50
In the Swiss Post electronic voting protocol, after voters submit ballots, they are scrambled individually and shuffled together so that they cannot be traced back to voters to find who voted for whom—variously called ballot secrecy, privacy, or anonymity—before they are tallied.
But since the ballots are bits in an electronic system, not physical artifacts,...
answered Mar 13 '19 at 15:56
Squeamish Ossifrage
41.8k3 gold badges80 silver badges172 bronze badges
16
The problem was the poor design of the scheme, specifically the part for universal verifiability.
As the paper Ceci n’est pas une preuve states:
To guarantee anonymity of the votes the scheme makes use of mixnets which rely on the shuffle proof by Bayer and Groth (a generalisation of Pedersen commitments), which then further relies on the discrete ...
11
In short, my answer is no; keep paper ballot, their have essential virtues unmatched by electronic substitutes; in particular, giving voters confidence that the result of the vote is not grossly manipulated.
Full disclosure: I co-founded a (French) association towards citizen oversight of voting means, essentially opposing electronic voting for political ...
10
We can't make satisfactory Electronic Voting Machines. Their design face conflicting goals that are impossible to reconcile, even in the simplest conceivable use case: a yes/no vote, a single machine.
Count votes (or at least: determine if there was more yes than no) with the result public.
Limit voting to one per registered voter.
Keep individual votes ...
7
Full disclosure: In 2007 I founded an association aiming at voting transparency. I'm proud that my efforts may have had some role, however small, in the fact that the number of French cities using electronic voting machines for political elections, then growing, has been declining since then.
The book defining the protocol of the question is made freely ...
7
Notice that the result says 67 mod 257.
All calculations here are being done modulo 257. So, $101^{-1}$ is actually the modular inverse of $101 \bmod 257$, which is 28. Similarly, $85 \cdot 28$ is also done modulo 257.
7
Unfortunately, the answer to your question is yes. You have made glaring mistakes. In particular, Yao's garbled circuits are suited for two-party computation only, and here you wish to carry out a multiparty computation. One huge problem that arises with your entire approach is that if the server colludes with one of the voters, then they can learn the ...
5
There is a very recent paper that solves this problem at a large scale using secure computation techniques:
How to (not) share a password: Privacy preserving protocols for finding heavy hitters with adversarial behavior: Moni Naor, Benny Pinkas, Eyal Ronen
They motivate the problem from the point of view of passwords (they want to identify passwords that ...
5
Electronic voting schemes constitute a big area of cryptographic research. The problem is complicated and multifaceted, and there are still no end-to-end secure schemes that provide desirable properties like verifiability and coercion resistance and that have good usability and performance for a large number of voters. See for example this survey from 2017 ...
5
How does an average voter know that his vote actually counted? He doesn't have any way of performing the summation and obtaining the private key to decrypt.
This is not actually true. He does have a way of performing the summation. From the spec, "all captured votes are displayed (in encrypted form) for all to see". Given the encrypted votes, you can do the ...
5
A threshold, additively homomorphic cryptosystems (such as the threshold variant of paillier) would work just fine for this sort of system. Each voter would need to prove that their vote was in the set $\{-1,0,1\}$ instead of the typical $\{0,1\}$. All of this could be done using the thep library. There is a page on dealing with negative numbers.
An ...
4
I am making the following assumptions regarding your requirements:
The number of participants is low enough, for it to be feasible for each participant to open a reliable, authenticated and confidential communication channel to each other participant.
The vote of each individual participant is only meant to be kept secret until the threshold of votes has ...
4
After a small search; it is a vote buying scheme.
Chain voting, a vote buying scheme in which a crook gives the voter a pre-voted ballot, the voter votes that ballot, and then after leaving the polling place, sells his blank ballot to the crook, who votes it and then gives it to the next willing participant.
This is from Douglas W. Jones web page and ...
3
The second property is formally called receipt freeness. Any voting system based on probabilistic encryption cannot be receipt free, because the voter uses a random value to construct the vote, this random value can serve as a receipt.
The solution given to this problem is by having an authority create the vote and the voter simply selects it from a ...
3
Andrew Neff's verifiable shuffle scheme A Verifiable Secret Shuffle and its Application to E-Voting is implemented by the DeDiS Advanced Crypto Library for Go
A working example program that uses the code is the server from the Riffle anonymous communication system.
Here's a "mostly finished" standalone implementation in Go, including a paper explaining the ...
3
You shouldn't use advanced crypto nor specialist algorithms here else you will be seriously over engineering and actually increasing the risks you face not reducing them. Seasoned security engineers would strongly recommend the "KISS principle". It's better to do something simple with a low error rate than attempt something complex and maybe have a bug ...
2
I figured it out, it's quite simple actually.
The $d$ values (and $r$ values) are all exponents and chosen from $\mathbb{Z}_q$. Thus all calculations on them directly take place in $\mathbb{Z}_q$. Applying mod $q$ (not mod $p$) to all of my calculations on $d$ and $r$ fixed any problems with calculations.
2
The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures:
Lets say we want to blindly sign distinct messages $m_1$ and $m_2$ with distinct randomness $r_1$ and $r_2$.
Now during the blind signing you produce the transcripts (I omit $\mod N$):
$m_1'=...
2
Yes, it could be done. However, it would work a little different from what you imagine.
The government can create a new blockchain operating under zerocoin rules. The government could then distribute one satoshi per citizen. This distribution could happen for example by letting each citizen visit a government office to present their passport and receive ...
2
I thought that the structure of the presentation would be as followed.
One of the basic tools that are used by the most cryptographic protocols of electronic voting are the Zero-Knowledge proofs. These proofs use protocols at which the Prover confirms to a Verifier the correctness of a statement, in such a way that the Verifier cannot find anything out ...
2
A homomorphic cryptosystem has some operation $*$ on ciphertexts that correspond to some other operation $\circ$ on plaintexts, that is
$$\mathcal{D}(c_1 * c_2) = \mathcal{D}(c_1) \circ \mathcal{D}(c_2).$$
Typically, the ciphertexts you get by applying $*$ look like ciphertexts that are produced by the encryption algorithm. For Damgård-Jurik, $*$ is ...
2
The easiest way would be to make use of a trusted third party. In this way, users can authenticate to the trusted party (maybe with the cellphone/IMEI number) which then issues them with a "ticket" or "group/blind signature" along with a pseudo-identity, similar to those used in e-voting schemes. The pseudo-identities can then be checked for duplicates.
...
2
I found a few for shuffles.
The papers below will be good pointers for recent results.
Stephanie Bayer and Jens Groth: Efficient Zero-Knowledge Argument for Correctness of a Shuffle. EUROCRYPT 2012.
Melissa Chase and Markulf Kohlweiss and Anna Lysyanskaya and Sarah Meiklejohn: Verifiable Elections That Scale for Free. PKC 2013.
Melissa Chase and Markulf ...
2
Just to say you have tons of literature about that.
If you need an entry point check out some papers here for instance:
http://esorics2014.pwr.wroc.pl/page2/index.html#15
Read the introductions and the related work and follow the links to find the big seminal papers in the domain.
Oh also, just a remark: it seems that you are looking for anonymity. if ...
2
It can guarantee the integrity, because you can not fake another voting with the same hash.
However, this only shows the ballot is casted correctly, but does not prove the ballot is correctly counted. And as you said, it can not provide anonymity, such as buying vote and coercion.
2
I'm going to try to answer a more modest version of your question.
Imagine that the Dishonest Society, a small club of 100 members, needs to take care of an Arduous Task that will require 5 people to complete. The members are lazy and so there are no volunteers. The members also don't trust each other very much, so they want to use a _sortition_ protocol ...
1
The standard solution is to use a proof of encryption of zero, coupled with an or proof and a careful choice of ciphertexts.
A proof of encryption of zero is a proof that the decryption of a ciphertext is zero. For ElGamal, this is typically done using a proof of equal discrete logarithm. Recall that an encryption of zero is of the form $(x,w) = (g^r, y^r g^...
1
Based on @Cort Ammon suggestion and some additional consultation i think the below will work
Each of the 5 parties could publish Hash(vote || random bytes), because of the random bytes it would not be possible to find the vote by hashing guesses. Then after all commitments are published or 24 hours has passed each party would publish the plaintext = (...
1
One approach might be the usage of a homomorphic cryptosystem like the Paillier cryptosystem, while the specific protocol properties depend on your use case.
For more detailed description of Paillier system,
I refer to https://de.wikipedia.org/wiki/Paillier-Kryptosystem and limit my answer to a possible protocol application to achieve your goal.
Due to ...
Only top voted, non community-wiki answers of a minimum length are eligible
