civitas security and transparency for remote voting swiss e-voting workshop september 6, 2010...
TRANSCRIPT
![Page 1: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/1.jpg)
CivitasSecurity and Transparency
for Remote Voting
Swiss E-Voting Workshop September 6, 2010
Michael ClarksonCornell University
with Stephen Chong (Harvard) and Andrew Myers (Cornell)
![Page 2: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/2.jpg)
2
SECURITYTRANSPARENCY
![Page 3: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/3.jpg)
3
PRIVACYVERIFIABILITY
![Page 4: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/4.jpg)
4
Remote
PRIVACYVERIFIABILITY
(including Internet)
![Page 5: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/5.jpg)
5
Mutual DistrustKEY PRINCIPLE:
![Page 6: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/6.jpg)
6
VERIFIABILITY
Universal verifiabilityVoter verifiability
Eligibility verifiability
UV: [Sako and Killian 1994, 1995]EV & VV: [Kremer, Ryan & Smyth 2010]
![Page 7: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/7.jpg)
7
PRIVACY
Coercion resistance
better than receipt freeness or simple anonymity
RF: [Benaloh 1994]CR: [Juels, Catalano & Jakobsson 2005]
![Page 8: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/8.jpg)
8
ROBUSTNESS
Tally availability
![Page 9: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/9.jpg)
9
Security Properties
Original system:• Universal
verifiability• Eligibility
verifiability• Coercion resistance
Ongoing projects:• Voter verifiability• Tally availability
…under various assumptions
![Page 10: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/10.jpg)
10
JCJ Voting Scheme
[Juels, Catalano & Jakobsson 2005]
Proved universal verifiability and coercion resistance
Civitas extends JCJ
![Page 11: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/11.jpg)
11
Civitas Architecture
bulletinboard
voterclient
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
registration teller
ballot boxballot boxballot box
![Page 12: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/12.jpg)
12
Registration
voterclient
registration teller
registration teller
registration teller
bulletinboard
tabulation teller
tabulation teller
tabulation teller
ballot boxballot boxballot box
Voter retrieves credential share from each registration teller;combines to form credential
![Page 13: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/13.jpg)
13
Credentials• Verifiable• Unsalable• Unforgeable• Anonymous
![Page 14: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/14.jpg)
14
Voting
voterclient
ballot boxballot boxballot box
bulletinboard
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
registration teller
Voter submits copy of encrypted choice and credential to each ballot box
![Page 15: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/15.jpg)
15
Resisting Coercion:
Fake Credentials
![Page 16: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/16.jpg)
16
Resisting CoercionIf the coercer demands that the voter…
Then the voter…
Submits a particular vote
Does so with a fake credential.
Sells or surrenders a credential
Supplies a fake credential.
Abstains Supplies a fake credential to the adversary and votes with a real one.
![Page 17: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/17.jpg)
17
Tabulation
bulletinboard
tabulation teller
tabulation teller
tabulation teller
voterclient
registration teller
registration teller
registration teller
ballot boxballot boxballot box
Tellers retrieve votes from ballot boxes
![Page 18: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/18.jpg)
18
Tabulation
bulletinboard
tabulation teller
tabulation teller
tabulation teller
voterclient
registration teller
registration teller
registration teller
ballot boxballot boxballot box
Tabulation tellers anonymize votes;eliminate unauthorized (and fake) credentials;
decrypt remaining choices.
![Page 19: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/19.jpg)
19
Auditing
bulletinboard
voterclient
registration teller
registration teller
registration teller
Anyone can verify proofs that tabulation is correct
tabulation teller
tabulation teller
tabulation teller
ballot boxballot boxballot box
![Page 20: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/20.jpg)
20
Civitas Architecture
bulletinboard
voterclient
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
registration teller
ballot boxballot boxballot box
Universal verifiability: Tellers post proofs during tabulation
Coercion resistance:
Voters can undetectably fake credentialsSECURITY PROOFS
![Page 21: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/21.jpg)
21
Protocols– El Gamal; distributed [Brandt]; non-malleable [Schnorr
and Jakobsson]– Proof of knowledge of discrete log [Schnorr]– Proof of equality of discrete logarithms [Chaum &
Pederson]– Authentication and key establishment [Needham-
Schroeder-Lowe]– Designated-verifier reencryption proof [Hirt & Sako]– 1-out-of-L reencryption proof [Hirt & Sako]– Signature of knowledge of discrete logarithms
[Camenisch & Stadler]– Reencryption mix network with randomized partial
checking [Jakobsson, Juels & Rivest]– Plaintext equivalence test [Jakobsson & Juels]
Implementation: 21k LoC
![Page 22: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/22.jpg)
Trust Assumptions
![Page 23: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/23.jpg)
23
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
![Page 24: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/24.jpg)
24
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
Universal verifiability Coercion resistance
Coercion resistance
![Page 25: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/25.jpg)
25
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 26: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/26.jpg)
26
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 27: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/27.jpg)
27
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 28: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/28.jpg)
28
RegistrationIn person.
In advance.
Con: System not fully remote
Pro: Credential can be used in
many elections
![Page 29: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/29.jpg)
29
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 30: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/30.jpg)
30
Eliminating Trust in Voter ClientUV: Use challenges (like Helios)
CR: Open problem
![Page 31: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/31.jpg)
31
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 32: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/32.jpg)
32
Trust Assumptions`1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 33: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/33.jpg)
33
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 34: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/34.jpg)
34
Untappable Channel
Minimal known assumption for receipt freeness and coercion
resistance
Eliminate? Open problem.(Eliminate trusted registration teller? Also open.)
![Page 35: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/35.jpg)
35
Trust Assumptions1. “Cryptography works.”
2. The adversary cannot masquerade as a voter during registration.
3. Voters trust their voting client.
4. At least one of each type of authority is honest.
5. The channels from the voter to the ballot boxes are anonymous.
6. Each voter has an untappable channel to a trusted registration teller.
UV + CR
CR
![Page 36: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/36.jpg)
36
Trusted procedures?
![Page 37: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/37.jpg)
37
Time to Tally
![Page 38: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/38.jpg)
38
Tabulation Time
# voters in precinct = K, # tab. tellers = 4, security strength ≥ 112 bits [NIST 2011–2030]
![Page 39: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/39.jpg)
39
SummaryCan achieve strong security and
transparency:– Remote voting– Universal (voter, eligibility) verifiability– Coercion resistance
Security is not free:– Stronger registration (untappable channel)– Cryptography (computationally expensive)
![Page 40: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/40.jpg)
40
AssuranceSecurity proofs (JCJ)
Secure implementation (Jif)
![Page 41: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/41.jpg)
41
Ranked Voting
![Page 42: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/42.jpg)
42
Open Problems• Coercion-resistant voter client?• Eliminate untappable channel in
registration?• Credential management?• Application-level denial of service?
![Page 43: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/43.jpg)
http://www.cs.cornell.edu/projects/civitas
(google “civitas voting”)
![Page 44: Civitas Security and Transparency for Remote Voting Swiss E-Voting Workshop September 6, 2010 Michael Clarkson Cornell University with Stephen Chong (Harvard)](https://reader035.vdocuments.site/reader035/viewer/2022062421/56649c8b5503460f949451ab/html5/thumbnails/44.jpg)
CivitasSecurity and Transparency
for Remote Voting
Swiss E-Voting Workshop September 6, 2010
Michael ClarksonCornell University
with Stephen Chong (Harvard) and Andrew Myers (Cornell)