Anonymity of Paillier cryptosystem in e-voting system

Question

I'm not an expert so at the moment I'm trying to figure out (at high level) how such cryptosystem would exploit it's homomorphic properties to guarantee anonymity in a e-voting system.

As far as i have understand given two plain number $x$ and $y$, I can sum those numbers and obtain $z$, with such cryptosystem I can encrypt them before the sum, so the adder has no idea of which numbers are involved :

$E(x) + E(y) = E(z)$

When decrypted $D(E(z)) = z$

Reading wikipedia, I find a statement that is not clear to me :

Semantic security is not the only consideration. There are situations under which malleability may be desirable. The above homomorphic properties can be utilized by secure electronic voting systems. Consider a simple binary ("for" or "against") vote. Let m voters cast a vote of either 1 (for) or 0 (against). Each voter encrypts their choice before casting their vote. The election official takes the product of the m encrypted votes and then decrypts the result and obtains the value n, which is the sum of all the votes. The election official then knows that n people voted for and m-n people voted against. The role of the random r ensures that two equivalent votes will encrypt to the same value only with negligible likelihood, hence ensuring voter privacy.

So if I understand this is like the previous example, with the difference that all the votes are zeroes (against) or ones (for) and are casted for each option.

Eg :

There are four people ($A,B,C$ and the evil Trudy, when only first three people are valid voters).They can only cast $E(0)$ (against) or $E(1)$ (for) that is encrypted in a probabilistic way using election official's public key so $E_c(0) \neq E_a(0)$ and nobody can understand the vote of someone else simply comparing the encrypted votes.

After the votes are casted the election offical will see a sequence like that :

$E_a(0) , E_b(1) , E_c(1)$

Now if each vote is not signed (or identifiable in some way) how can I exclude that Trudy has not forged a huge amount of fake votes? For that reason I suppose that each vote has to be identifiable when still encrypted. Now the election official sum all the encrypted votes

$E_a(0) + E_b(1) + E_c(1) = E(2)$

And then decrypt the result $D(E(2)) = 2$ obtaining the election result (2 on 3 valid voter is a win of the 'for' and a lose of 'against').

What I can't understand is what prevent the election official to decrypt that votes one by one and see who vote for what.

Answer 1

You've discovered some of the challenges of secure electronic voting. As you can see, merely having a cipher that allows you to confidentially tally numbers is not sufficient to conduct a secure election.

Now if each vote is not signed (or identifiable in some way) how can I exclude that Trudy has not forged a huge amount of fake votes? For that reason I suppose that each vote has to be identifiable when still encrypted.

This is the issue of ensuring that each voter only gets one vote.

What I can't understand is what prevent the election official to decrypt that votes one by one and see who vote for what.

This is an issue of vote privacy, the inability for even the officials who run the election to know who voted for what.

There are lots of different schemes that use different techniques and make tradeoffs regarding the goals and efficiency.

E-voting is a subject unto itself. This paper provides a gentle introduction.