Are there reasonably secure online voting implementations e.g. for student council elections?

Question

Assume a university want to elect the student council. This was done via paper ballot and there is a need to reach more students for voting, so electronic voting is on the table.

While researching existing solutions I came across Helios: helios voting and agora voting

Both seem to implement somewhat peer-reviewed schemes to do a online vote, but my impression is that the devil might hide in the details.

Has anyone here experience using these schemes? We plan to implement such an online voting scheme and would authenticate the voters via the university LDAP. Which cryptographic obstacles or security problems could we face?

Answer 1

In short, my answer is no; keep paper ballot, they have essential virtues unmatched by electronic substitutes; in particular, giving voters confidence that the result of the vote is not grossly manipulated.

Full disclosure: I co-founded a (French) association towards citizen oversight of voting means, essentially opposing electronic voting for political elections. I take some pride in our contribution (however little) to an observed pause in the deployment of electronic voting machines in France since 2007.

Electronic voting has two different meanings:

1. voting in polling stations using dedicated electronic voting machines;
2. voting remotely by electronic means such as mobile phone, web browser.

The question seems to be about 2, and I'll focus on that. A major problem is that it does not propose any means to discourage vote selling or voting under duress. In most proposed systems, handing over one's credentials to vote (perhaps: during the closing of the polling time-frame) will do the trick.

Contrast with the traditional voting system used for political elections (in France, and many countries with a long history of voting, thus a long history of voting fraud, and fixes to the voting code to fight that). Voting takes places according to procedures carefully designed to discourage vote selling and threats to vote in some prescribed way, by making it hard (and prohibited) that anyone but the voter knows how the vote was cast (that goal is not reached for mail voting, instead this is purposely kept marginal by requiring formal prior declaration to police that normal voting can't be performed for some reason, like traveling). Towards that goal, complex measures have evolved over time:

• generally, making it illegal and difficult to act in any way such as showing how one voted, or transferring one's right to vote to another person (voting requires an official ID with photo, in all but very small towns).
• requiring the insertion of paper ballot materializing the vote in an opaque envelope in a voting booth ("isoloir" = isolating device) where no one but the voter is allowed;
• making paper ballots with a distinctive sign invalid (and not counted); this is a countermeasure to the practice of marking the paper ballots handed for vote under duress/pay with a distinctive sign, so that the bribed/intimidated voter can fear that if s/he does not use that paper, it will get noticed at vote counting;
• often, making the paper ballots available by multiple means (at the polling station, and by mail), so that voters can be seen not grabbing a ballot from the stack X at the polling station, but still actually vote for X by using a paper ballot for X that they brought secretly (ticking a choice with a pen would be superior to paper ballots in this regard, but may bring back the previous problem; also, separate availability of paper ballots at least helps the reading impaired).

---

Another issue with both forms of electronic voting is that it makes fraud by a very small group of persons conceivable, when the traditional voting system makes that impossible for large-scale voting with multiple independent polling stations (this argument thus does not apply to a small local student council with a single polling station):

• Votes are cast in urns which remain observable from vote start till end of counting (French urns are transparent, in reaction to fraud).
• Votes are counted locally at each polling stations; anyone is allowed to obverse counting and check what the tally at the polling station where s/he voted.
• The tally at each polling station is made publicly available in print, so that any observer can check that the tally at the polling station where s/he voted was not modified, and check the addition of counts thus the election result (there is a hierarchy of two levels of publication, but the principle remains valid).

Most importantly, a rational person/voter can be convinced that the traditional system does not allow centralized fraud; but electronic voting systems which manage to keep what one voted secret do not meet (or even have) that goal, to my knowledge. At best, the organizers of an electronic election can be convinced that there was no fraud; that's not the correct objective (and it is not even really met by any practical system that I have seen).

Again restricting to voting remotely by electronic means, some usually poorly mitigated risks include:

1. Browsers (e.g. on university computers) modified to vote as asked by the voter as far as the screen is concerned, when the vote is really cast differently on the network side; that's far from rocket science.
2. A server pretending to be the real voting server(s) to the voter's browser, performing Man-in-the-Middle attack at some point on the network; if the cryptographic defense is https with TLS as in normal web browsers, that's defeated with a copy of the private key of the true server (certificates emitted by certification authorities in breach of CPS, which abound, would also trick most voters, albeit with a risk of being caught by an observer comparing the certificate shown by the browser with the real thing obtained out-of-band). The MitM machine can go undetected to a real voting server (and even inquisitive client) scrutinizing IP address and routing info, if the MitM machine is appropriately inserted in the network near either the real voting server or the targeted browser, and competently programmed; a university network is ideal grounds for such attack.
3. In many systems, plain subversion of the machine(s) counting the votes. Having several counting machines run by multiple parties helps, but what should be the rule when they do not agree?
4. Denial of service; it's easy to prevent voting by attacking the voting server or network infrastructure, and conceivable (especially if observers are allowed) to create some ESD/EMP that zaps the server.
5. Loss of secrecy of individual votes, threatened by:
6. penetration of the central computer(s) running the election; that's a problem the industry hardly knows how to tackle when the computer operators are trusted; and in this situation, we'd like not to trust them!
7. compromise of the voter's device (this is somewhat mitigated by the diversity of devices)
8. brittleness of web security practices; e.g. consider an https connection used for a "please confirm your vote" page visually showing the ballot selected: if there's a jpg image shown and no special precaution is taken, it is likely that mere analysis of the length of TCP/IP packets reveals the choice made.

Note: there's a simple countermeasure, mitigating 1, 2, 7 and 8, that I have seldom seen proposed: the voter would key-in a few digits, received secretly, different according to the vote cast. That would largely remove the browser and network from the attack surface. This is not without its own security problems, but the real reason why some proponents of electronic voting dislike it is that it is low tech, and acknowledges the need to distrust high tech in matters of voting.

---

Addition: any voting system, electronic of not, must balance between two antagonist goals:

• Keeping individual votes secret, including to whoever runs the election; because otherwise, individual retaliation could ensue.
• Making the outcome convincingly representative of the intention of voters, to as many reasonable persons as feasible; because the elected needs legitimacy.

We can reach either goal by a sacrifice of the other (if all individual votes are made public along the name of the voter as the election goes, the outcome is verifiable; if we choose the election's winner by stone/paper/scissor, voting in one's mind is enough).

Electronic voting complicates both goals considerably, particularly when you consider that whoever runs the election is an adversary (in the sense of that in crypto) trying to breach vote secrecy and accurate vote counting. Simply put, I do not see an even mildly-satisfactory solution.

Answer 2

You shouldn't use advanced crypto nor specialist algorithms here else you will be seriously over engineering and actually increasing the risks you face not reducing them. Seasoned security engineers would strongly recommend the "KISS principle". It's better to do something simple with a low error rate than attempt something complex and maybe have a bug whereby there is a huge flaw in your approach that you miss and an attacker finds. With a real world public election the eligible voters are a class of citizens; registering them to vote and giving them secure credentials is hard. You know the exact population of eligible voters and they are already registered on and using the college network where they have set their own passwords already. So you have none of the complications of a real election and you have only a basic authentication problem; is the person casting the vote authenticated as a college student. This problem should already been solved by your college.

The most important outcome is confidence in the election results with maximum participation. That's not the same success criteria as a "perfect vote count". Let's say you use some complex techniques and some noisy looser of the election declares that the complex algorithm was badly implemented and led to a flawed outcome when infact it all worked perfectly: you will have a world of pain and a likely outcome is that you are fired and the election is rerun as a paper election. That may or may not vindicate you as the publicity around the claims that the original election was unfair may boost the vote of the candidate who claimed the original vote was bad. That's a form of social engineering attack. She can claim "victory" no matter what the actual facts of the matter and increase her vote share. So it is better that you do something "low tech" that people have confidence was properly implemented the do anything complex and novel.

Here is a list of ways to solve your problem:

1. If your college has a way that sudents can login and submit course work just have them login and submit the name of the candidate they are voting for; and you are done. Counting the votes is a bit more complex as they may be bad submissions but you can publish all the submissions anonymised and anyone can validate them or recount them and the outcome of the election won't be in dispute.
2. If your college has a system were users can login and answer multiple choice questions then use that.
3. If your college systems use a single sign-on API such as SAML you can use that to secure your own voting web page; students authenticate to the college system with their college password and your web page is secured via a standard authentication API.
4. If all students have a college email address create a unique random ID per student and email them a link to vote that uses their unique ID.p in the link. Ensure that page at the link only allows one vote to be cast per student.

Sure some students will have obtained the network password of other students (such is life) and can steal a few votes. Yet if a noisy looser says "the vote was stolen" when you used the colleges authentication system they are challenging the integrity of the college authentication systems and ability to stop cheating etc so the college will robustly investigate and defend the outcome. The cheater risks being expelled from college for subverting the college authentication systems so that's a deterrent; but they may think it's a safe game to attack a custom system you built. If caught they can claim that they are a hero white hat hacker improving the world by testing your system and that they always intended to tell the world that they rigged the vote after the results were declared giving you longer to discover their playful attack.

Answer 3

For starters: you should look up posts and papers related to "LDAP Security" using your favorite search engine.

I will say I like the solution that crypto has come up with in the form of not being able to spend the same BTC twice. Something involving that and user verification would be ideal for online voting although those two are very different technologies. Luckily math has the answer.

Now, whether that will be a sustainable solution without any security issues is probably not realistic but you bring up an important point and something that needs attention not just in your domain but in other domains as well. Maybe "quantum" DNA verification and multifactor authentication…