7
$\begingroup$

There are many design goals for an e-voting system. My question concerns a conflict between 2 particular goals:

  • A voter should be able to verify that their vote was correctly tallied
  • A voter should not be able to prove how they voted (to prevent vote selling)

I've looked into various e-voting systems and none of them appear to be able to satisfy these 2 goals simultaneously.

Some researchers argue that end-to-end auditability and receipt-freeness should be considered to be orthogonal properties. (Wikipedia)

Is this an unsolved problem?

Improve this question
$\endgroup$
12
  • $\begingroup$ It has been proven that e-voting systems cannot unconditionally satisfy privacy and verifiability simultaneously. By comparison, e-voting systems can satisfy privacy and verifiability with overwhelming probability. Indeed, the e-voting protocol proposed by Juels, Catalano & Jakobsson simultaneously achieves these two properties. $\endgroup$
    – user2768
    Apr 18 '17 at 14:59
  • $\begingroup$ The paper you referenced states: "We also do not treat the problem of enabling voters to verify that their votes have been counted." $\endgroup$
    – Atte Juvonen
    Apr 18 '17 at 20:51
  • 1
    $\begingroup$ I don't know why they wrote that, they also write "In the full paper, we offer formal definitions for...verifiability of election schemes, a detailed security-proof outline...", which supports my claim. Perhaps refer to cs.cornell.edu/projects/civitas/papers/clarkson_civitas_tr.pdf. $\endgroup$
    – user2768
    Apr 19 '17 at 9:47
  • $\begingroup$ That paper is amazing! $\endgroup$
    – Atte Juvonen
    Apr 20 '17 at 10:42
  • $\begingroup$ If you adopt the same mechanisms that paper voting uses the problem is easily solved. e-voting has never been a technical issue. You're actually worrying about a political problem. $\endgroup$
    – Paul Uszak
    Apr 26 '17 at 21:27
3
$\begingroup$

The second property is formally called receipt freeness. Any voting system based on probabilistic encryption cannot be receipt free, because the voter uses a random value to construct the vote, this random value can serve as a receipt. The solution given to this problem is by having an authority create the vote and the voter simply selects it from a presented list. The first protocol to achieve this is as far as I know is the one described in the paper Receipt-free secret-ballot elections from Benaloh and Tuinstra. A more widely used example is Efficient receipt-free voting based on homomorphic encryption from Hirt and Sako. You can check these references especially the second one on details about how to achieve verifiability.

Improve this answer
$\endgroup$
1
$\begingroup$

I believe you can have a system that gives a receipt that increases personal voter confidence but cannot be used to prove how a voter voted. But this method requires already having a shared secret between the voter and the voting authority. Also the voter can only prove to themselves that their vote was tallied correctly, they couldn't show this proof to someone else.

A voter couldn't say "look at this evidence that the government didn't count my vote" but also couldn't say "look at this evidence that I voted for who you told me to".

https://security.stackexchange.com/questions/152044/is-this-voting-system-secure-in-an-information-theory-sense

Improve this answer
$\endgroup$
0
$\begingroup$

Punchscan does this, though it's not a purely electronic system. I'm not aware of any purely electronic (online) system that satisfies these properties, but having a paper trail makes audits easier and improves security anyway. Scantegrity is an updated version.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.