Auditing for privacy in threshold PKE e-voting

Abstract

The importance of voter auditing in order to ensure election integrity has been extensively studied in the e-voting literature. On the other hand, the necessity of auditing to protect voter privacy in an e-voting system has been mostly overlooked. This work investigates election privacy issues that appear in the state-of-the-art implementations of e-voting systems that apply threshold public key encryption (TPKE) in the client like Helios and use a bulletin board (BB). More specifically, it is shown that without PKI support or-more generally-authenticated BB "append" operations, such systems are vulnerable to attacks where the malicious election server can act as a man-in-the-middle between the election trustees and the voters, hence it can learn how the voters have voted. As countermeasure for this type of man-in-the-middle attacks, this work suggests compulsory trustee auditing which should be executed either (i) immediately after the election setup phase, if the BB is consistent, or (ii) right after the voting phase, if the BB is corrupted. Finally, this work studies the impact of verifying the cryptographic (zero-knowledge) proofs posted in the BB from a privacy aspect; namely, it is shown that proof auditing implies significantly stronger provable privacy guarantee for a TPKE e-voting system against covert adversaries (i.e., adversaries that may deviate arbitrarily from the protocol specification, but do not wish to be detected), given that the proof is carried out via standard reduction to the security of the underlying TPKE scheme.

Desafios e Soluções em Sistemas de Votação Eletrônica: Um Mapeamento Sistemático

“…Outro exemploé o protocolo TPKE, poisé suscetível ao ataque MITM, o que pode causar a perda de privacidade do eleitor, [Kiayias et al 2017, Kiayias et al 2015].…”

“…Entre os sistemas de votação, o que mais teve destaque negativo foi o Hélios, que se trata de um sistema de votação pela Internet. Estudos como os de [Kiayias et al 2017] e [Srinivasan et al 2013] mostram que esse sistemaé suscetível ao ataque MITM e ataque de enchimento de cédulas, podendo sofrer também de uma vulnerabilidade que pode revelar o voto do eleitor [Kiayias et al 2017, Cortier andSmyth 2013]. Além disso o estudo de [Heiderich et al 2011] mostra que esse sistema não implementa o cabeçalho HTTP.…”