Epoque: Practical End-to-End Verifiable Post-Quantum-Secure E-Voting

Abstract

The ultimate goal in modern secure e-voting is to enable everyone to verify whether the final election result correctly reflects the votes chosen by the (human) voters, without exposing how each individual voted. These fundamental security properties are called end-to-end verifiability and voter privacy. Unfortunately, it turns out to be very challenging to pursue these properties simultaneously, especially when the latter must be future-proofed against the rise of quantum computers. In this work, we show, for the first time, a practical approach to do this.We present Epoque, the first end-to-end verifiable, voterprivate, post-quantum-secure homomorphic e-voting protocol. It achieves its properties through the combination of practical lattice-based cryptographic primitives only, in a novel way. We formally prove all our security claims under common trust and hardness assumptions. At the core of Epoque lies an efficient identity-based encryption (IBE) scheme with blazingly fast master-key decryption. It is the component that makes the efficient tallying of thousands or millions of ballots a practical possibility. In order to demonstrate its practicality, we fully implemented it and provide detailed benchmarks; we believe this latter contribution is of independent interest beyond the specific e-voting application.

How Efficient are Replay Attacks against Vote Privacy? A Formal Quantitative Analysis

“…In this example, we choose polling station S53P in Mustamäe linnaosa where 1,404 valid votes were cast. 8 The public partial election result at this polling station was (14,233,22,82,9,210,31,702,5,92,4). 9 Example 2 (Germany, Landtag Election 2021): In the Landtag (parliamentary) election in the state of Rhineland-Palatinate in 2021, 1,922,579 votes were cast in total.…”

“…8 The public partial election result at this polling station was (14,233,22,82,9,210,31,702,5,92,4). 9 Example 2 (Germany, Landtag Election 2021): In the Landtag (parliamentary) election in the state of Rhineland-Palatinate in 2021, 1,922,579 votes were cast in total. The number of polling stations was (roughly) 2,300, which results 8 See https://rk2019.valimised.ee/en/voting-result/ local-municipality-0482-voting-result.html (accessed 11.04.2022).…”

“…The number of polling stations was (roughly) 2,300, which results 8 See https://rk2019.valimised.ee/en/voting-result/ local-municipality-0482-voting-result.html (accessed 11.04.2022). 9 The public election result is even more fine-grained because the number of votes per candidate on each party list is revealed. We aggregated the number of votes for each party list and consider adversaries who merely know the aggregated result; this makes our overall argument only stronger.…”

“…III). The KTV privacy definition is not only established and widely used (see, e.g., [3,9,28,29,32]) but it proves particularly useful for our purposes because it allows us to measure the loss of vote privacy and thus the efficiency of replay attacks.…”

Shorter Lattice-Based Zero-Knowledge Proofs for the Correctness of a Shuffle

“…This alternative can only work with elections where the result can be represented as the addition of individual votes, but it can not implement write-ins, that are easily handled by mix-nets. The same limitation applies to the recent work [11], which proposes an elegant way of solving some security issues in [19]. Gjøsteen and Strand also propose the use of fully homomorphic encryption to construct a decryption circuit in [23], but while theoretically interesting it is still far from efficient.…”