Defining Privacy for Weighted Votes, Single and Multi-voter Coercion

Abstract

Abstract. Most existing formal privacy definitions for voting protocols are based on observational equivalence between two situations where two voters swap their votes. These definitions are unsuitable for cases where votes are weighted. In such a case swapping two votes can result in a different outcome and both situations become trivially distinguishable. We present a definition for privacy in voting protocols in the applied π-calculus that addresses this problem. Using our model, we are also able to define multi-voter coercion, i.e. situations where several voters are attacked at the same time. Then we prove that under certain realistic assumptions a protocol secure against coercion of a single voter is also secure against coercion of multiple voters. This applies for ReceiptFreeness as well as Coercion-Resistance.

SoK: A Comprehensive Analysis of Game-Based Ballot Privacy Definitions

“…We unveil that some previous definitions present shortcomings that have gone unnoticed: either ballot secrecy and election verifiability are incompatible [22], or ballot secrecy does not guarantee that the choices of the voters remain private once the election result is published [19], [21]. We also discuss known limitations of the approaches in [23], [25], [24], [31], [33]. A summary of our findings is shown in Table I, at the end of this section.…”

“…It also resembles the symbolic vote privacy definition by Delaune, Kremer and Ryan [31], which states that "no party receives information which would allow them to distinguish one situation from another one in which two voters swap their votes". Dreier, Lafoucarde and Laknech have generalised the swap-equivalent symbolic privacy definition to weighted votes [33].…”

Enforcing Privacy in the Presence of Others: Notions, Formalisations and Relations

“…So far, attempts at formalising privacy have usually been domain-specific (e.g., [22,2,10,3,4,23,11,12,24]). We advocate a domain-independent approach to privacy, and develop a formal framework to achieve this in Sect.…”

When Are Three Voters Enough for Privacy Properties?

“…To our knowledge, the only other reduction result applying to voting protocols was proposed by Dreier et al [21]. Their result states that it is sufficient to prove vote privacy for two honest voters when the protocol is observationally equivalent to a protocol consisting of the parallel composition (not sharing any secret) of a partition of the set of voters.…”