Natural Strategic Abilities in Voting Protocols

Abstract

Security properties are often focused on the technological side of the system. One implicitly assumes that the users will behave in the right way to preserve the property at hand. In real life, this cannot be taken for granted. In particular, security mechanisms that are difficult and costly to use are often ignored by the users, and do not really defend the system against possible attacks. Here, we propose a graded notion of security based on the complexity of the user's strategic behavior. More precisely, we suggest that the level to which a security property ϕ is satisfied can be defined in terms of (a) the complexity of the strategy that the voter needs to execute to make ϕ true, and (b) the resources that the user must employ on the way. The simpler and cheaper to obtain ϕ, the higher the degree of security. We demonstrate how the idea works in a case study based on an electronic voting scenario. To this end, we model the vVote implementation of the Prêt à Voter voting protocol for coercion-resistant and voter-verifiable elections. Then, we identify "natural" strategies for the voter to obtain receipt-freeness, and measure the voter's effort that they require. We also look at how hard it is for the coercer to compromise the election through a randomization attack.

STV+AGR: Towards Verification of Strategic Ability Using Assume-Guarantee Reasoning

“…A good example of a specific domain is formal verification of voting procedures and elections, with a number of classical requirements, such as election integrity, ballot secrecy, receipt-freeness, and voter-verifiability [42,44]. Some recent case studies [23,25,28] have shown that practical verification of such scenarios is still outside of reach. Some tools do not support intuitive specification and validation of models; some others have limited property specification languages.…”

“…Unfortunately, model checking of agents with imperfect information is ∆ P 2 -to PSPACE-complete for memoryless strategies [9,22,43] and EXPTIME-complete to undecidable for agents with perfect recall [18,20]; also, the problem does not admit simple incremental solutions [10,16,17]. This has been confirmed in experiments [11,12,21,26,40] and case studies [23,25,28].…”