 2� 3� 3� Voter� 1� 2� 3� 1� 2� 3� Mix-net� Voter� 3� 1� 2� 3� 1� 2� 3� Tally� 3� Ciphertext� Using� Election Results� Election� 3� Homomorphic� without Write-ins� Write-in� Encryption� Results� 10