Internet voting will probably be one of the most significant achievements of the future information society. It will have an enormous impact on the election process making it fast, reliable and inexpensive. Nonetheless, so far remote voting is considered to be very difficult, as one has to take into account susceptibility of the voter's PC to various cyber-attacks. As a result, most the research effort is put into developing protocols and machines for poll-site electronic voting. Although these solutions yield promising results, they cannot be directly adopted to Internet voting because of secure platform problem. However, the cryptographic components they utilize may be very useful. This paper presents a scheme based on combination of mixnets and homomorphic encryption borrowed from robust poll-site voting, along with techniques recommended for remote voting -- code sheets and test ballots. The protocol tries to minimize the trust put in voter's PC by making the voter responsible for manual encryption of his vote. To achieve this, the voter obtains a paper ballot that allows him to scramble the vote by performing simple operations (lookup in a table). Creation of paper ballots, as well as decryption of votes, is performed by a group of cooperating trusted servers. As a result, the scheme is characterized by strong asymmetry -- all computations are carried out on the server side. In consequence it does not require any additional hardware on the voter's side, and offers distributed trust, receipt-freeness and verifiability.
As computer vision is prevalently used for mail-in ballot processing and counting, it becomes a point of centralized trust in postal voting. We propose DVote, a prototype system of postal voting that provides decentralized trust in computer vision. With blockchain and layer-2 technologies, DVote decentralizes the computation and model training of computer vision to a group of scrutineers that hold the AnyTrust assumption, i.e., at least one member is honest. Consequently, the computational integrity is anchored to the trustworthiness of a large public blockchain such as Ethereum.
A boardroom election is an election that takes place in a single room -- the boardroom -- in which all voters can see and hear each other. We present an initial exploration of boardroom elections with ballot privacy and voter verifiability that use only "low-tech cryptography" without using computers to mark or collect ballots. Specifically, we define the problem, introduce several building blocks, and propose a new protocol that combines these blocks in novel ways. Our new building blocks include "foldable ballots" that can be rotated to hide the alignment of ballot choices with voting marks,…
An election is a process through which citizens in liberal democracies select their governing bodies, usually through voting. For elections to be truly honest, people must be able to vote freely without being subject to coercion; that is why voting is usually done in a private manner. In this paper we analyze the security offered by a paper-ballot voting system that is used in Israel, as well as in several other countries around the world. we provide an algorithm which, based on publicly available information, breaks the privacy of the voters participating in such elections. Simulations based …
A secret ballot mechanism that enables voting in absence is proposed. It amends standard vote collection methods that use ballot box as anonymizer, adding the option for absent voters to vote by a proxy blinded to the content of the ballot paper. Votes are cast under unique and hidden identification numbers generated solely for the purpose of that election. Voters prepare their ballot papers from scratch and submit them to the tallying authority in two parts via separate routes, each part being meaningless without the other.
Election systems must ensure that representatives are chosen by voters. Moreover, each voter should have equal influence. Traditionally, this has been achieved by permitting voters to cast at most one ballot. More recently, this has been achieved by tallying the last ballot cast by each voter. We show this is not achieved by the Helios election system, because an adversary can cause a ballot other than a voter's last to be tallied. Moreover, we show how the adversary can choose the contents of such a ballot, thus the adversary can unduly influence the selection of representatives.
In this paper a new multi-candidate electronic voting scheme is constructed with unlimited participants. The main idea is to express a ballot to allow voting for up to k out of the m candidates and unlimited participants. The purpose of vote is to select more than one winner among $m$ candidates. Our result is complementary to the result by Sun peiyong$'$ s scheme, in the sense, their scheme is not amenable for large-scale electronic voting due to flaw of ballot structure. In our scheme the vote is split and hidden, and tallying is made for $G\ddot{o}del$ encoding in decimal base without any t…
We advance the state-of-the-art in automated symbolic analysis for e-voting protocols by introducing three conditions that together are sufficient to guarantee ballot secrecy. There are two main advantages to using our conditions, compared to existing automated approaches. The first is a substantial expansion of the class of protocols and threat models that can be automatically analysed: we can systematically deal with (a) honest authorities present in different phases, (b) threat models in which no dishonest voters occur, and (c) protocols whose ballot secrecy depends on fresh data coming fro…
The strongest threat model for voting systems considers coercion resistance: protection against coercers that force voters to modify their votes, or to abstain. Existing remote voting systems either do not provide this property; require an expensive tallying phase; or burden users with the need to store cryptographic key material and with the responsibility to deceive their coercers. We propose VoteAgain, a scalable voting scheme that relies on the revoting paradigm to provide coercion resistance. VoteAgain uses a novel deterministic ballot padding mechanism to ensure that coercers cannot see …
Elections seem simple---aren't they just counting? But they have a unique, challenging combination of security and privacy requirements. The stakes are high; the context is adversarial; the electorate needs to be convinced that the results are correct; and the secrecy of the ballot must be ensured. And they have practical constraints: time is of the essence, and voting systems need to be affordable and maintainable, and usable by voters, election officials, and pollworkers. It is thus not surprising that voting is a rich research area spanning theory, applied cryptography, practical systems an…
There is still debate on whether voters can detect malicious changes in their printed ballot after making their selections on a Ballot Marking Device (BMD). In this study, we altered votes on a voter's ballot after they had made their selections on a BMD. We then required them to examine their ballots for any changes from the slate they used to vote. Overall accuracy was exceptionally high. Participants saw 1440 total contests, and of those 1440, there were a total of 4 errors, so total accuracy was 99.8%. Participants were able to perform with near-perfect accuracy regardless of ballot length…
We propose a method providing cast-as-intended verifiability for remote electronic voting. The method is based on plaintext equivalence tests (PETs), used to match the cast ballots against the pre-generated encrypted code tables. Our solution provides an attractive balance of security and functional properties. It is based on well-known cryptographic building blocks and relies on standard cryptographic assumptions, which allows for relatively simple security analysis. Our scheme is designed with a built-in fine-grained distributed trust mechanism based on threshold decryption. It, finally, imp…
Current electronic voting systems require an anonymous channel during the voting phase to prevent coercion. Typically, low-latency anonymization-networks like Tor are used for this purpose. In this paper we devise a monitoring attack that allows an attacker to monitor whether participants of an election voted, despite the use of a low-latency network during the voting phase, thereby breaking an important part of coercion-freeness. We implement a simulation carrying out our attack and measure its success rates.
Busting the Paper Ballot: Voting Meets Adversarial Machine Learning
University of Rhode Island（罗德岛大学）；University of Connecticut（康涅狄格大学）；Northeastern University（东北大学）；Stony Brook University（石溪大学）；University of Connecticut Voting Technology Center（康涅狄格大学选举技术中心）；Synchrony Chair in Cybersecurity University of Connecticut（康涅狄格大学网络安全荣誉教授职位）
We propose a secure voting protocol for score-based voting rules, where independent talliers perform the tallying procedure. The protocol outputs the winning candidate(s) while preserving the privacy of the voters and the secrecy of the ballots. It offers perfect secrecy, in the sense that apart from the desired output, all other information -- the ballots, intermediate values, and the final scores received by each of the candidates -- is not disclosed to any party, including the talliers. Such perfect secrecy may increase the voters' confidence and, consequently, encourage them to vote accord…
A boardroom election is an election with a small number of voters carried out with public communications. We present BVOT, a self-tallying boardroom voting protocol with ballot secrecy, fairness (no tally information is available before the polls close), and dispute-freeness (voters can observe that all voters correctly followed the protocol). BVOT works by using a multiparty threshold homomorphic encryption system in which each candidate is associated with a masked unique prime. Each voter engages in an oblivious transfer with an untrusted distributor: the voter selects the index of a prime a…
In the world's largest-ever deployment of online voting, the iVote Internet voting system was trusted for the return of 280,000 ballots in the 2015 state election in New South Wales, Australia. During the election, we performed an independent security analysis of parts of the live iVote system and uncovered severe vulnerabilities that could be leveraged to manipulate votes, violate ballot privacy, and subvert the verification mechanism. These vulnerabilities do not seem to have been detected by the election authorities before we disclosed them, despite a pre-election security review and despit…
We study the liquid democracy problem, where each voter can either directly vote to a candidate or delegate his voting power to a proxy. We consider the implementation of liquid democracy on the blockchain through Ethereum smart contract and to be compatible with the realtime self-tallying property, where the contract itself can record ballots and update voting status upon receiving each voting massage. A challenge comes due to the gas fee limitation of Ethereum mainnet, that the number of instruction for processing a voting massage can not exceed a certain amount, which restrict the applicati…
Bitcoin, as a decentralized digital currency, has caused extensive research interest. There are many studies based on related protocols on Bitcoin, Bitcoin-based voting protocols also received attention in related literature. In this paper, we propose a Bitcoin-based decentralized privacy-preserving voting mechanism. It is assumed that there are n voters and m candidates. The candidate who obtains t ballots can get x Bitcoins from each voter, namely nx Bitcoins in total. We use a shuffling mechanism to protect voter's voting privacy, at the same time, decentralized threshold signatures were us…
We present Phrase-Verified Voting, a voter-verifiable remote voting system assembled from commercial off-the-shelf software for small private elections. The system is transparent and enables each voter to verify that the tally includes their ballot selection without requiring any understanding of cryptography. This paper describes the system and its use in fall 2020, to vote remotely in promotion committees in a university. Each voter fills out a form in the cloud with their vote V (YES, NO, ABSTAIN) and a passphrase P-two words entered by the voter. The system generates a verification prompt …
Selene is an e-voting protocol that allows voters to directly check their individual vote, in cleartext, in the final tally via a tracker system, while providing good coercion mitigation. This is in contrast to conventional, end-to-end verifiable schemes in which the voter verifies the presence of an encryption of her vote on the bulletin board. The Selene mechanism can be applied to many e-voting schemes, but here we present an application to the polling station context, resulting in a voter-verifiable electronic tally with a paper audit trail. The system uses a smartcard-based public key sys…
Electing democratic representatives via voting has been a common mechanism since the 17th century. However, these mechanisms raise concerns about fairness, privacy, vote concealment, fair calculations of tally, and proxies voting on their behalf for the voters. Ballot voting, and in recent times, electronic voting via electronic voting machines (EVMs) improves fairness by relying on centralized trust. Homomorphic encryption-based voting protocols also assure fairness but cannot scale to large scale elections such as presidential elections. In this paper, we leverage the blockchain technology o…
We propose a protocol for verifiable remote voting with paper assurance. It is intended to augment existing postal voting procedures, allowing a ballot to be electronically constructed, printed on paper, then returned in the post. It allows each voter to verify that their vote has been correctly cast, recorded and tallied by the Electoral Commission. The system is not end-to-end verifiable, but does allow voters to detect manipulation by an adversary who controls either the voting device, or (the postal service and electoral commission) but not both. The protocol is not receipt-free, but if th…
A trusted electronic election system requires that all the involved information must go public, that is, it focuses not only on transparency but also privacy issues. In other words, each ballot should be counted anonymously, correctly, and efficiently. In this work, a lightweight E-voting system is proposed for voters to minimize their trust in the authority or government. We ensure the transparency of election by putting all message on the Ethereum blockchain, in the meantime, the privacy of individual voter is protected via an efficient and effective ring signature mechanism. Besides, the at…
In voting, disputes arise when a voter claims that the voting authority is dishonest and did not correctly process his ballot while the authority claims to have followed the protocol. A dispute can be resolved if any third party can unambiguously determine who is right. We systematically characterize all relevant disputes for a generic, practically relevant, class of voting protocols. Based on our characterization, we propose a new definition of dispute resolution for voting that accounts for the possibility that both voters and the voting authority can make false claims and that voters may ab…
We present the first automated privacy analysis of STAR-Vote, a real world voting system design with sophisticated "end-to-end" cryptography, using FDR and ProVerif. We also evaluate the effectiveness of these tools. Despite the complexity of the voting system, we were able to verify that our abstracted formal model of STAR-Vote provides ballot-secrecy using both formal approaches. Notably, ProVerif is radically faster than FDR, making it more suitable for rapid iteration and refinement of the formal model.
Voting by mail has been gaining traction for decades in the United States and has emerged as the preferred voting method during the COVID-19 pandemic. In this paper, we examine the security of electronic systems used in the process of voting by mail, including online voter registration and online ballot tracking systems. The goals of these systems, to facilitate voter registration and increase public confidence in elections, are laudable. They indisputably provide a critical public good. It is for these reasons that understanding the security and privacy posture of the mail-in voting process i…
The November 2014 Australian State of Victoria election was the first statutory political election worldwide at State level which deployed an end-to-end verifiable electronic voting system in polling places. This was the first time blind voters have been able to cast a fully secret ballot in a verifiable way, and the first time a verifiable voting system has been used to collect remote votes in a political election. The code is open source, and the output from the election is verifiable. The system took 1121 votes from these particular groups, an increase on 2010 and with fewer polling places.
Electronic and remote voting has become a large field of research and brought forth a multiplicity of schemes, systems, cryptographic primitives as well as formal definitions and requirements for electronic elections. In this survey we try to give a brief and precise overview and summary of the current situation.
Countries like Estonia, Norway or Australia developed electronic voting systems, which could be used to realize parliamentary elections with the help of personal computers and the Internet. These systems are completely different in their design and their way to solve the same problem. In this thesis, we analyze some of the largest real-world systems, describe their building blocks and their general design to focus on possible problems in these electronic voting systems. Furthermore, we present a template for an e-voting system, which we designed to try to fulfill the preliminaries and requirem…
Estonia has one of the most established e-voting systems in the world. Internet voting - remote e-voting using the voter's own equipment - was piloted in 2005 with the first real elections using e-voting being conducted the same year and has been in use ever since. We detail this internet voting system and discuss how it was developed.
Paper ballot voting with its fully-reviewable paper-trail is usually considered as more secure than their e-voting counterparts, given the large number of recent incidents. In this work, we explore the security of paper voting and show that paper voting, as it is implemented today, is surprisingly vulnerable to cyber-attacks. In particular, the aggregation methods of preliminary voting results of various countries rely on insecure communication channels like telephone, fax or non-secure e-mail. Furthermore, regulations typically do not mandate the use of secure channels for the transmission of…
Code voting was introduced by Chaum as a solution for using a possibly infected-by-malware device to cast a vote in an electronic voting application. Chaum's work on code voting assumed voting codes are physically delivered to voters using the mail system, implicitly requiring to trust the mail system. This is not necessarily a valid assumption to make - especially if the mail system cannot be trusted. When conspiring with the recipient of the cast ballots, privacy is broken. It is clear to the public that when it comes to privacy, computers and "secure" communication over the Internet cannot …
Recently, there has been a growing interest in using online technologies to design protocols for secure electronic voting. The main challenges include vote privacy and anonymity, ballot irrevocability and transparency throughout the vote counting process. The introduction of the blockchain as a basis for cryptocurrency protocols, provides for the exploitation of the immutability and transparency properties of these distributed ledgers. In this paper, we discuss possible uses of the blockchain technology to implement a secure and fair voting system. In particular, we introduce a secret share-ba…
Online voting for independent elections is generally supported by trusted election providers. Typically these providers do not offer any way in which a voter can verify their vote, so the providers are trusted with ballot privacy and ensuring correctness. Despite the desire to offer online voting for political elections, this lack of transparency and verifiability is often seen as a significant barrier to the large-scale adoption of online elections. Adding verifiability to an online election increases transparency and integrity, allowing voters to verify that their vote has been recorded corr…
