A Mix-Net from Any CCA2 Secure Cryptosystem

Abstract

Abstract. We construct a provably secure mix-net from any CCA2 secure cryptosystem. The mix-net is secure against active adversaries that statically corrupt less than λ out of k mix-servers, where λ is a threshold parameter, and it is robust provided that at most min(λ − 1, k − λ) mix-servers are corrupted.The main component of our construction is a mix-net that outputs the correct result if all mix-servers behaved honestly, and aborts with probability 1 − O(H −(t−1) ) otherwise (without disclosing anything about the inputs), where t is an auxiliary security parameter and H is the number of honest parties. The running time of this protocol for long messages is roughly 3tc, where c is the running time of Chaum's mix-net (1981).

Machine-Checked Proofs of Privacy for Electronic Voting Protocols

“…Since we are not concerned here with dishonest tally authorities, we simply view mixnets as an abstract algorithm TallyMix which, given a list of ballots and the secret key, returns their decryptions in some order together with a proof that the list of decrypted votes corresponds to the initial list of ballots. Existing mixnet constructions return the plaintexts either in random order [36] or in lexicographic order [32].…”

“…A mixnet takes as input a set of encrypted messages and outputs the underlying plaintexts in a way that hides the relation between the input ciphertexts and the output plaintexts. Interest in their applications (which go significantly beyond electronic voting) resulted in a large body of literature that covers different constructions [30], [32], [36], [37], [41], and security models and proofs for some of the constructions [32], [33], [41].…”

Making Code Voting Secure Against Insider Threats Using Unconditionally Secure MIX Schemes and Human PSMT Protocols

“…MIX-networks can be constructed using a shuffle (permutation). One way of achieving this [32,39] is by using approaches which are based on zero-knowledge arguments [25,45]. In [17] the use of zero-knowledge was avoided.…”

Formal Analysis of Chaumian Mix Nets with Randomized Partial Checking

“…Analogously, here we formalize privacy of RPC mix nets as the inability of an adversary to distinguish whether some sender under observation submitted plaintexts p or p , when running her honest program. While this definition is quite strong (see, e.g., the discussion in [2]), simulation-based definitions [12] are stronger (see also [3] for a related game-based definition). Roughly speaking, simulation-based definitions imply that an adversary should not be able to distinguish between two (different) vectors of honest inputs.…”