E-voting using Paillier encryption scheme: security risks

Question

I am trying to solve the following problem but am stuck for the moment. Suppose there are two candidates, A and B, and $K$ voters. All of these voters vote.

They vote for A by encrypting 0 and vote for B by encrypting 1, using a public key for the Paillier cryptosystem made public by the voting authority. Each voter puts his encrypted vote on a webpage and when all votes are online, the voting authority adds these votes up by using that the Paillier cryptosystem is additively homomorphic. They decrypt, and if the tally is $>K/2$, candidate B is elected. If it is $<K/2$, candidate A is elected.

What would be some security concerns if not all voters play by the rules/some decide to collude?

One that came immediately to mind was that not everyone may encrypt 0 or 1, thus being able to illegally give their vote more weight or sabotage the process entirely if the end result is for example more than $K$.

Does anyone know how to mitigate this within the context of the Paillier cryptosystem? I was thinking of some way to digitally sign the encryption so people can tell that it is the encryption of either 0 or 1, without knowing which of the two it is. I suppose if Paillier was also multiplicatively homomorphic we could check if the equation $x^2 - x=0$ holds, but this isn’t the case.

Any help is appreciated! Also if people can point out other security concerns aside from anonimity and the fact that people could cast more than one vote.

Answer 1

In the question's setup:

Each voter puts his encrypted vote on a webpage and when all votes are online, the voting authority adds these votes up by using that the Paillier cryptosystem is additively homomorphic. They decrypt..

The voting authority can decrypt individual votes, and check they are 0 or 1. That solves the problem in the question! But notice that then, instead of additively homomorphic encryption, we could do with any public-key encryption, and encrypt votes with the authority's public key.

Independently, in this setup, if the voting authority can match votes on the webpage with the identity of the voter, it can break voter anonymity.

The very idea of voting by publishing votes encrypted with the Paillier cryptosystem is flawed from a cryptographic standpoint. There are better cryptography-based systems (see e.g. this question). But in my opinion they remain inappropriate for political elections, if only because they miss one essential point: most ordinary voters should understand the system well enough to trust the result.