Este documento mostra a nova configuração de chaves da Urna Eletrônica (UE), que agora está assentada em uma segurança computacional dentro do modelo ROM (Random Oracle Model), o que permitirá a abertura livre do código-fonte para a sociedade. Os modelos anteriores, baseados em guarda de chaves no código-fonte ou a sua derivação em tempo de execução, foram substituídos pelo uso de um módulo de segurança embarcado, que caracteriza as urnas brasileiras como do tipo T-DRE.

No abstract

We present a hardware trusted computing base (TCB) aimed at Direct Recording Voting Machines (T-DRE), with novel design features concerning vote privacy, device verifiability, signed-code execution and device resilience. Our proposal is largely compliant with the VVSG (Voluntary Voting System Guidelines), while also strengthening some of its reccomendations. To the best of our knowledge, T-DRE is the first architecture to employ multi-level, certification-based, hardware-enforced privileges to the running software. T-DRE also makes a solid case for the feasibility of strong security systems: it is the basis of 165,000 voting machines, set to be used in a large upcoming national election. In short, our contribution is a viable computational trusted base for both modern and classical voting protocols. * Partially funded by KRYPTUS and SERASA Experian research grants † Partially funded by FAPESP (2007/56052-8), CNPq (309491/2008-8), and SERASA Experian research grants ‡ Partially funded by FAPESP (