Why do people criticize and mistrust the e-voting based block chain?

Question

I am planning to implement an e-voting system based on hyperledger fabric blockchain, however, I came across many criticisms from well-known security experts like Josh Benaloh and others. The problem is I couldn't find any proof that the e-voting is definitely insecure. In my opinion, I think Blockchain can be considered the best solution compared to the current voting system as it covers many security aspects.

can anybody explain to me thoroughly with tangible examples and proofs?

Answer 1

There's a good reason many democracies reserve mail voting to rare cases where that's the only option: it allows one's vote to be influenced by duress or bribery, because one can prove how one voted. No remote voting technology that I know has solved that issue. Ergo, physically going to a polling station with isoloirs should remain the normal voting procedure for political elections in a democracy. And this comment is right to point that some¹ usages of blockchain in electronic voting can ease vote selling.

A large fraction of voters do not understand cryptography or math, some are not even able to follow a logical argument. Even if a complex system was impossible to fraud, they would not be convinced that it is. Therefore simple systems that people understand are the best ones from the standpoint of having the people trust the outcome, which is critical to why we vote: decide who leads without a civil war.

Many electronic voting systems in use (including, in physical polling stations) fail to give a convincing argument to a rational and knowledgeable person that a vote gets counted as cast. People who know something about e-security are the hardest ones to convince because they see how an insider can rig the machine/system. I can't criticize the "e-voting system based on hyperledger fabric blockchain" of the question from that standpoint since it is not described, but ask yourself: how could an insider rig the result? And would it be that easy to make a fraud that can't be detected in a traditional voting system, where voters put a paper bulletin in an envelope at a polling station, publicly insert the envelope in a transparent box, these get locally and publicly opened and bulletins counted at the end of the day, and results of each polling station nationwide are made public, so that anyone can check this public record for accuracy when it comes to the polling station where s/he was a witness, and redo the addition towards the national outcome?

---

¹ Blockchain-based solutions that aim at securing the collection of results of different voting places, or prevent double voting by an individual, do not necessarily facilitate vote selling.

Answer 2

As a society we have decided that "secret ballots" are better than "open ballots". When you use a blockchain you will issue public keys to individuals who can then verify their votes were counted. I'm aware that the voter's name is not on these keys (I could not look at the chain and determine how you voted), but regardless it is a way to prove how you voted (I can prove to you how I voted). This means that you could do things like sell your vote or people could try to intimidate you to vote certain ways.

I'm not saying this is a good or bad idea, since in the past "open ballots" had something more explicit like your name attached, but this is a reason why people may be hesitant to use blockchain.

We need to decide which is more important,

• ensuring a way for the voter to check that their vote was accurate and counted to combat corruption by altering counts
• or ensuring secret ballots to combat corruption by people coercing or forcing people to vote certain ways

One great point Maeher mentioned in the comments is that with paper ballots the tradeoff of not being able to verify your vote is correct and counted when using paper ballots does not necessarily need to exist. If you view the entire process from putting your ballot into the box to the counting of the ballots then you can know for certain your vote was counted. Then make sure that the numbers reported during the counting match what is publicly reported from your place of voting.

---

The above is more of a philosophical why a blockchain wouldn't work. You also mentioned "I couldn't find any proof that the e-voting is definitely insecure." I can comment on that as well. Not all electronic voting would involve a blockchain, so you can have secret ballots while still using electronic voting.

How do you know what software any kind of electronic voting system is using? You simply cannot. You may suggest something like getting a hash of the program, but how do you know the device performing the hash has not been tampered with and how do you know that the device being hashed isn't trying to fake something? You really just can't know.

Paper ballots on the other hand are extremely easy to reason about. Physical things are just simpler. You don't need to worry about if the terminals are secure or recording properly, you simply know your ballot has the right vote because you can see it. Then the ballots will be loaded into boxes and counted somewhere. Parties from all sides of the election will be present to ensure nothing fishy is happening, and they will be able to spot it even if they are a non-technical person.

So it's not that electronic voting is "definitely insecure", it's that it's harder to know if it is.

Answer 3

[...] any proof that the e-voting is definitely insecure. [...] Blockchain can be considered the best solution compared to the current voting system as it covers many security aspects.

can anybody explain to me thoroughly with tangible examples and proofs

In cryptography, a system is considered secure:

• under a set of assumptions
• if formal proof exists
• if an attack requires so much more effort than normal usage of the system that the attack is not only infeasible but impossible.

The proposed

e-voting system based on hyperledger fabric blockchain

is lacking so many details that no one will be able to provide proof that it is insecure. However that does not mean it is secure. Quite the contrary, typical "security assumptions" for blockchain systems include:

• proof of work - this typically means, that the system is secure unless a single attacker has a substantial part of the computing power of the rest of the system. The Bitcoin blockchain is computed in a distributed network. If at any point in time any attacker ever has more computing power than the network, they can fake blocks, that will not become part of the blockchain. This makes the supposedly irreversible transactions in Bitcoin reversible (by abandoning the faked branch) and allows for fraud. This attack is even described in the whitepaper founding Bitcoin. It's not bad practice, to describe potential attacks on the system. However it is bad that the attack only requires an effort from the attacker that grows linearly with the effort put in by regular users.
  Non-blockchain systems (i.e. actually effective cryptography) use exponential growth to be fast enough to be used comfortably by regular users while attackers would need all the computing power existing extrapolated to the expected end of life of the system running till the heat death of the universe to crack a single code. "Attackers not having a tad more computing power at any time" is a laughable security assumption in comparison.
• trusted central authority - Bitcoin is a distributed system. Other cryptocurrencies (e.g. Ethereum) rely on a trusted central authority. However having a trusted central authority completely defeats the purpose of establishing trust via blockchain. Think about it this way: PayPal is a payment service with a trusted central authority. What benefit do cryptocurrencies add? They are slower. There's no fraud protection. Most people don't even get, what cryptocurrencies actually are.
  PayPal doesn't use blockchain, because their system is simpler, faster and safer without.
• non-quantum computing - Since OP tagged the question "elliptic curves", I'd like to "honourable mention" the impact of quantum computing. Since quantum computers can invert any function [citation needed] that they can compute, hash-based proof of work is likely to fail. If OP claims that his proposed system is "quantum secure", that is a strong claim that should be proven by OP, instead of asking for a proof to the contrary from people, who don't have any detail on the actual proposal. This is not just my opinion but actual practice in what's usually called an auditing process. Not passing auditing processes is also a feature of many blockchain systems as indicated by the criticism by well-known security experts.

E-voting can have some additional security assumptions

• restricted access - There's a challenge to reprogram voting machines to play Doom. There's also a university professor, who takes photos of unattended voting machines. Both of this combined exemplify one of the rules of computer security: If an attacker has physical access to the system, it isn't your system anymore. Problem is, with dedicated voting machines you have to grant access to the machine to anybody, who wants to vote. Without dedicated voting machines, how do the elderly or the poor vote? How do you make sure, eventual non-dedicated machines used for voting are secure? If an attacker can change your software, they can make your software ignore the input of the user and vote for Cthulhu (why vote for the lesser evil?) instead. No amount of buzzwords (e.g. Blockchain) will change the fact that software can be changed.