Moser, Florian

English

DSpace at Tartu University Library

Code Voting for Swiss Internet VotingFlorian Moser1[0000−0003−2268−2367]ETH Zürich, Switzerland moserfl@ethz.ch1 IntroductionSwitzerland is attempting to introduce an internet voting channel, with seriousefforts starting as early as 2001 [7]. However, a clear solution has not yet beenestablished: Switzerland has seen multiple systems come and go [8,5,13], alongwith three major revisions of its applicable law [9].As Switzerland attempts to re-introduce internet voting, Swiss Post has theonly viable system in reach. It is based on a system once distributed by Scytl [21].While it was gradually extended over time, the core mechanisms remained thesame [1,12,25]. As did the feedback: Critics regret low implementation quality[19,17,18] and very complex proofs and specification [20,28,10].We believe the complexity of the protocol is indeed a serious issue that re-duces implementation quality, makes reviews hard, and ultimately also under-mines full trust in the system. But redesigning the protocol based on the sameassumptions and same mechanisms will likely not result in a much simpler pro-tocol; this has been attempted by experienced researchers in 2017 in the form ofCHVote [14,3], which also turned out to be complex.2 Code VotingWe propose tackling the complexity using code voting [11,23,4]. In code voting,each voting option is associated with a voting code. For each voter, these votingcodes are then randomly permuted into voter-specific voting codes. To cast avote, the voter submits the appropriate voting code.If the voting server and network are untrusted, as it is the case in the Swisssetting, submitted voting codes are attributable to individual voters. To remedythis issue, code voting may be used with a privacy-preserving tally mechanism(e.g. verified shuffle), by mapping cast voting codes to ciphertext representing thevoting choice. The same authority already responsible for generating the voter-specific permutation of the voting codes can generate the appropriate lookup.With code voting, the voter’s device needs not be trusted for privacy, asthe voting option is already entered in an encrypted form. Additionally, codevoting promises to reach a notion of everlasting privacy, as, by the voter-specificpermutation, the voter-specific voting codes are a perfect encryption of the votingoptions.Code voting also allows using simpler and fewer cryptographic operations. Ifvoter-specific encryption keys are generated by multiple authorities, the voter-specific permutations are applied one after the other. If the vote is sent over aninsecure network, the voter’s device no longer needs to encrypt, but can simplyforward the voting code. Consequentially, the voter no longer needs to entera security-level appropriate encryption key, the expectedly much shorter votingcodes suffice.1 The validation of the vote is trivial, as valid voting codes are publicinformation. To implement return codes, a voter-specific lookup, mapping eachvoting code to the appropriate return code, is sufficient.For the voter, the process of casting a vote changes: Instead of entering thevoting option, they now have to enter the corresponding voting code. It is ourunderstanding, strengthened by corresponding communications with the Swisschancellery, that the current Swiss law does not forbid code voting. An extensionof the Swiss Post Protocol incorporating code voting has been shown to notreduce general usability [29].3 ProofsThe proposed code voting scheme needs to be proven secure. Swiss law [9] man-dates computational and symbolic proofs of four high-level properties, that wedecompose into provable formal definitions while respecting Swiss particularities(for example, the availability of multiple voting channels).Individual verifiability is defined to hold by Swiss law when voters are givenexactly one of two proofs: Voters who participate electronically are given a proofthat the vote has been registered successfully by the server, exactly as cast.Voters who did not participate electronically can request a proof that their votehas not been registered by the server [6, article 5.2, appendix 2.5]. The literatureusually only refers to the first proof as individual verifiability (see [24,15,3]).We cover the second proof with an additional property we call ParticipationVerifiability ; a new term, as we are not aware of this property being used in theliterature.23 We guarantee the "registered successfully" part by proving VoteVerifiability that ensures all votes represent valid voting options.4Universal Verifiability is defined to hold when the auditors are given a proofthat the result is composed out of all, and only out of, successfully registeredvotes [6, article 5.3, appendix 2.6]. This property is consistent with its use inliterature (see [24,15,3]), although Swiss law only requires it to hold for auditors.Vote Secrecy is defined to hold if the plaintext vote cannot be attributedto the voter, and Fairness ensures the attacker does not learn partial electionresults before the official tally [6, article 7, appendix 2.7]. While this intuitionmatches the literature, established privacy definitions such as BPRIV or Benalohdo not apply to return-code based schemes [2,28]. Further, we are not awareof any formal definition or proof of fairness; although depending on how bothproperties are formally defined, privacy might imply fairness.1 The voting codes need only be long enough to represent all voting choices.2 The property remains unproven for CHVote [3] and the Swiss Post protocol [22].3 The property was however discussed as part of Selections [27].4 This property is also referred to as ballot verifiability [3] or vote compliance [22].Authentication is defined to hold when the attacker cannot insert votes with-out controlling the voter [6, appendix 2.8]. In the literature, this property isusually referred to as Eligibility Verification (see [16,26,15,3]). Implicitly, thelaw also requires that voters must only cast and confirm a single vote, which werefer to as Eligibility Uniqueness, as in the verifiability analysis of CHVote [3].We introduce the formal definitions free from potentially complex protocol-specific syntax. This enables fruitful discussions over whether the definitionsindeed capture the security notions implied by the Swiss law, while not limit-ing the discussions to experts of the concrete protocol. Further, we aim for asconsistent definitions as possible. This makes it easier to think about whetherall necessary properties have been captured; and it allows to simplify the proofs(e.g. by reusing game hops of similar properties). As another way to simplify theproofs, we aim to encapsulate the privacy-preserving tally mechanism and proveit separately.4 References[1] Allepuz, J.P., Castelló, S.G.: Cast-as-intended verification in Norway. In:Proc. 5th Conf. Electron. Voting. pp. 49–63. Citeseer (2012)[2] Bernhard, D., Cortier, V., Galindo, D., Pereira, O., Warinschi, B.: Sok: Acomprehensive analysis of game-based ballot privacy definitions. In: 2015IEEE Symposium on Security and Privacy. pp. 499–516. IEEE (2015)[3] Bernhard, D., Cortier, V., Gaudry, P., Turuani, M., Warinschi, B.: Verifia-bility analysis of CHVote. report, Bernhard, David and Cortier, Véroniqueand Gaudry, Pierrick and Turuani, Mathieu and Warinschi, Bogdan (2018)[4] Budurushi, J., Neumann, S., Olembo, M.M., Volkamer, M.: Pretty under-standable democracy-a secure and understandable internet voting scheme.In: 2013 International Conference on Availability, Reliability and Security.pp. 198–207. IEEE (2013)[5] Bundeskanzlei, S.: Bundeskanzlei nimmt Standortbestimmung zum E-Voting vor. (March 2019)[6] Bundeskanzlei, S.: Vorentwurf Verordnung der BK über die elektronischeStimmabgabe(VEleS) (April 2021)[7] Bundesrat, S.: Bericht über den Vote électronique: Chancen, Risiken undMachbarkeit elektronischer Ausübung politischer Rechte. report, Schweiz-erischer Bundesrat (February 2002)[8] Bundesrat, S.: Nationalratswahlen mit dem elektronischen Stimmkanal (Au-gust 2015)[9] Bundesrat, S.: Vorentwurf Verordnung über die politischen Rechte(VPR)(April 2021)[10] Bundesrat, S.: E-Voting: Ergebnisse der ersten unabhängigen Überprüfungliegen vor (April 2022)[11] Chaum, D.: Sure Vote: Technical Overview. In: Proceedings of the workshopon trustworthy elections (WOTE 2001) (2001)[12] Galindo, D., Guasch, S., Puiggali, J.: 2015 Neuchâtel’s cast-as-intended ver-ification mechanism. In: International Conference on E-Voting and Identity.pp. 3–18. Springer (2015)[13] et canton de Genève, R.: Elections fédérales 2019: le canal de vote électron-ique ne sera pas proposé. (June 2019)[14] Haenni, R., Koenig, R.E., Locher, P., Dubuis, E.: CHVote System Specifi-cation. IACR Cryptol. ePrint Arch. 2017, 325 (2017)[15] Jonker, H., Mauw, S., Pang, J.: Privacy and verifiability in voting systems:Methods, developments and trends. Computer Science Review 10, 1–30(2013)[16] Kremer, S., Ryan, M., Smyth, B.: Election verifiability in electronic votingprotocols. In: European Symposium on Research in Computer Security. pp.389–404. Springer (2010)[17] Locher, P., Haenni, R., Koenig, Reto E, B.F.: Analysis of the CryptographicImplementation of the Swiss Post Voting Protocol. report, Berner Fach-hochschule (July 2019)[18] Locher, P., Haenni, R., Koenig, R.E., Dubuis, Eric, B.F.: Examination of theSwiss Post Internet Voting System. report, Berner Fachhochschule (March2022)[19] Østvold, B.M., Karlsen, E.K.: Public Review of E-Voting Source Code:Lessons learnt from E-Vote 2011. Norsk informatikkonferanse (2012)[20] Pereira, O., Teague, V.: Report on the SwissPost-Scytl e-voting system,trusted-server version. report, Pereira, Olivier and Teague, Vanessa (July2019)[21] Post, S.: Ein E-Voting-System für die Schweiz aus der Schweiz (June 2020)[22] Post, S.: Protocol of the Swiss Post Voting System: Computational Proofof Complete Verifiability and Privacy. Version 0.9.10. report, SchweizerischePost (July 2021)[23] Ryan, P.Y., Teague, V.: Pretty good democracy. In: International Workshopon Security Protocols. pp. 111–130. Springer (2009)[24] Sako, K., Kilian, J.: Receipt-free mix-type voting scheme. In: InternationalConference on the Theory and Applications of Cryptographic Techniques.pp. 393–403. Springer (1995)[25] Scytl: Swiss Online Voting Protocol. report, Scytl (2018)[26] Smyth, B., Ryan, M., Kremer, S., Kourjieh, M.: Towards automatic analysisof election verifiability properties. In: Joint Workshop on Automated Rea-soning for Security Protocol Analysis and Issues in the Theory of Security.pp. 146–163. Springer (2010)[27] Spycher, O.: Trustworthy internet voting: defeating powerful coercers andvote-buyers. Ph.D. thesis, University of Fribourg, Switzerland (2015)[28] Thomas Haines, Olivier Pereira, V.T.: Report on the Swiss Post e-VotingSystem. report, Thomas Haines, Olivier Pereira, Vanessa Teague (March2022)[29] Volkamer, M., Kulyk, O., Ludwig, J., Fuhrberg, N.: Increasing security with-out decreasing usability: A comparison of various verifiable voting systems.In: Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022).pp. 233–252 (2022)

Code Voting for Swiss Internet Voting

https://dspace.ut.ee/bitstream/handle/10062/84333/Phd5.pdf?sequence=1&isAllowed=y

Code Voting for Swiss Internet Voting

Abstract

Similar works

Full text

Available Versions

DSpace at Tartu University Library