Open-Audit Voting

Open-Audit Voting
How to let anyone
verify an election
Ben Adida
Harvard University

Université Catholique de Louvain
3 February 2009

Saturday, February 14, 2009

The Point of An Election



“The People have spoken....
the bastards!”
Dick Tuck
1966 Concession Speech



“The People have spoken....
the bastards!”
Dick Tuck
1966 Concession Speech

Provide enough evidence
to convince the loser.


quot;That's for me and a
button to know.quot;
Joe, the plumber.


“When I ﬁnally saw
the results of our tests,
I thought I was going to throw up.”
Secretary of State of Ohio,
two weeks before 2008 US Presidential Elections


Fashionable Voting

http://www.cs.uiowa.edu/~jones/voting/pictures/8


Fashionable Voting

9

Voting is a
fundamentally
difﬁcult problem.

10

Wooten got the news from his wife, Roxanne,
who went to City Hall on Wednesday
to see the election results.

quot;She saw my name with zero votes by it.
She came home and asked me if
I had voted for myself or not.quot;

11

12

14

12

12

14

12

1 person, 1 vote

12

Enforced Privacy
to ensure each voter
votes in his/her
own interest

13

http://www.cs.uiowa.edu/~jones/voting/pictures/ 14

1892 - Australian Ballot

http://www.cs.uiowa.edu/~jones/voting/pictures/ 15

The Ballot Handoff

McCain

Alice the Voter
16

The Ballot Handoff

McCain Obama
Obama
Obama

McCain
McCain
McCain

Alice the Voter
16

The Ballot Handoff

McCain Obama
Obama
Obama

McCain
McCain
McCain

Alice the Voter Black Box
16

Chain of Custody

19

Chain of Custody
1
/*
* source
* code
*/

if (...

Vendor

19

Chain of Custody
1
/*
* source
* code
Voting */
2
Machine
if (...

Vendor

19

Chain of Custody
1
/*
* source
* code
Polling Voting */
3 2
Location Machine
if (...

Vendor

19

Chain of Custody
1
/*
* source
* code
Polling Voting */
3 2
Location Machine
if (...

Vendor
4

Alice

19

Chain of Custody
1
/*
* source
* code
Polling Voting */
3 2
Location Machine
if (...

Vendor
4

Alice

5

Ballot Box Collection

19

Chain of Custody
1
/*
* source
* code
Polling Voting */
3 2
Location Machine
if (...

Vendor
4

Alice
Results
5 6 .....


19

Chain of Custody
1
/*
* source
* code
Polling Voting */
3 2
Location Machine
if (...

Vendor
4

Alice
Results
5 6 .....

Black Box
19

The Cost of Secrecy


But Secrecy is Important.

Secret Ballot implemented in Chile in 1958.

“the secrecy of the ballot [...] has
ﬁrst-order implications for resource
allocation, political outcomes, and social efﬁciency.”

[BalandRobinson 2004]


Computers have
obscured the process.

22

Computers have
obscured the process.

What about
computer science?
22

Cryptography
solving problems
that initially appear to have
conﬂicting requirements.

23

Public-Key Encryption

Customer

24


public key

Customer

24


public key
enc(cc number)
Customer

24

Secret Ballot vs.
Veriﬁability

Voting System
convince
Alice

Carl the Coercer

25

Secret Ballot vs.
Veriﬁability

Voting System
convince
Alice

Carl the Coercer
[Chaum81], [Benaloh85], [PIK93], [BenalohTuinstra92], [SK94], [Neff2001], [FS2001],
[Chaum2004], [Neff2004], [Ryan2004], [Chaum2005]

Punchscan, Scantegrity I & II, Civitas, ThreeBallot, Prêt-à-Voter, Scratch & Vote, ...
25

Public Ballots
Bulletin Board

Bob:
McCain

Carol:
Obama

26

Public Ballots
Bulletin Board

Bob:
McCain

Carol:
Obama

Alice
26

Public Ballots
Bulletin Board

Alice: Bob:
Obama McCain

Carol:
Obama

Alice
26

Public Ballots
Bulletin Board

Alice: Bob:
Obama McCain

Carol:
Obama
Tally

Obama....2
McCain....1
Alice
26

Encrypted Public Ballots
Bulletin Board

Alice: Bob:
Rice Clinton

Carol:
Rice
Tally

Obama....2
McCain....1
Alice
27

Bulletin Board

Alice: Bob:
Rice Clinton

Carol:
Ali Rice
ce
ver Tally
i ﬁes
he
rv Obama....2
ote
McCain....1
Alice
27

Bulletin Board

Alice: Bob:
Rice Clinton

Carol:
lly
Ali ta
Rice
ce e
thTally
ver es
riﬁ
i ﬁes
e ve
he n
ryo
rv ve Obama....2
E
ote
McCain....1
Alice
27

End-to-End Veriﬁcation


/*
* source
* code
Voting */
Machine
if (...

Vendor

Polling
Location


/*
* source
* code
Voting */
Machine
if (...

Vendor

Ballot Box /
Bulletin Board
Polling
Location

Alice


/*
* source
* code
Voting */
Machine
if (...

Vendor
Results
Ballot Box /
Bulletin Board
Polling
.....
Location

Alice


/*
* source
* code
Voting */
Machine
if (...

Vendor
Results
Ballot Box /
Bulletin Board
Polling
.....
Location

1
Alice
Receipt


/*
* source
* code
Voting */
Machine
if (...

Vendor
Results
Ballot Box /
Bulletin Board
Polling
.....
Location

1 2
Alice
Receipt


How can we verify
operations on
encrypted data?

Mathematical Proofs.
29

Zero-Knowledge Proof

30

President:
President:
Mickey Mouse
President:
Mickey Mouse
President:
Mickey Mouse
President:
Mickey Mouse
President:
Mickey Mouse
Vote For:
Mickey Mouse
Obama
Vote For:
Obama

30

President:
President:
Mickey Mouse
President:
Mickey Mouse
President:
Mickey Mouse
President:
Mickey Mouse
President:
Mickey Mouse
Vote For:
Mickey Mouse
Obama
Vote For:
Obama

This last envelope
likely contains “Obama”
30

President: President:
Mickey Mouse Mickey Mouse
Vote For: Vote For:
McCain
Obama Paul

Open envelopes don’t prove
anything after the fact.
31

Helios


“And there are cryptographic
techniques that can be used to
achieve software independence so
that even if there's a bug in the
software, you'll detect if there's a
problem. But those are not ready
for prime time in my opinion.”

Avi Rubin, 7/9/2008

“But with cryptography, you’re just
moving the black box. Few people really
understand it or trust it.”

California Sec. of State, 7/30/2008
(paraphrased)


Simplify

Low-Coercion Elections

Web-based


Technical Concepts


Technical Concepts
- Probabilistic Encryption & Threshold Decryption.
posting ciphertexts safely on a bulletin board


Technical Concepts
- Homomorphic Tallying.
no write-ins, proofs of correct plaintext


Technical Concepts
- Benaloh Challenge.
cast or audit, authenticate only upon cast


Technical Concepts
- Benaloh Challenge.
cast or audit, authenticate only upon cast
- In-Browser Encryption.
plaintext only in user’s browser


Probabilistic Encryption &
Threshold Decryption


Keypair consists of a public key pk and a secret key sk .



Enc pk
quot;Obamaquot; 8b5637



Enc pk

Enc pk
quot;McCainquot; c5de34



Enc pk

Enc pk
quot;McCainquot; c5de34

Enc pk
quot;Obamaquot; a4b395


Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.

8b5637



Dec sk1 b739cb

8b5637



Dec sk1 b739cb

Dec sk2 261ad7
8b5637



Dec sk1 b739cb

Dec sk2 261ad7
8b5637
Dec sk3 7231bc



Dec sk1 b739cb

Dec sk2 261ad7
8b5637
Dec sk3 7231bc

Dec sk4 8239ba



Dec sk1 b739cb

Dec sk2 261ad7
8b5637 quot;Obamaquot;
Dec sk3 7231bc

Dec sk4 8239ba


Homomorphic
Tallying


Homomorphic Property

First: r’th residuosity [Benaloh85]
Also: Paillier Cryptosystem [P99] 41


Enc(m1 ) × Enc(m2 ) = Enc(m1 + m2 )



Enc(m1 ) × Enc(m2 ) = Enc(m1 + m2 )

then we can simply
add votes “under cover” of encryption!


Homomorphic Tally
Vote for None Adam
0001 0000 0000 0000 Vote for

Vote for Vote for Bob
Obama
0000 0001 0000 0000

Vote for McCain
0000 0000 0001 0000 Vote for Charlie

0000 0000 0000 0001 Vote for David

0003 0001 0008 0002
0004 0006 0005 Sample Tally

[B+2001, P1999]
42

Benaloh
Casting Protocol


http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg


Alice



quot;Obamaquot;

Alice



quot;Obamaquot;

Encrypted
Ballot
Alice



quot;Obamaquot;

Encrypted
Ballot
Alice

Alice



quot;Obamaquot;

Encrypted
Ballot
Alice

quot;AUDITquot;

Alice



quot;Obamaquot;

Encrypted
Ballot
Alice

quot;AUDITquot;
Decrypted
Ballot
Alice



quot;Obamaquot;

Encrypted
Ballot
Alice

quot;AUDITquot;
Decrypted
Ballot
Alice

Encrypted Decrypted
Ballot Ballot

VERIFICATION



quot;Obamaquot;

Encrypted
Ballot
Alice

quot;AUDITquot;
Decrypted
Ballot
Alice Alice

Encrypted Decrypted
Ballot Ballot

VERIFICATION



quot;Obamaquot;

Encrypted
Ballot
Alice

quot;AUDITquot; quot;CASTquot;
Decrypted
Ballot
Alice Alice

Encrypted Decrypted
Ballot Ballot

VERIFICATION



quot;Obamaquot;

Encrypted
Ballot
Alice

Decrypted Signed
Ballot Encrypted
Ballot
Alice Alice

Encrypted Decrypted
Ballot Ballot

VERIFICATION



quot;Obamaquot;

Encrypted
Ballot
Alice

Decrypted Signed
Ballot Encrypted
Ballot
Alice Alice

Encrypted Decrypted
Ballot Ballot

VERIFICATION
Alice



quot;Obamaquot;

Encrypted
Ballot
Alice

Decrypted Signed
Ballot Encrypted
Ballot
Alice Alice

Encrypted Decrypted
Ballot Ballot
Signed
Encrypted
Ballot

VERIFICATION
Alice



Web Browser Tricks


Single-Page Web App

<a href=“javascript:doStuff();”>
next page
</a>


LiveConnect


LiveConnect

var p = new java.math.BigInteger(“13”,10);


LiveConnect


var p = lc_applet.newBigInteger(“13”,10);


LiveConnect



var GEN = new java.security.SecureRandom();


LiveConnect



var GEN = new java.security.SecureRandom();

var GEN = lc_applet.newSecureRandom();


Data URIs


Data URIs
window.open(“data:text/plain,” + content);


Data URIs
window.open(“data:text/plain,” + content);

w = window.open(quot;quot;);
w.document.open(quot;text/plainquot;);
w.document.write(content);
w.document.close();


window.postMessage()



w = window.open(HELIOS_API_URL);

w.postMessage(“election 123”, helios_host);



w = window.open(HELIOS_API_URL);

w.postMessage(“election 123”, helios_host);

window.addEventListener(“message”, ...);

window.opener.postMessage(election_data);


Helios System Details


- Python & JavaScript logic & crypto


- Free/Open-Source stack


- Deployed on Google App Engine


- Deployed on Apache/Python/PostgreSQL
at UCL!


- Deployed on Apache/Python/PostgreSQL
at UCL!
- Customizable
authentication, look-and-feel, translations


Demo


Is Open-Audit Voting Too
Difﬁcult to Understand?



- It’s more difﬁcult than counting paper ballots.



- Simplicity hides a lack of auditability: how can you
trust that a ballot box was not tampered with?



- With open-audit, anyone can learn the math and
write their own program.



- With open-audit, anyone can learn the math and
write their own program.
- If there’s fraud, there’s evidence!
All you need is one person to point it out.


Questions?

Ben Adida
ben@adida.net
Harvard University

Université Catholique de Louvain
3 February 2009
53

Open-Audit Voting

Recommandé

Recommandé

Contenu connexe

Dernier

Dernier (20)

En vedette

En vedette (20)

Open-Audit Voting

Notes de l'éditeur