Cryptographic Voting Systems (Ben Adida)

Transcription

1 Cryptographic Voting Systems (Ben Adida) Click to edit Master subtitle style Jimin Park Carleton University COMP 4109 Seminar 15 February 2011

2 If you think cryptography is the solution to your problem.

3 then you don t understand cryptography and you don t understand your problem.

4 Yet, cryptography solves problems that initially appear to be impossible.

5 There is a potential paradigm shift. A means of election verification far more powerful than other methods.

6 But with cryptography, you re just moving the black box. Few people really understand it or trust it. Debra Bowen California Sec. of State, 7/30/2008 (paraphrased)

7 Problems with current voting systems Lost ballot boxes or magically found, coercion, dead citizen s votes, etc.

8 Why not fully computerize voting systems? Bush vs. Gore (California, 2000) Bush won by just 500 votes! Known missing ballots, coercion Computerization was taken seriously Direct Recording Electronic (DRE) machines Nothing but touch screen, automatic tallying Problems with DRE, can we trust it? Ref: [2] Avi Rubin

9 Dilemma: Verification vs. Secrecy Analogy: ATM machines Fully automated computerized system Why do we trust them? We can fully verify the transactions Difference between ATM and Voting Systems VS: information being verified must stay secret Rely on mathematical proofs of the results rather than of the machines.

10 The Goal of Cryptographic Voting Systems No: Chain-of-Custody approach (current) Yes: End-to-End verification approach

11 Flow Diagram

12 Threshold Decryption Need Public-key encryption system Private key used for decryption need to be distributed among the different parties Shared-secret scheme E.g. ) A race of 3 candidates. Each given an equation of a plane (non-coplanar). Key resides at the point where all planes intersect. Ref: [3] Blakley, G. R.

13 What crypto system to use? 3 desired properties of our crypto system Public-Private key encryption-decryption Voters encrypt Candidates decrypt Easily generated random keys One vote encrypts to many different ciphertexts Ref: [4] Josh D. Cohen and Michael J. Fischer Homomorphic All cipher-texts (different votes) get

14 Group Homomorphism Def: Given two groups (G, *) and (H, ), group homomorphism from (G, *) to (H, ) is a function h : G H such that for all u and v in G it holds that h(u v) = h(u) h(v) * In our case, the function h can be the encryption. encrypt(u v) = encrypt(u) encrypt(v)

15 El Gamal encryption: original Alice Bob (voters) (candidates) (1) Bob computes + publishes: - p : large prime (p-1 has at least one large prime factor) - a : primitive element xb mod p B B - y : Bpublic key, y B = a mod p x : private key, x = random(1, 2,, p-1) A X A X B X A Shared Key (SK) x A B SK = (y x ) A B = (y ) (2) Alice encrypts : message m: 0 <= m <= p-1 - (c1, c2) = ( y, m SK) X mod A X B p -X = ( a, m (a ) 1 X A B ) mod p (3) Bob decrypts: Ref: [6] T. El Gamal

16 El Gamal example Alice Bob (voters) (candidates) (1) Bob computes + publishes: p : - p : large prime (p-1 has at least one large prime factor) 13 a : - a : primitive element x 1 B mod p 2y B B B : 7 (2 mod 1 13) - y : Bpublic key, y B x = a mod p B : 11 x : private key, x = random(1, 2,, m p-1) : X A X B X A A (c1, c2) = (2, 7 (2 ) ) 1 mod 13 (2) Alice encrypts : message m: 0 <= m <= p-1 = (12, 6) - (c1, c2) = 1 ( y, m SK) X mod A X B p -X = ( a, m (a ) ) mod p X A (7 2 2 ) mod B = (3) Bob decrypts: Ref: [6] T. El Gamal

17 Comparison: RSA vs. El Gamal Security RSA: factoring large integers El Gamal: discrete logarithms x 3 13 (mod 17) what is x? Keys RSA: expensive computation of finding large p and q El Gamal: computation of large p is done

18 Homomorphic Tallying Original El Gamal Enc(m1) Enc(m2) = X( y 1, m 1 1 SK X2 ) 2( y 2, m SK mod p )) mod p X X 1 2 Exponential El Gamal = ( 1y 2y, (m m ) (SK S It would be more useful if we could do addition on the cipher texts rather than multiplication! = Enc( m m ) Enc(m1) Enc(m2) = m( 1 y, a SK m 2 ) ( y, a X 1 1 X 2 2 SK ) mod p (m X 1 X 2 m ) 1 2 = (m ( y y, a (SK m ) SK )) mod p

19 What is the message that we are encrypting?

20 Let s Vote! (1) Auditing the ballot - by zero-knowledge proof - Pick any two ballots to vote - You pick one of them and scratch to reveal random numbers -> private keys of the ballot - Take to election activist organization to scan 2D bar code and validate the ballot

21 Zero-knowledge Proof

22 Let s Vote! (2) Vote (3) Remove candidate list (4) Shred random numbers, take home the

23 Public Bulletin Board The votes of the registered citizens were casted as intended and these votes are tallied properly, so we have counted as intended!

24 Mixnets Ref: [7] David

25 Deployments Numerous university student elections MIT, Hardvard, etc. Unversite Catholique de Louvain: 25,000 voters University of Ottawa: punchscan voting system Takoma Park election, Maryland (Nov )

26 Ben s Fear Computerization of voting is inevitable, without true verifiability, the situation is grim. Ben s Hope Public auditing proofs will soon be as common as public-key crypto is now.

27

28 Quiz (1) What approach is current voting system taking? And what is this seminar s proposed approach? (1) What is threshold decryption? (1) List the 3 desired properties crypto system should have for homomorphic tallying method? (1) What method is used to do ballot auditing? (1) In the voting process, the un-scratched random numbers are shredded in public view. What is the danger in revealing these numbers? What sort of benefit would a coercer have?

29 Reference [1] Ben Adida. Advances in Cryptographic Voting Systems. MIT. (2006). [2] Avi Rubin. An Election Day clouded by doubt, October [3] Blakley, G. R. Safeguarding cryptographic keys. Proceedings of the National Computer Conference 48: , (1979). [4] Josh D. Cohen and Michael J. Fischer. A robust and verifiable cryptographically secure election scheme. In FOCS, pages IEEE Computer Society, [5] S. Poblig and M. Hellman, An improved algorithm for computing logarithms over GF(p) and its cryptographic significance, IEEE Transaction on Information Theory It-24: , (1978). [6] T. El Gamal. A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms. IEEE Transactions on Information Theory 31, pg (1985)