SoK: Secure E-Voting with Everlasting Privacy

Abstract

Vote privacy is a fundamental right, which needs to be protected not only during an election, or for a limited time afterwards, but for the foreseeable future. Numerous electronic voting (e-voting) protocols have been proposed to address this challenge, striving for everlasting privacy. This property guarantees that even computationally unbounded adversaries cannot break privacy of past elections. The broad interest in secure e-voting with everlasting privacy has spawned a large variety of protocols over the last three decades. These protocols differ in many aspects, in particular the precise security properties they aim for, the threat scenarios they consider, and the privacy-preserving techniques they employ. Unfortunately, these differences are often opaque, making analysis and comparison cumbersome. In order to overcome this non-transparent state of affairs, we systematically analyze all e-voting protocols designed to provide everlasting privacy. First, we illustrate the relations and dependencies between all these different protocols. Next, we analyze in depth which protocols do provide secure and efficient approaches to e-voting with everlasting privacy under realistic assumptions, and which ones do not. Eventually, based on our extensive and detailed treatment, we identify which research problems in this field have already been solved, and which ones are still open. Altogether, our work offers a well - founded reference point for conducting research on secure e - voting with everlasting privacy as well as for future - proofing privacy in real - world electronic elections.

DeVoS: Deniable Yet Verifiable Vote Updating

“…Beyond the individual pros and cons of the various proposals, a recent systematic review has identified a global problem [28]: there is no secure and efficient Internet voting system that can simultaneously mitigate the effects of malicious influence and keep votes secret in the long term. In fact, in all state-of-the-art systems that limit coercion or vote buying, such as BeleniosRF, JCJ/Civitas or VoteAgain, votes are encrypted using the tellers' public key and the resulting ciphertexts are then posted on a bulletin board for verification purposes.…”

“…This state of research is unsatisfactory because many elections require confidentiality to be guaranteed not just for some time, but for several decades because voters may have to fear negative consequences even if their individual choices are revealed, say, 10 or 20 years after the election. Instead, electronic voting systems should provide everlasting privacy [28], i.e. privacy without relying on any hardness assumption.…”

“…(2) Strong participation privacy: DeVoS hides which voters did and did not vote, even if the voters who did vote try to convince a potential coercer otherwise. (3) Practical everlasting privacy: DeVoS is fully compatible with Perfectly Private Audit Trail (PPAT) [15], a state-of-the-art verifiable Internet voting protocol with everlasting privacy from the public (according to [28]). In this way, DeVoS can be extended to make all of its privacy features (i.e., deniable vote updating, strong participation privacy, and basic vote privacy) unconditionally private from the public, and thus long-term.…”

“…DeVoS is fully compatible with the homomorphic and the shuffling versions of the Perfectly Private Audit Trail (PPAT) voting protocol [15]. According to a recent systematization-of-knowledge [28], the PPAT protocols are stateof-art secure Internet voting protocols with practical everlasting privacy. In such protocols, privacy is guaranteed unconditionally towards the public, meaning that even a computationally unbounded observer would not be able to break vote privacy.…”