Sebery J.Cryptography.An introduction to computer security.1989

identify ballots unless she can try all possible random numbers for rj; rk; r` or collude with Leo. The protocol is complete as the nal result of elections can be trusted if all voters are honest. To prove that the protocol is sound we need to de ne possible actions of a dishonest voter. The voter can

1.Refuse to vote { this will be detected by rst honest voter.

2.Cast multiple votes { this will be also detected by honest voters as the number of ballots will be greater than the number of voters (this is the unreusability property).

3.Substitute ballots { any voter can do this during rst cycle for their own ballots, if an attacker substitutes a ballot of some other voter, this will be detected with high probability unless the attacker has broken the corresponding public key cryptosystem (this is the veri ability property).

Note that the protocol has some drawbacks including:

{An excessive computation overhead when the number of voters is getting bigger (the protocol is not practical for large scale elections).

{A diÆculty with the initialization of the protocol. The agreement about the list of voters must be done collectively as there is no central trusted authority.

{All voters must be present at the same time to execute the protocol.

{The protocol fails if there is a voter who refuses to follow it.

15.1.2 The Chaum Protocol

In 1981 Chaum designed a protocol that uses a trusted mix to implement an anonymous channel and digital pseudonyms to ensure voter privacy [86].

In most cases, any message sent over communication network could be traced back to its origin (for instance, in any packet switching network, it is possible to identify the sender from headings of the packets). To thwart traceability, Chaum suggested using an anonymous channel. The main part of it is an active entity called the mix. The mix is a trusted authority that plays the same role as Joan for both Keith and Leo in the previous protocol at the very beginning of the voting stage.

The mix sets up its service by announcing its public encryption algorithm Ex and keeping the decryption algorithm Dx secret. Needless to say, anybody can get authentic Ex. If a voter Vi wants to send a message m anonymously to other voter, say Vj, Vi follows the following steps.

502 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

1.Vi gets the authentic Ex of the mix.

2.Vi creates a cryptogram

Ex(r; m; aj )

where m 2 M is the message, r is a random integer used to prevent exhaustive attacks if the message space M is small and aj is the address of voter Vj (the destination).

3.Vi forwards the cryptogram to the mix that decrypts it using its private Dx.

4.The mix sends the message m to the destination ai.

If Vi cares about privacy of m, Vi may send m encrypted using the public encryption algorithm of Vj. To prevent attacks based on the knowledge of the sequence of cryptograms coming to the mix, the mix changes the order of outcoming messages. The mix may also prevent reply attacks by keeping the random strings r and checking subsequent cryptograms against it.

A digital pseudonym is a public key used to verify the signature made by an anonymous voter (who holds the matching private key).

Chaum protocol

Assumptions: 1. There is a trusted administrator (authority) T A.

2.Voters and administrator communicate via an anonymous channel (there is a trusted mix).

3.Each voter has got a pseudonym.

Initialization stage: 1. T A prepares the information for voting including bundle of cryptograms (one cryptogram per voter). Any cryptogram Ev(r; K; ) includes the public key K and the pseudonym .

2.T A ! Mix : fEv(ri; Ki; i) j i = 1; : : : ; ng, where n is the number of eligible voters.

3.The mix shu es the cryptograms and

Mix ! Vi : Ev (ri; Ki; i)

for i = 1; : : : ; n. The mix also conveys general information about how to vote (encrypted using the voter's public key). T A does not know which cryptogram goes to which voter. Clearly, the mix has to have the list of all eligible voters.

Voting and counting stage: 1. Each registered voter Vi prepares their ballot of the form

Ev(ri; i; EKi (qi; vi))

where ri; qi are random integers, vi is the vote and i; Ki is the pseudonym and the public key given by the mix to Vi, respectively.

2.Vi sends their ballot to the mix.

3.The mix collects all ballots and processes them as a single batch and

outputs a complete list of valid entries ( i; EKi (qi; vi)).

4. The mix communicates the list via a secure channel to T A.

5.T A veri es whether i are valid. If so, T A decrypts the second part, recovers votes vi and counts them. All ballots with invalid pseudonyms are rejected.

In 1988 Chaum published a modi ed version of the protocol [88]. That version uses blind signatures and sender untraceability. For security analysis, we direct the reader to the original papers [86, 88].

15.1.3 Boyd Protocol

The Boyd protocol [53] uses exponentiation modulo a prime p. The security and anonymity depends on the diÆculty of computing the discrete logarithm modulo p. The protocol involves registered voters Vi and a trusted administrator

T A.

504 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

3.T A checks the voter identity. If the check holds, T A records that Vi has registered and returns Biai0 b to Vi.

Voting and counting stage: 1. Voters complete their ballots by using the key

redundancy constant is correct, T A accepts the vote vi.

3.Finally, T A publishes all messages mi together with the result of the election. At this stage each voter can check their random number that clearly identi es the message mi.

The protocol ensures privacy and authenticity of voters [53]. The main drawback of the protocol is that T A can see the votes and produce a false tally by adding votes of its own choice. The nal result of casting is not veri able.

15.1.4 Fujioka-Okamoto-Ohta Protocol

Fujioka, Okamoto and Ohta described a protocol that is more suitable for large scale elections [190]. The players in the protocol are voters, an administrator A and a counter C.

Fujioka-Okamoto-Ohta protocol

Assumptions: 1. The counter communicates with voters via an anonymous channel.

2.Ballots are computed using a bit commitment scheme.

3.Every voter has their own digital signature scheme SG.

4.The administrator uses a blind signature scheme.

The bit commitment scheme uses two functions (f; g). The function f encrypts binary strings into cryptograms (blobs) and the function g decrypt cryptograms (open blobs) and reveals the bits. The blind signature uses two functions (B; U), The function B takes the ballot x and a random integer r and computes the blind message e = B(x; r). The blind message e is then

given to the administrator who signs the blind message and returns the blind signature d. The function U allows to unblind the signature and to retrieve signature of the administrator as SGA(x) = U(d; r).

Registration stage: 1. Vi selects their vote vi, which is typically a binary string and creates a blob for it, i.e.

xi = f (vi; ki): for a random ki.

2. Vi blinds xi, i.e. computes ei = B(xi; ri)

using a random integer ri.

3.Vi signs ei by calculating si = SGi(ei) and sends the triple hIDi; ei; sii to A, i.e.

Vi ! A : hIDi; ei; sii:

where IDi is the identity or name of voter Vi.

4.A veri es whether

a)Vi is eligible to vote,

b)Vi has not already applied for registration, and

c)si is valid.

If the three conditions hold, A generates the certi cate di = SGA(ei) and

A ! Vi : di:

If any of the three conditions is violated, the registration of Vi is declined. 5. When the deadline for registration has passed, the administrator announces the number of voters and publishes the list hIDi; ei; sii of all

registered voters.

Voting stage: 1. Vi retrieves A's signature for xi by unbliding di so yi =

SGA(xi) = U(di; ri).

2.Vi checks whether yi is a signature generated by A. If the check fails, Vi complains by showing the pair (xi; yi). Otherwise, Vi sends the pair (xi; yi) to the counter C via an anonymous channel.

3.C veri es the signature yi of the ballot xi. If the check holds, C puts the

triple h`; xi; yii into a list where ` is the consecutive number assigned to the ballot.

4.C publishes the list after all voters have cast their ballots, i.e.

C ! ? : fh`; xi; yii j i = 1; : : : ; g where is the number of ballots cast.

506 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

Opening and counting stage: Each voter Vi checks whether

1.The number of ballots on the list is equal to the number of voters. If the check fails, voters may reveal their secret random numbers ri and indirectly indicate which ballots are forged.

2.The ballot xi is on the list. If not, Vi complains by showing the valid

pair (xi; yi).

If the checks are successful, Vi sends the key ki with the number ` to C via an anonymous channel. C opens the blob xi using the key ki and retrieves the vote vi = g(xi; ki). The pair (ki; vi) is appended to the entry (xi; yi) on the list. Finally, C counts the tally and announces the results.

It is easy to check that if all parties honestly follow the protocol, then the result of elections is correct. The protocol is complete. A dishonest voter can disrupt election process by sending invalid ballots, but this will be detected in the counting stage (soundness holds). There is a problem when a voter sends an illegal key at the opening stage as, in this case, it is impossible to distinguish dishonest voter from dishonest counter. The privacy of voters is ensured by the blind signature as the administrator never sees voters' ballots. As the voters blinds their ballot using a random string, the privacy is unconditionally secure. Unreusability property holds as each voter can legally obtain one blindly signed ballot by the administrator. The ability to create two di erent and signed by the administrator ballots is equivalent to breaking the blind signature used by the administrator. Note that an outsider cannot vote unless she is able to to break the signature scheme used by voters (eligibility is satis ed). Fairness holds as counting ballots does not a ect the voting (votes are hidden by the bit commitment scheme). The results of voting are veri able as even if both the administrator and counter collude, they cannot change the result of the voting process. The main problem with the protocol is that it requires all registered voters to cast their votes and no voter can abstain from voting. In fact, the failure of a single voter will disrupt the whole election process. Additionally, the vote is xed after the registration phase.

15.1.5 Other Protocols

Iversen [257] designed an electronic election protocol based on privacy homomorphisms. Players in the protocol are voters, candidates, and the government. The communication between voters and candidates is done over a broadcast

channel. Voters may cast their ballots with no need for \synchronization" and there is no need for global computation. The protocol preserves the privacy of votes against a collusion of dishonest voters or any proper subset of dishonest candidates including the government.

Sako and Kilian [446] proposed a voting protocol based on families of homomorphic encryptions, which have a partial compatibility property, generalising a method of Benaloh and Yung [25]. The protocol has a much lower complexity than protocols using anonymous communication channel. It preserves the privacy of voters as long as the centers are honest. The drawback of the protocol is that if all centers conspire, the privacy of voters is violated. Even worse, if a center accidentally or otherwise produces incorrect subtally then the veri cation fails and consequently the entire election will collapse.

Niemi and Renvall described a protocol [375] that prevents buying votes. In traditional voting protocols, the buying is prevented as voters cannot prove that they have voted as agreed. In other words, the buyer has no means to verify how the voter has voted. This is mimicked by attaching to the vote vi an eligibility token ei. Each ballot must consist of the pair (vi; ei). The token ei is generated collectively by all candidates and the voter. Although the voter Vi is con dent as to the authenticity of ei, Vi does not have any means to prove its validity to anybody. Sako and Kilian in [447] present an receipt free protocol that also prevents buying votes. Other protocols for electronic elections can be found in [15, 114].

15.2 Digital Cash

Traditional cash has the following properties:

{It is diÆcult to forge.

{It is untraceable (more precisely coins are untraceable but paper currency can be traced, at least in principle, because of their unique serial number).

{It is issued centrally by a mint.

{Its lifetime extends beyond a single transaction (coins from ten to twenty years, banknotes several years).

Cash transactions directly involve two parties: the seller and the buyer. The third party usually is the bank where the buyer withdraws a suitable amout of money to pay for goods o ered by the buyer and the seller deposits the money

508 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

after a transaction. Any single transaction takes three operations: withdrawing money by the seller, selling/buying process, and depositing money.

In a computer environment, electronic cash (money) must be in the form of a binary string. If a transaction between buyer and seller can proceed successfully without the direct involvement of the bank, we are dealing with o -line electronic money. If a payment protocol requires all three parties (buyer, seller, bank) to interact at the same time, it is called on-line electronic money.

The requested properties of electronic money include:

Unforgeability { money cannot be forged, i.e. money tokens (coins, bills) cannot be generated illegally.

Unreuseability { the same money must not be spent twice,

Untraceability { the bank is not able to identify the buyer from the money deposited by the seller.

Transferability { money can be transferred from person to person. Divisibility { a money token can be divided into tokens of smaller values.

The next section describes an electronic money protocol that satis es: unforgeability, unreuseability, untraceability, and transferability. The interesting feature is that two characteristics, unreuseability and untraceability, are connected, i.e. any double payment of the same coin reveals the identity of the spender. The protocol is an example of o -line payment.

15.2.1 Untraceable Digital Coins

Unforgeability requires that nobody can produce valid digital cash except a bank who knows some secret so it can identify its money. Chaum, Fiat, and Naor [90] showed how to get untraceability when the seller is honest (spends digital money once). If, however, the seller spends the same money more than once, his or her identity will be revealled. Their electronic money takes form of $1 coins. Each coin is a pair

1

(x; f(x)3 ) mod N

where f(x) is a one-way function, N is an RSA modulus (N = pq, p and q are large enough primes) and x is some integer. Note that the factorization of N is known to the bank that has issued the coin. Coins can be forged if calculation of the cube root is feasible. In other words, unforgeability rests on the assumption that computation of the cube root modulo N is intractable. Assume that we

have three parties. Alice wants to buy an item from Bob. The item costs $1. Both Alice and Bob use the same bank. The purchase involves three phases. In the rst phase, Alice withdraws $1 from her account u. In the second phase, Alice purchases the item from Bob and pays $1. Finally, Bob deposits $1 to the bank.

Issuing a coin (Alice $ Bank).

1.Alice chooses n triples (ai; bi; ci) at random (i = 1; : : : ; n) where n is the security parameter.

2.Alice computes n blind elements

Bi = ri3f(xi; yi)

where ri is a random integer used for blinding, and f is a collision-resistant hash function,

xi = g(ai; ci) and

yi = g(ai (ukv + i); bi);

where k stands for the concatenation, g is a collision-resistant hash function, v is a counter associated with the account u. Finally,

A ! Bank : fBi j i = 1; : : : ; ng.

3.Bank picks up a random subset of n=2 indices. Let them be R = fij j j = 1; : : : ; n=2g.

Bank ! Alice : R.

4.Alice ! Bank : fri; ai; bi; ci j i 2 Rg.

Bank checks their consistency with Bi. If there is any attempt to cheat, Bank aborts.

5.Otherwise (checks hold)

1

Bank ! Alice : Qi2R= Bi3

and charges one dollar against her account. 6. Alice extracts the coin C

To simplify our notation, we further assume that the indices that were not in the R belong to the set f1; : : : ; n=2g so

510 15 ELECTRONIC ELECTIONS AND DIGITAL MONEY

In the withdrawal protocol, Bank checks whether or not Alice follows the protocol. After Alice computes her blind elements and commits herself by sending them to Bank, Bank randomly selects half of them and asks her to show all parameters. If Alice cheats she will be caught with a high probability. Note that if Alice does not follow protocol for a single blind element, the probability of not being (or being) caught is 0.5 and equals to the probability that the element will be selected by Bank for checking.

Payment (Alice $ Bob).

1.Alice ! Bob : C.

2.Bob ! Alice : e

where e = (e1; : : : ; en=2) and each ei 2R f0; 1g. The string e is a challenge.

3.Alice has to reply to the challenge and

(ukv + i); bi; xi otherwise.

4.Bob veri es whether C has the form consistent with the responce provided by Alice.!

Deposit (Bob $ Bank).

1.Bob deposits the coin C with Bank and forwards his string e together with Alice's responce.

2.Bank veri es the correctness and credits $1 to Bob's account. Bank must keep e and Alice's responce for future references (in the case when the coin is spent more than once).

Untraceability is tied up with prevention against multiple spending. A single spending of a coin does not allow Bank to identify the spender. If Alice, however, spends the same coin many times, then there is an overwhelming probabability that there is at least one bit ei for which the buyers have recorded both (ai; ci; yi) (when ei = 1) and (ai (u; v+i); bi; xi) (when ei = 0). After the coin is deposited with Bank twice, Bank knows both ai and ai (u; v + i) so it can recover the account number u and identify the double spender.