Analysis of an Electronic Voting Protocol in the Applied Pi Calculus

Abstract

Abstract. Electronic voting promises the possibility of a convenient, efficient and secure facility for recording and tallying votes in an election. Recently highlighted inadequacies of implemented systems have demonstrated the importance of formally verifying the underlying voting protocols. The applied pi calculus is a formalism for modelling such protocols, and allows us to verify properties by using automatic tools, and to rely on manual proof techniques for cases that automatic tools are unable to handle. We model a known protocol for elections known as FOO 92 in the applied pi calculus, and we formalise three of its expected properties, namely fairness, eligibility, and privacy. We use the ProVerif tool to prove that the first two properties are satisfied. In the case of the third property, ProVerif is unable to prove it directly, because its ability to prove observational equivalence between processes is not complete. We provide a manual proof of the required equivalence.

Automatic Verification of Privacy Properties in the Applied pi Calculus

“…In [12], it is shown that this protocol provides fairness, eligibility and privacy. However, the proof of privacy given in [12] is manual: ProVerif is unable to prove it directly.…”

“…In the context of voting protocols, the definition of privacy is rather subtle. We recall the definition of privacy for electronic voting protocols given in [12]. A voting protocol guarantees ballot secrecy (privacy) whenever a process where Alice votes for candidate v 1 and Bob votes for candidate v 2 is observationally equivalent to a process where their votes are swapped, i.e.…”

“…Some of these properties cannot easily be expressed using traditional reachability techniques but can be written as equivalences. For example, the privacy, receipt-freeness and coercion-resistance properties of electronic voting protocols can be expressed using equivalences (see [12,7]). …”

“…For example, the secret ballot (privacy) property of an electronic voting protocol can be expressed as P (skva, v 1 ) | P (skvb, v 2 ) ∼ P (skva, v 2 ) | P (skvb, v 1 ) where P is the voter process with two parameters: its secret key (skva, skvb) and the candidate for whom he wish to cast their vote (here v 1 , v 2 ). Historically many applications of equivalences to prove security requirements of cryptographic protocols have relied upon hand written proofs [12,7]. Such proofs are time consuming and error prone.…”

“…Kremer & Ryan [12] have previously demonstrated the electronic voting protocol FOO satisfies fairness, eligibility and privacy. The first two properties were verified automatically using ProVerif, and the third relied on a hand proof.…”