On e-voting and privacy

Size: px

Start display at page:

Download "On e-voting and privacy"

Hilary Reed
5 years ago
Views:

1 On e-voting and privacy Jan Willemson UT,Cybernetica On e-voting and privacy p. 1

2 What is e-voting?? A citizen sits in front of his computer, On e-voting and privacy p. 2

3 What is e-voting?? A citizen sits in front of his computer, opens a voting application (e.g. a web browser), On e-voting and privacy p. 2

4 What is e-voting?? A citizen sits in front of his computer, opens a voting application (e.g. a web browser), clicks an appropriate name. On e-voting and privacy p. 2

5 Simple, isn t it? No, it s not. On e-voting and privacy p. 3

6 Simple, isn t it? No, it s not. Vote transmission over public media (Internet, phone line) is not secure. On e-voting and privacy p. 3

7 Simple, isn t it? No, it s not. Vote transmission over public media (Internet, phone line) is not secure. Thus we need to encrypt the votes. On e-voting and privacy p. 3

8 Is it now OK? No, it s not. On e-voting and privacy p. 4

9 Is it now OK? No, it s not. Some how we need to find out the sum of all votes. On e-voting and privacy p. 4

10 Is it now OK? No, it s not. Some how we need to find out the sum of all votes. How on Earth should that be possible if the votes are encrypted? On e-voting and privacy p. 4

11 Should a server decrypt? A voting server could possess a decryption key for every voter. But... On e-voting and privacy p. 5

12 Should a server decrypt? A voting server could possess a decryption key for every voter. But... The Estonian Riigikogu Valimise seadus 1 says: (2) Riigikogu liikmete valimised on vabad, üldised, ühetaolised ja otsesed. Hääletamine on salajane. On e-voting and privacy p. 5

13 Should a server decrypt? A voting server could possess a decryption key for every voter. But... The Estonian Riigikogu Valimise seadus 1 says: (2) Riigikogu liikmete valimised on vabad, üldised, ühetaolised ja otsesed. Hääletamine on salajane. Can we claim privacy if some server can decode everything? On e-voting and privacy p. 5

14 Should a server decrypt? A voting server could possess a decryption key for every voter. But... The Estonian Riigikogu Valimise seadus 1 says: (2) Riigikogu liikmete valimised on vabad, üldised, ühetaolised ja otsesed. Hääletamine on salajane. Can we claim privacy if some server can decode everything? Even threshold trust does not solve the essential problem if t + 1 servers are compromized, the votes become public. On e-voting and privacy p. 5

15 Homomorphic cryptography It is possible first to combine all the cryptograms of the votes to one large cryptogram and decode that one to obtain the sum of all of them. On e-voting and privacy p. 6

16 Homomorphic cryptography It is possible first to combine all the cryptograms of the votes to one large cryptogram and decode that one to obtain the sum of all of them. We need a special (so-called homomorphic) underlying cryptosystem for that (ElGamal, Paillier, Damgård-Jurik are fine) On e-voting and privacy p. 6

17 Homomorphic cryptography It is possible first to combine all the cryptograms of the votes to one large cryptogram and decode that one to obtain the sum of all of them. We need a special (so-called homomorphic) underlying cryptosystem for that (ElGamal, Paillier, Damgård-Jurik are fine) Do they help? On e-voting and privacy p. 6

18 Homomorphic cryptography It is possible first to combine all the cryptograms of the votes to one large cryptogram and decode that one to obtain the sum of all of them. We need a special (so-called homomorphic) underlying cryptosystem for that (ElGamal, Paillier, Damgård-Jurik are fine) Do they help? No, as every single vote can be decoded just like the whole sum. On e-voting and privacy p. 6

19 Anything else doesn t work either. On e-voting and privacy p. 7

20 Anything else doesn t work either. Theorem. If an electronic voting system is capable of decoding the result of voting by any subset of voters, it is possible to decode every single vote. On e-voting and privacy p. 7

21 Anything else doesn t work either. Theorem. If an electronic voting system is capable of decoding the result of voting by any subset of voters, it is possible to decode every single vote. Proof. Say, the set of voters is X. Take any x X and decode X together with X \ {x}. The difference of the results gives x s vote. On e-voting and privacy p. 7

22 Now what? The only way to try design a privacy-preserving voting system is to design it for a predetermined set of voters (so-called boardroom voting ). On e-voting and privacy p. 8

23 Now what? The only way to try design a privacy-preserving voting system is to design it for a predetermined set of voters (so-called boardroom voting ). The good side: we do not have to be very concerned about the possibility that some party leaves the boardroom in the middle of the action. On e-voting and privacy p. 8

24 Now what? The only way to try design a privacy-preserving voting system is to design it for a predetermined set of voters (so-called boardroom voting ). The good side: we do not have to be very concerned about the possibility that some party leaves the boardroom in the middle of the action. The bad side: the resulting scheme is probably not very practical... On e-voting and privacy p. 8

25 Now what? The only way to try design a privacy-preserving voting system is to design it for a predetermined set of voters (so-called boardroom voting ). The good side: we do not have to be very concerned about the possibility that some party leaves the boardroom in the middle of the action. The bad side: the resulting scheme is probably not very practical but still hopefully applicable in some limited setting. On e-voting and privacy p. 8

26 Planning the protocol The voters should still encrypt their votes. On e-voting and privacy p. 9

27 Planning the protocol The voters should still encrypt their votes. No-one else should possess the respective decryption keys. On e-voting and privacy p. 9

28 Planning the protocol The voters should still encrypt their votes. No-one else should possess the respective decryption keys. Thus, the voters should decrypt their own votes. On e-voting and privacy p. 9

29 Planning the protocol The voters should still encrypt their votes. No-one else should possess the respective decryption keys. Thus, the voters should decrypt their own votes. Consequently, our protocol should contain (at least) two rounds. On e-voting and privacy p. 9

30 Setting the protocol up Let us have the voters A 1, A 2,..., A n. On e-voting and privacy p. 10

31 Setting the protocol up Let us have the voters A 1, A 2,..., A n. Choose a group G and an element g of large order so that the respective discrete logarithm problem is hard. On e-voting and privacy p. 10

32 Setting the protocol up Let us have the voters A 1, A 2,..., A n. Choose a group G and an element g of large order so that the respective discrete logarithm problem is hard. Z p and its generator g for a good choice of prime p will do. On e-voting and privacy p. 10

33 Setting the protocol up Let us have the voters A 1, A 2,..., A n. Choose a group G and an element g of large order so that the respective discrete logarithm problem is hard. Z p and its generator g for a good choice of prime p will do. Each party A i chooses his vote v i and a random exponent invertible in Z p 1. On e-voting and privacy p. 10

34 Protocol: encryption A 1 : g a 1 On e-voting and privacy p. 11

35 Protocol: encryption A 1 : g a 1 A 2 : (g a 1 )a 2 = ga 1a 2 On e-voting and privacy p. 11

36 Protocol: encryption A 1 : g a 1 A 2 : (g a 1 )a 2 = ga 1a 2... On e-voting and privacy p. 11

37 Protocol: encryption A 1 : g a 1 A 2 : (g a 1 )a 2 = ga 1a 2... A n : g a 1a 2...a n On e-voting and privacy p. 11

38 Protocol: decryption A 1 : (g a 1a 2...a n ) a 1 1 v 1 = gv 1a 2...a n On e-voting and privacy p. 12

39 Protocol: decryption A 1 : (g a 1a 2...a n ) a 1 1 v 1 = gv 1a 2...a n A 2 : (g v 1a 2...a n ) a 1 2 v 2 = gv 1v 2 a 3...a n On e-voting and privacy p. 12

40 Protocol: decryption A 1 : (g a 1a 2...a n ) a 1 1 v 1 = gv 1a 2...a n A 2 : (g v 1a 2...a n ) a 1 2 v 2 = gv 1v 2 a 3...a n... On e-voting and privacy p. 12

41 Protocol: decryption A 1 : (g a 1a 2...a n ) a 1 1 v 1 = gv 1a 2...a n A 2 : (g v 1a 2...a n ) a 1 2 v 2 = gv 1v 2 a 3...a n... A n : g v 1v 2...v n On e-voting and privacy p. 12

42 Protocol: decryption A 1 : (g a 1a 2...a n ) a 1 1 v 1 = gv 1a 2...a n A 2 : (g v 1a 2...a n ) a 1 2 v 2 = gv 1v 2 a 3...a n... A n : g v 1v 2...v n In order to obtain the result of the voting, we must solve limited discrete logarithm problem by raising g to all possible powers v 1 v 2...v n and comparing the results to the output of the protocol. On e-voting and privacy p. 12

43 All-against-one attack Say, A 2,..., A n choose a 2 =... = a n = 1. On e-voting and privacy p. 13

44 All-against-one attack Say, A 2,..., A n choose a 2 =... = a n = 1. Then A 1 computes g a 1 in the first round and (g a 1 )a 1 1 v 1 = gv 1 in the second. On e-voting and privacy p. 13

45 All-against-one attack Say, A 2,..., A n choose a 2 =... = a n = 1. Then A 1 computes g a 1 in the first round and (g a 1 )a 1 1 v 1 = gv 1 in the second. Then v 1 can be found by solving the limited discrete logarithm problem. On e-voting and privacy p. 13

46 All-against-one attack Say, A 2,..., A n choose a 2 =... = a n = 1. Then A 1 computes g a 1 in the first round and (g a 1 )a 1 1 v 1 = gv 1 in the second. Then v 1 can be found by solving the limited discrete logarithm problem. But hey, if A 2,..., A n collaborate, they can find out v i anyway! On e-voting and privacy p. 13

47 All-against-one attack Say, A 2,..., A n choose a 2 =... = a n = 1. Then A 1 computes g a 1 in the first round and (g a 1 )a 1 1 v 1 = gv 1 in the second. Then v 1 can be found by solving the limited discrete logarithm problem. But hey, if A 2,..., A n collaborate, they can find out v i anyway! We have an interesting situation: in order for my vote to be secure, at least one other voter has to be honest! On e-voting and privacy p. 13

48 Is one other honest guy enough? No, it s not. On e-voting and privacy p. 14

49 Is one other honest guy enough? No, it s not. A n can give g a 1 as his first round output as this value is public anyway. On e-voting and privacy p. 14

50 Is one other honest guy enough? No, it s not. A n can give g a 1 as his first round output as this value is public anyway. In order to do it legally, A n has to compute the true discrete logarithm log g a 1 g a 2...a n. On e-voting and privacy p. 14

51 Is one other honest guy enough? No, it s not. A n can give g a 1 as his first round output as this value is public anyway. In order to do it legally, A n has to compute the true discrete logarithm log g a 1 g a 2...a n. This can be avoided by requiring the proofs of knowledge of their own exponents from everybody. On e-voting and privacy p. 14

52 Is one other honest guy enough? No, it s not. A n can give g a 1 as his first round output as this value is public anyway. In order to do it legally, A n has to compute the true discrete logarithm log g a 1 g a 2...a n. This can be avoided by requiring the proofs of knowledge of their own exponents from everybody. Zero-knowledge proofs can do the job. On e-voting and privacy p. 14

53 Good and bad sides + The protocol is very efficient only 2n modular exponents are needed to compute the result On e-voting and privacy p. 15

54 Good and bad sides + The protocol is very efficient only 2n modular exponents are needed to compute the result This is good compared to 2n 2 + 2n done in the protocol by Kiayias and Yung... On e-voting and privacy p. 15

55 Good and bad sides + The protocol is very efficient only 2n modular exponents are needed to compute the result This is good compared to 2n 2 + 2n done in the protocol by Kiayias and Yung and in a way as efficient as it can get everybody has to perform at least 2 operations. On e-voting and privacy p. 15

56 Good and bad sides + The protocol is very efficient only 2n modular exponents are needed to compute the result This is good compared to 2n 2 + 2n done in the protocol by Kiayias and Yung and in a way as efficient as it can get everybody has to perform at least 2 operations. The rounds have to be carried out in the predefined order, otherwise it may be possible to decode some votes. On e-voting and privacy p. 15

57 Anything else wrong? Probably yes, at least points to be improved. On e-voting and privacy p. 16

58 Anything else wrong? Probably yes, at least points to be improved. We could still try to cope with some parties failing to complete the protocol. On e-voting and privacy p. 16

59 Anything else wrong? Probably yes, at least points to be improved. We could still try to cope with some parties failing to complete the protocol. A n learns the sum of other votes before the others do. He could change his mind before voting based on that information. On e-voting and privacy p. 16

60 Anything else wrong? Probably yes, at least points to be improved. We could still try to cope with some parties failing to complete the protocol. A n learns the sum of other votes before the others do. He could change his mind before voting based on that information. Etc. Security proofs/improvements are needed open call for student contributions! On e-voting and privacy p. 16

61 That s how far we are. Questions? On e-voting and privacy p. 17

Addressing the Challenges of e-voting Through Crypto Design

Addressing the Challenges of e-voting Through Crypto Design Thomas Zacharias University of Edinburgh 29 November 2017 Scotland s Democratic Future: Exploring Electronic Voting Scottish Government and University