I am planning to implement an e-voting system based on hyperledger fabric blockchain, however, I came across many criticisms from well-known security experts like Josh Benaloh and others. The problem is I couldn't find any proof that the e-voting is definitely insecure. In my opinion, I think Blockchain can be considered the best solution compared to the current voting system as it covers many security aspects.

can anybody explain to me thoroughly with tangible examples and proofs?

  • 16
    $\begingroup$ As a general rule, if someone suggests "blockchain" as a solution, they have not understood the problem. $\endgroup$ – Maeher Mar 30 '20 at 10:31
  • 6
    $\begingroup$ If someone suggests "blockchain" as a solution, they probably don't know what a blockchain is. If they think just stapling the word blockchain (cargo-cult style) to a half-baked idea is somehow going to eventually result in a secure product, then they definitely don't know what a block chain is NOR do they understand the problem they are trying to solve $\endgroup$ – Future Security Mar 30 '20 at 14:16
  • 2
    $\begingroup$ Obligatory Tom Scott videos: youtu.be/w3_0x6oaDmI, youtu.be/LkH2r-sNjQs $\endgroup$ – MooseBoys Mar 30 '20 at 19:33

There's a good reason many democracies reserve mail voting to rare cases where that's the only option: it allows one's vote to be influenced by duress or bribery, because one can prove how one voted. No remote voting technology that I know has solved that issue. Ergo, physically going to a polling station with isoloirs should remain the normal voting procedure for political elections in a democracy. And this comment is right to point that some¹ usages of blockchain in electronic voting can ease vote selling.

A large fraction of voters do not understand cryptography or math, some are not even able to follow a logical argument. Even if a complex system was impossible to fraud, they would not be convinced that it is. Therefore simple systems that people understand are the best ones from the standpoint of having the people trust the outcome, which is critical to why we vote: decide who leads without a civil war.

Many electronic voting systems in use (including, in physical polling stations) fail to give a convincing argument to a rational and knowledgeable person that a vote gets counted as cast. People who know something about e-security are the hardest ones to convince because they see how an insider can rig the machine/system. I can't criticize the "e-voting system based on hyperledger fabric blockchain" of the question from that standpoint since it is not described, but ask yourself: how could an insider rig the result? And would it be that easy to make a fraud that can't be detected in a traditional voting system, where voters put a paper bulletin in an envelope at a polling station, publicly insert the envelope in a transparent box, these get locally and publicly opened and bulletins counted at the end of the day, and results of each polling station nationwide are made public, so that anyone can check this public record for accuracy when it comes to the polling station where s/he was a witness, and redo the addition towards the national outcome?

¹ Blockchain-based solutions that aim at securing the collection of results of different voting places, or prevent double voting by an individual, do not necessarily facilitate vote selling.

  • 5
    $\begingroup$ In addition to this great answer, I just want to further elaborate on trustless vote selling/buying already pointed out by @fgrieu. One can imagine a smart contract which pays for certain votes in a totally transparent, trustless and automatic way. Hence, in this context also vote buying made a lot easier and cheaper. Highly recommended, great blog post by Phil Daian: hackingdistributed.com/2018/07/02/on-chain-vote-buying $\endgroup$ – István András Seres Mar 30 '20 at 7:32
  • $\begingroup$ I think the voting system will never be transparent in some counties, let's take RD. Congo as an example where the result was altered after using an electronic voting system in December 2018, I mean 50% electronic because voters used the machine to vote and inserted the printed bulletins in the ballot as well. The transfer of power was negotiated even if the number of bulletins was counted physically and electronically. Electronic or non-electronic voting both present some downsides and strong points. It's a dilemma. A 100% transparent and secure system doesn't exist. $\endgroup$ – jack Mar 30 '20 at 8:35
  • $\begingroup$ @fgrieu "All users may comment on their own posts and any answers to their own questions." $\endgroup$ – Maarten Bodewes Mar 30 '20 at 10:48
  • 1
    $\begingroup$ Both electronic and traditional voting are vulnerable to fraud, or/and their results can be ignored. I argue that with traditional voting this is harder to achieve on a massive scale and undetected. In my view, the risk of a centralized and undetected fraud introduced by electronic voting offsets the advantage it has of making fraud harder at a decentralized level. Note: a moderator has kindly repositioned the above comment, originally posted (likely by the OP) as an answer and under (& because of) a different login; that's bad. $\endgroup$ – fgrieu Mar 30 '20 at 11:01
  • $\begingroup$ "Blockchain-based solutions that [...] prevent double voting by an individual, do not necessarily facilitate vote selling" -- Using demographics about how certain populations vote in general, couldn't people use that knowledge to pay people to vote (regardless of how they actually do) and know within a certain range how likely it is they will vote favorably? As a more concrete example, in states with a weak majority in favor of party A, couldn't party B pay demographics that usually vote for party B to vote? Sure, they may vote for A but I imagine you could narrow it down quite a bit. $\endgroup$ – Captain Man Mar 30 '20 at 18:15

As a society we have decided that "secret ballots" are better than "open ballots". When you use a blockchain you will issue public keys to individuals who can then verify their votes were counted. I'm aware that the voter's name is not on these keys (I could not look at the chain and determine how you voted), but regardless it is a way to prove how you voted (I can prove to you how I voted). This means that you could do things like sell your vote or people could try to intimidate you to vote certain ways.

I'm not saying this is a good or bad idea, since in the past "open ballots" had something more explicit like your name attached, but this is a reason why people may be hesitant to use blockchain.

We need to decide which is more important,

  • ensuring a way for the voter to check that their vote was accurate and counted to combat corruption by altering counts
  • or ensuring secret ballots to combat corruption by people coercing or forcing people to vote certain ways

One great point Maeher mentioned in the comments is that with paper ballots the tradeoff of not being able to verify your vote is correct and counted when using paper ballots does not necessarily need to exist. If you view the entire process from putting your ballot into the box to the counting of the ballots then you can know for certain your vote was counted. Then make sure that the numbers reported during the counting match what is publicly reported from your place of voting.

The above is more of a philosophical why a blockchain wouldn't work. You also mentioned "I couldn't find any proof that the e-voting is definitely insecure." I can comment on that as well. Not all electronic voting would involve a blockchain, so you can have secret ballots while still using electronic voting.

How do you know what software any kind of electronic voting system is using? You simply cannot. You may suggest something like getting a hash of the program, but how do you know the device performing the hash has not been tampered with and how do you know that the device being hashed isn't trying to fake something? You really just can't know.

Paper ballots on the other hand are extremely easy to reason about. Physical things are just simpler. You don't need to worry about if the terminals are secure or recording properly, you simply know your ballot has the right vote because you can see it. Then the ballots will be loaded into boxes and counted somewhere. Parties from all sides of the election will be present to ensure nothing fishy is happening, and they will be able to spot it even if they are a non-technical person.

So it's not that electronic voting is "definitely insecure", it's that it's harder to know if it is.

  • 2
    $\begingroup$ We only need to decide between these two bullet points for electronic voting. With manual voting, we get secret ballots (second bullet), and a practically sufficient degree of verifiable counting (first bullet), because altering the counts in many independent manual voting places without beeing detected is hard, and AFAIK unprecedented. Electronic voting makes voting more convenient, less error prone, and often harder to hack locally with prestidigitator skills, but all system that I know make large scale undetectable fraud by a few insiders possible. Why should we accept that risk? $\endgroup$ – fgrieu Mar 30 '20 at 15:30
  • $\begingroup$ @fgrieu I think you misunderstood me, when I said verifiable I meant a method for the voter personally to check that their vote was both cast and counted correctly. Regardless of method there is no way to have that while also having secret ballots. -- As for the bit about "why should we accept that risk", I'm not trying to suggest electronic or "traditional" voting is better in this answer. I'm just saying that for elections, most (all?) non-authoritarian countries have chosen secret ballots instead of open ballots and that blockchains cannot be secret ballots. $\endgroup$ – Captain Man Mar 30 '20 at 15:56
  • $\begingroup$ @fgrieu I added some more though so now I am sort of making a point for paper voting being better. Sorry, added it after I made the first comment so I cannot edit out that part about not suggesting one method is better. Sorry for the confusion! $\endgroup$ – Captain Man Mar 30 '20 at 16:11
  • 3
    $\begingroup$ @CaptainMan Of course I can ensure that my vote is counted correctly. Since I can observe the entire voting process from sealing the empty ballot box to the hand-count of all cast ballots I can indeed verify that all ballot cast in my polling place (including mine) were counted correctly. $\endgroup$ – Maeher Mar 30 '20 at 16:28
  • $\begingroup$ @Maeher that's a good point, I don't know how many places that is really an option but this discussion has been about theory not practice. Yes, if a group watch their secret ballots go into the box and then get counted and all polling sites have their numbers listed publicly then yes, you can verify your vote was counted. -- I'll update the wording on my answer to specify that with paper votes you can verify if you observe the entire process. $\endgroup$ – Captain Man Mar 30 '20 at 17:58

[...] any proof that the e-voting is definitely insecure. [...] Blockchain can be considered the best solution compared to the current voting system as it covers many security aspects.

can anybody explain to me thoroughly with tangible examples and proofs

In cryptography, a system is considered secure:

  • under a set of assumptions
  • if formal proof exists
  • if an attack requires so much more effort than normal usage of the system that the attack is not only infeasible but impossible.

The proposed

e-voting system based on hyperledger fabric blockchain

is lacking so many details that no one will be able to provide proof that it is insecure. However that does not mean it is secure. Quite the contrary, typical "security assumptions" for blockchain systems include:

  • proof of work - this typically means, that the system is secure unless a single attacker has a substantial part of the computing power of the rest of the system. The Bitcoin blockchain is computed in a distributed network. If at any point in time any attacker ever has more computing power than the network, they can fake blocks, that will not become part of the blockchain. This makes the supposedly irreversible transactions in Bitcoin reversible (by abandoning the faked branch) and allows for fraud. This attack is even described in the whitepaper founding Bitcoin. It's not bad practice, to describe potential attacks on the system. However it is bad that the attack only requires an effort from the attacker that grows linearly with the effort put in by regular users.
    Non-blockchain systems (i.e. actually effective cryptography) use exponential growth to be fast enough to be used comfortably by regular users while attackers would need all the computing power existing extrapolated to the expected end of life of the system running till the heat death of the universe to crack a single code. "Attackers not having a tad more computing power at any time" is a laughable security assumption in comparison.
  • trusted central authority - Bitcoin is a distributed system. Other cryptocurrencies (e.g. Ethereum) rely on a trusted central authority. However having a trusted central authority completely defeats the purpose of establishing trust via blockchain. Think about it this way: PayPal is a payment service with a trusted central authority. What benefit do cryptocurrencies add? They are slower. There's no fraud protection. Most people don't even get, what cryptocurrencies actually are.
    PayPal doesn't use blockchain, because their system is simpler, faster and safer without.
  • non-quantum computing - Since OP tagged the question "elliptic curves", I'd like to "honourable mention" the impact of quantum computing. Since quantum computers can invert any function [citation needed] that they can compute, hash-based proof of work is likely to fail. If OP claims that his proposed system is "quantum secure", that is a strong claim that should be proven by OP, instead of asking for a proof to the contrary from people, who don't have any detail on the actual proposal. This is not just my opinion but actual practice in what's usually called an auditing process. Not passing auditing processes is also a feature of many blockchain systems as indicated by the criticism by well-known security experts.

E-voting can have some additional security assumptions

  • restricted access - There's a challenge to reprogram voting machines to play Doom. There's also a university professor, who takes photos of unattended voting machines. Both of this combined exemplify one of the rules of computer security: If an attacker has physical access to the system, it isn't your system anymore. Problem is, with dedicated voting machines you have to grant access to the machine to anybody, who wants to vote. Without dedicated voting machines, how do the elderly or the poor vote? How do you make sure, eventual non-dedicated machines used for voting are secure? If an attacker can change your software, they can make your software ignore the input of the user and vote for Cthulhu (why vote for the lesser evil?) instead. No amount of buzzwords (e.g. Blockchain) will change the fact that software can be changed.
  • $\begingroup$ feel free to add security assumptions, if you have enough rep to edit. $\endgroup$ – NoAnswer Mar 30 '20 at 17:20
  • 2
    $\begingroup$ "quantum computers can invert any function [citation needed] that they can compute" You won't find a citation for that because it isn't true. $\endgroup$ – Joseph Sible-Reinstate Monica Mar 30 '20 at 19:42
  • 1
    $\begingroup$ "Other cryptocurrencies (e.g. Ethereum) rely on a trusted central authority." You sure about that? $\endgroup$ – Joseph Sible-Reinstate Monica Mar 30 '20 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.