Abstract
We analyse three game-based definitions of receipt-freeness; uncovering soundness issues with two of the definitions and completeness issues with all three. Hence, two of the definitions are too weak, i.e., satisfiable by voting schemes that are not intuitively receipt-free. More precisely, those schemes need not even satisfy ballot secrecy. Consequently, the definitions are satisfiable by schemes that reveal how voters vote. Moreover, we find that each definition is limited in scope. Beyond soundness and completeness issues, we show that each definition captures a different attacker model and we examine some of those differences.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
Verifiability is typically defined as individual verifiability (any voter can check that their ballot is counted), universal verifiability (anyone can check that the published tally is correct) and eligibility verifiability (only eligible voters voted). The interested reader can consult [11, 31, 34] for a discussion on the subject of verifiability.
- 2.
For simplicity, we consider each entity to be a single individual but the role of any individual can be distributed.
- 3.
Function f must itself be correct, i.e., f must output the election outcome with respect to \(v_{1}, \dots , v_{n_v}\).
- 4.
Simulator \(\mathcal {S}\) models a voter providing fake evidence of a vote they did not submit.
- 5.
\(\mathsf {view}\) is defined as the “internal state of the voter” [23]. It refers to any information that the voter inputs to the voting client to produce a ballot, including, but not necessarily limited to, private credentials and the coins input to algorithm \(\mathsf {Vote}\).
- 6.
In this section, we use the term e-voting scheme to refer to Definition 1 plus algorithms \(\mathsf {Valid}\) and \(\mathsf {Publish}\).
- 7.
We omit \(\mathsf {SimSetup}\) and \(\mathsf {SimProof}\) as inputs to game \(\mathsf {Exp}_{\mathcal {A}, \varGamma }^{\mathsf {CCFG}, \beta }(\lambda )\) for simplicity.
- 8.
In this game \(\mathcal {BB}_{} = \mathcal {PBB}_{}\). Bernhard et al. do not mention adversarial access to \(\mathcal {BB}_{\beta }\) in the technical report [6] but do allow the adversary to ‘see’ \(\mathcal {BB}_{}\) in the conference version [7]. We assume that, as \(\mathsf {DKV}\) is a modification of \(\mathsf {CCFG}\), the adversary should have access to \(\mathcal {BB}_{\beta }\). This could be resolved by providing the adversary with access to an oracle \(\mathcal {O}\mathsf {publish}\) as defined for \(\mathsf {CCFG}\). This provides the adversary with a view of \(\mathcal {BB}_{\beta }\), which we assume is the intention in this definition.
References
Adida, B.: Helios: web-based open-audit voting. In: USENIX Security Symposium, vol. 17, pp. 335–348. USENIX (2008)
Baskar, A., Ramanujam, R., Suresh, S.P.: Knowledge-based modelling of voting protocols. In: TARK 2007, pp. 62–71. ACM (2007)
Benaloh, J.: Verifiable secret-ballot elections. Ph.D. thesis, Yale University (2006)
Benaloh, J., Tuinstra, D.: Receipt-free secret-ballot elections. In: STOC 1994, pp. 544–553. ACM (1994)
Bernhard, D., Cortier, V., Galindo, D., Pereira, O., Warinschi, B.: SoK: a comprehensive analysis of game-based ballot privacy definitions. In: S&P 2015, pp. 499–516. IEEE (2015)
Bernhard, D., Kulyk, O., Volkamer, M.: Security proofs for participation privacy, receipt-freeness, ballot privacy, and verifiability against malicious bulletin board for the Helios voting scheme. IACR ePrint 2016/431
Bernhard, D., Kulyk, O., Volkamer, M.: Security proofs for participation privacy, receipt-freeness and ballot privacy for the Helios voting scheme. In: ARES 2017, p. 1. ACM (2017)
Braunlich, K., Grimm, R.: Formalization of receipt-freeness in the context of electronic voting. In: ARES 2011, pp. 119–126. IEEE (2011)
Chaidos, P., Cortier, V., Fuchsbauer, G., Galindo, D.: BeleniosRF: a non-interactive receipt-free electronic voting scheme. In: CCS 2016, pp. 1614–1625. ACM (2016)
Chevallier-Mames, B., Fouque, P.-A., Pointcheval, D., Stern, J., Traoré, J.: On some incompatible properties of voting schemes. Towards Trust. Elect. 6000, 191–199 (2010)
Cortier, V., Galindo, D., Küsters, R., Mueller, J., Truderung, T.: Sok: verifiability notions for e-voting protocols. In: S&P 2016, pp. 779–798. IEEE (2016)
Cortier, V., Lallemand, J.: Voting: you can’t have privacy without individual verifiability. In: CCS 2018, pp. 53–66. ACM (2018)
Delaune, S., Kremer, S., Ryan, M.: Coercion-resistance and receipt-freeness in electronic voting. In: CSFW 2006, pp. 28–42. IEEE (2006)
Delaune, S., Kremer, S., Ryan, M.: Verifying privacy-type properties of electronic voting protocols. JCS 17(4), 435–487 (2009)
Dreier, J., Lafourcade, P., Lakhnech, Y.: A formal taxonomy of privacy in voting protocols. In: ICC 2012, pp. 6710–6715. IEEE (2012)
Fraser, A., Quaglia, E.A., Smyth, B.: A critique of game-based definitions of receipt-freeness for voting. IACR ePrint 2019/853
Helios voting system. https://heliosvoting.org/. Accessed 06 Mar 2018
IACR final report of IACR electronic voting committee. www.iacr.org/elections/eVoting/finalReportHelios_2010-09-27.html. Accessed 01 Aug 2017
iVote online voting. www.ivote.nsw.gov.au/. Accessed 01 Aug 2017
Jonker, H.L., de Vink, E.P.: Formalising receipt-freeness. In: Katsikas, S.K., López, J., Backes, M., Gritzalis, S., Preneel, B. (eds.) ISC 2006. LNCS, vol. 4176, pp. 476–488. Springer, Heidelberg (2006). https://doi.org/10.1007/11836810_34
Jonker, H.L., Pieters, W.: Receipt-freeness as a special case of anonymity in epistemic logic. In: IAVoSS Workshop on Trustworthy Elections (WOTE) (2006)
Juels, A., Catalano, D., Jakobsson, M.: Coercion-resistant electronic elections. In: WPES 2005, pp. 61–70. ACM (2005)
Kiayias, A., Zacharias, T., Zhang, B.: End-to-end verifiable elections in the standard model. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9057, pp. 468–498. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46803-6_16
Küesters, R., Truderung, T., Vogt, A.: Verifiability, privacy, and coercion-resistance: new insights from a case study. In: S&P 2011, pp. 538–553. IEEE (2011)
Kulyk, O., Teague, V., Volkamer, M.: Extending Helios towards private eligibility verifiability. In: Haenni, R., Koenig, R.E., Wikström, D. (eds.) VOTELID 2015. LNCS, vol. 9269, pp. 57–73. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-22270-7_4
Lee, B., Boyd, C., Dawson, E., Kim, K., Yang, J., Yoo, S.: Providing receipt-freeness in mixnet-based voting protocols. In: Lim, J.-I., Lee, D.-H. (eds.) ICISC 2003. LNCS, vol. 2971, pp. 245–258. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24691-6_19
Moran, T., Naor, M.: Receipt-free universally-verifiable voting with everlasting privacy. In: Dwork, C. (ed.) CRYPTO 2006. LNCS, vol. 4117, pp. 373–392. Springer, Heidelberg (2006). https://doi.org/10.1007/11818175_22
Okamoto, T.: Receipt-free electronic voting schemes for large scale elections. In: Christianson, B., Crispo, B., Lomas, M., Roe, M. (eds.) Security Protocols 1997. LNCS, vol. 1361, pp. 25–35. Springer, Heidelberg (1998). https://doi.org/10.1007/BFb0028157
Smyth, B.: Ballot secrecy: security definition, sufficient conditions, and analysis of Helios. IACR ePrint 2015/942
Smyth, B.: Ballot secrecy with malicious bulletin boards. IACR ePrint 2014/822
Smyth, B.: A foundation for secret, verifiable elections. IACR ePrint 2018/225
Smyth, B.: Surveying definitions of coercion resistance. IACR ePrint 2019/822
Smyth, B.: Verifiability of Helios mixnet. IACR ePrint 2018/017
Smyth, B., Frink, S., Clarkson, M.R.: Election verifiability: cryptographic definitions and an analysis of Helios, Helios-C, and JCJ. IACR ePrint 2015/233
Springall, D., et al.: Security analysis of the Estonian internet voting system. In: CCS 2014, pp. 703–715. ACM (2014)
Acknowledgements
This work is partly supported by the EPSRC and the UK government as part of the Centre for Doctoral Training in Cyber Security at Royal Holloway, University of London (EP/P009301/1), and by the Luxembourg National Research Fund (FNR) under the FNR-INTER-VoteVerif project (10415467).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Fraser, A., Quaglia, E.A., Smyth, B. (2019). A Critique of Game-Based Definitions of Receipt-Freeness for Voting. In: Steinfeld, R., Yuen, T. (eds) Provable Security. ProvSec 2019. Lecture Notes in Computer Science(), vol 11821. Springer, Cham. https://doi.org/10.1007/978-3-030-31919-9_11
Download citation
DOI: https://doi.org/10.1007/978-3-030-31919-9_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-31918-2
Online ISBN: 978-3-030-31919-9
eBook Packages: Computer ScienceComputer Science (R0)