PRIVACY in electronic voting

Size: px

Start display at page:

Download "PRIVACY in electronic voting"

Daniella Pierce
5 years ago
Views:

1 PRIVACY in electronic voting Michael Clarkson Cornell University Workshop on Foundations of Security and Privacy July 15, 2010

3 Secret Ballot

10 Florida 2000: Bush v. Gore

11 Flawless

12 Security FAIL

13 Analysis of an electronic voting system. [Kohno et al. 2003, 2004] DRE trusts smartcards Hardcoded keys and initialization vectors Weak message integrity Cryptographically insecure random number generator...

14 California top-to-bottom reviews [Bishop, Wagner, et al. 2007] Virtually every important software security mechanism is vulnerable to circumvention. An attacker could subvert a single polling place device...then reprogram every polling place device in the county. We could not find a single instance of correctly used cryptography that successfully accomplished the security purposes for which it was apparently intended.

15 Why is this so hard?

16 PRIVACY INTEGRITY

17 Cryptography

18 Cryptography Can cryptography be defended? Low-tech crypto?

19 Simple Voting Protocol 1. V BB: sign(enc(vote); kv) 2. Talliers: check signatures 3. Talliers: decrypt votes, tally

20 Simple Voting Protocol 1. V BB: sign(enc(vote); kv) 2. Talliers: check signatures 3. Talliers: decrypt votes, tally How to build secure, scalable BB?

21 PRIVACY via cryptography Blind signatures Mix networks Homomorphic encryption

22 PRIVACY via cryptography Blind signatures Mix networks Homomorphic encryption Why these three? What others?

23 When is Vote Anonymized? Before submission After submission

24 Blind Signatures [Chaum 1983]

25 unblind( sign(blind(m); k) ) = sign(m; k)

26 V BB: sign(enc(vote); kv)

27 V BB: sign(enc(vote); ka)

28 Simple Blind Signature Election Protocol 1. V Auth: V, sign(blind(enc(vote)); kv)

29 Simple Blind Signature Election Protocol 1. V Auth: V, sign(blind(enc(vote)); kv) 2. Auth V: sign(blind(enc(vote)); ka)

30 Simple Blind Signature Election Protocol 1. V Auth: V, sign(blind(enc(vote)); kv) 2. Auth V: sign(blind(enc(vote)); ka) 3. V BB [anon.]: sign(enc(vote); ka)

31 Simple Blind Signature Election Protocol 1. V Auth: V, sign(blind(enc(vote)); kv) 2. Auth V: sign(blind(enc(vote)); ka) 3. V BB [anon.]: sign(enc(vote); ka) 4. Talliers: check signatures, decrypt votes, tally

32 Blind Signature Voting Protocols Chaum 1983, Fujioka et al. 1992, Sako 1994, Okamoto 1996, 1997, Cranor & Cytron 1997, Herschberg 1997, DuRette 1999, Ohkubo et al. 1999, Joaquim et al. 2003, Lebre et al. 2004, Shubina & Smith 2004,... How to achieve high integrity?

33 When is Vote Anonymized? Before submission After submission Before tallying

34 Mix Networks [Chaum 1981]

37 Decryption Mix enc( enc( enc( m ; K3 ) ; K2 ) ; K1)

38 Reencryption Mix enc(m; K) reenc(m; K) reenc(m; K) [Park et al. 1994]

39 Simple Mix Network Election Protocol 1. V BB: sign(enc(vote); kv) 2. Talliers: check signatures 3. Mixers: remove signatures, mix votes 4. Talliers: decrypt votes, tally

40 Mix Network Election Protocols Chaum 1981, Furukawa & Sako 1991, Park et al. 1993, Sako & Killian 1995, Ogata et al. 1997, Jakobsson 1998, Abe 1999, Neff 2001, Golle 2002, Jakobsson et al. 2002, Lee et al. 2003, Aditya et al. 2004, Juels et al. 2005, Chaum et al. 2005, Benaloh 2006, Popoveniuc & Hosp 2006, Ryan & Schneider 2006, Chaum et al. 2008,...

41 When is Vote Anonymized? Before submission After submission Before tallying During tallying

42 Homomorphic Encryption (f,f ) G G H H G G H H f [Rivest, Adleman, Dertouzos 1978] Fully homomorphic?

43 enc(v) enc(v ) = enc(v+v )

44 Simple Homomorphic Encryption Election Protocol 1. V BB: sign(enc(vote); kv) 2. Talliers: a. check signatures b. compute T = i enc(votei), which is enc( i votei) c. compute dec(t)

45 Homomorphic Encryption Election Protocols Cohen (Benaloh) & Fisher 1985, Cohen (Benaloh) & Yung 1986, Benaloh 1987, Benaloh & Tuinstra 1994, Sako & Killian 1994, Cramer et al. 1996, Cramer et al. 1997, Hirt & Sako 2000, Baudron et al. 2001, Kiayias 2006, Sandler 2007, Adida 2008,...

46 Formal Definitions of PRIVACY Integrity?

47 PRIVACY Vote privacy Receipt freeness Coercion resistance

48 Vote Privacy Nothing about map from voters to votes revealed (assuming everyone is honest)

49 Y Y Y Y N NN Vote Privacy

50 Vote Privacy Y Y Y Y N NN N N N Y Y Y Y

51 Vote Privacy V(x) V(y)

52 Vote Privacy V(y), V(x) V(y), V(x)

53 Vote Privacy Formal Definitions Computational: Cohen (Benaloh) & Fisher 1985 Symbolic: Delaune, Kremer & Ryan 2006

54 Receipt Freeness Voters do not obtain information (a receipt) that proves how they voted.

55 Receipt Freeness V(x) x Adv

56 Receipt Freeness V(x) V(y) x Adv x Adv

57 Receipt Freeness V(x) x Adv V(y) x Adv

58 Receipt Freeness V(y), V(x) V(y), V(x) x Adv x Adv

59 Receipt Freeness Requirements Private/untappable channel from authorities to voter [Benaloh 1994, Sako & Killian 1995] Trusted voter hardware [Lee et al. 2004] What is minimal requirement?

60 Receipt Freeness Formal Definitions Computational: Benaloh & Tuinstra 1994 (there called uncoercible), Okamoto 1997 Symbolic: Delaune, Kremer & Ryan 2006, Jonker & de Vink 2006, Backes et al Logical: Jonker & Pieters 2006

61 Receipt Freeness Fails to defend against: Randomization attacks Forced abstention attacks Simulation attacks [Schoenmakers 2000, Juels et al. 2005]

62 Coercion Resistance Voters cannot prove how they voted, even by fully cooperating with the adversary.

63 Coercion Resistance V(x) x Adv

64 Coercion Resistance V(x) V(y) x Adv x Adv

65 Coercion Resistance V(x) x Adv V(y) x Adv

66 Coercion Resistance V(y), V(x) V(y), V(x) x Adv x Adv

67 Coercion Resistance Formal Definitions Computational: Juels et al. 2005, Moran & Naor 2006 (there called receipt freeness) Symbolic: Delaune, Kremer & Ryan 2006, Backes et al. 2008

68 Coercion resistance Receipt freeness Vote privacy [Delaune, Kremer & Ryan 2006]

69 Civitas Secure Remote Voting [Clarkson, Chong & Myers 2008] based on [Juels, Catalano & Jakobsson 2005]

70 JCJ (Recall Mix Network Protocol) 1. V BB: sign(enc(vote); kv) 2. Talliers: check signatures 3. Mixers: remove signatures, mix votes 4. Talliers: decrypt votes, tally

71 JCJ Voter Credentials Registrar V: cred Registrar BB: enc(cred) [electoral roll] V BB: enc(cred), enc(vote)

72 JCJ Voter Credentials Registrar V: cred Registrar BB: enc(cred) V BB: enc(cred), enc(vote) [electoral roll]

73 JCJ Voter Credentials Registrar V [untap.]: cred, zkpf1 Registrar BB: enc(cred) [electoral roll] V BB [anon.]: enc(cred), enc(vote), zkpf2

74 JCJ Tallying Protocol Talliers:

75 JCJ Tallying Protocol Talliers: 1. Retrieve votes from BB, check proofs

76 JCJ Tallying Protocol Talliers: 1. Retrieve votes from BB, check proofs 2. Eliminate unauthorized credentials (requires mixes, zkpfs)

77 JCJ Tallying Protocol Talliers: 1. Retrieve votes from BB, check proofs 2. Eliminate unauthorized credentials (requires mixes, zkpfs) 3. Decrypt votes, tally

78 JCJ Removing Unauthorized Credentials enc(cred) enc(cred), enc(vote) PETs Electoral roll, mixed Submitted votes, mixed

79 JCJ Credentials Verifiable Unsalable Anonymous Unforgeable

80 JCJ Credentials Coercion resistant: voters use fake (unauthorized) credentials to comply with coercer

81 Civitas Architecture registration teller teller teller tabulation teller voter client ballot box ballot box ballot box tabulation teller tabulation teller bulletin board

82 Civitas JCJ: single trusted registrar Civitas: distributed trust...improved privacy and integrity registration teller teller teller Architecture tabulation teller voter client ballot box ballot box ballot box tabulation teller tabulation teller bulletin board

83 Civitas JCJ: single trusted registrar Civitas: distributed trust...improved privacy and integrity Architecture registration teller teller teller JCJ: no ballot boxes Civitas: distributed storage...improved availability tabulation teller voter client ballot box ballot box ballot box tabulation teller tabulation teller bulletin board

84 JCJ: single trusted registrar Civitas: distributed trust...improved privacy and integrity Civitas Architecture JCJ: O(V 2 ) Civitas: O(B 2 ), B V...improved scalability registration teller teller teller JCJ: no ballot boxes Civitas: distributed storage...improved availability tabulation teller voter client ballot box ballot box ballot box tabulation teller tabulation teller bulletin board

85 JCJ: single trusted registrar Civitas: distributed trust...improved privacy and integrity Civitas Architecture JCJ: O(V 2 ) Civitas: O(B 2 ), B V...improved scalability registration teller teller teller JCJ: no ballot boxes Civitas: distributed storage...improved availability tabulation teller voter client ballot box ballot box ballot box tabulation teller tabulation teller bulletin board Civitas: concrete implementation, 21K LoC

86 Civitas Security: Coercion resistance & universal verifiability Distributed trust Assurance: Security proofs & security-typed implementation Also: Ranked voting

87 Civitas High integrity voter client? Eliminate untappable channel in registration? Credential management? Application-level DoS?

88 or google civitas voting

89 PRIVACY in electronic voting History Cryptographic techniques Formal definitions Civitas

90 PRIVACY in electronic voting Michael Clarkson Cornell University Workshop on Foundations of Security and Privacy July 15, 2010

On Some Incompatible Properties of Voting Schemes

This paper appears in Towards Trustworthy Elections D. Chaum, R. Rivest, M. Jakobsson, B. Schoenmakers, P. Ryan, and J. Benaloh Eds., Springer-Verlag, LNCS 6000, pages 191 199. On Some Incompatible Properties