Efficient Receipt-Free Voting Based on Homomorphic Encryption

Abstract

Abstract. Voting schemes that provide receipt-freeness prevent voters from proving their cast vote, and hence thwart vote-buying and coercion. We analyze the security of the multi-authority voting protocol of Benaloh and Tuinstra and demonstrate that this protocol is not receiptfree, opposed to what was claimed in the paper and was believed before. Furthermore, we propose the first practicable receipt-free voting scheme. Its only physical assumption is the existence of secret one-way communication channels from the authorities to the voters, and due to the public verifiability of the tally, voters only join a single stage of the protocol, realizing the "vote-and-go" concept. The protocol combines the advantages of the receipt-free protocol of Sako and Kilian and of the very efficient protocol of Cramer, Gennaro, and Schoenmakers, with help of designated-verifier proofs of Jakobsson, Sako, and Impagliazzo. Compared to the receipt-free protocol of Sako and Kilian for security parameter (the number of repetitions in the non-interactive cut-andchoose proofs), the protocol described in this paper realizes an improvement of the total bit complexity by a factor .

On Some Incompatible Properties of Voting Schemes

“…It is well-known that using multi-party computation techniques a strongly secure voting scheme can be built, that achieves all the above ideal properties, but using secure channels between the parties (the voters and/or the authorities): efficient voting schemes that guarantee receipt-freeness or incoercibility [2,4,13,17,18,21] use such secure channels.…”

“…If the transcript is more intricate, and namely includes some private interactions between the voters and/or the authorities [13], then it may be possible to achieve the two properties simultaneously: B i is no longer available to the third-party, and thus r i is no longer a witness either. But such an assumption of private channels is not reasonable in practice.…”

A Practical and Secure Coercion-Resistant Scheme for Internet Voting

“…The solution, moreover, requires a protocol to prove that a ciphertext contains a vote for a valid candidate. This can be accomplished, for example, through the validity proof proposed by Hirt and Sako [14]. Besides these protocols, our proposal uses the discrete log equality test owing to Chaum and Pedersen [7], a protocol for proving knowledge of a representation, such as the one proposed by Okamoto [20], and a plaintext equivalence test [15].…”

Commital Deniable Proofs and Electronic Campaign Finance

“…Benaloh and Tuinstra [4] initiated the study of receipt-freeness and incoercibility for secret ballot election schemes (see also [18,16,17,15]). To achieve incoercibility these protocols typically have a "voting booth" (or make other physical assumptions) that guarantee that the voter is isolated from the coercer for one phase of the voting protocol.…”