Formal Analysis of Vote Privacy Using Computationally Complete Symbolic Attacker

Abstract

Abstract. We analyze the FOO electronic voting protocol in the provable security model using the technique of Computationally Complete Symbolic Attacker (CCSA). The protocol uses commitments, blind signatures and anonymous channels to achieve vote privacy. Unlike the Dolev-Yao analyses of the protocol, we assume neither perfect cryptography nor existence of perfectly anonymous channels. Our analysis reveals new attacks on vote privacy, including an attack that arises due to the inadequacy of the blindness property of blind signatures and not due to a specific implementation of anonymous channels. With additional assumptions and modifications, we were able to show that the protocol satisfies vote privacy in the sense that switching votes of two honest voters is undetectable to the attacker. Our techniques demonstrate effectiveness of the CCSA technique for both attack detection and verification.

Decidability of a Sound Set of Inference Rules for Computational Indistinguishability

“…We do not know if our problem remains decidable when we include the transitivity axiom. e) Applications: The BC indistinguishability model has been used to analyse RFID protocols [22], a key-wrapping API [23] and an e-voting protocol [24]. Ideally, we would like future case studies to be carried out automatically and machine checked.…”

Machine-aided analysis of vote privacy using computationally complete symbolic attacker

“…Note that some of the results of our contributions appear in the conference paper [BCE18] and in the journal publication [BCEO19].…”

“…We reproduce the background of the model from [BCE18]. Computationally, a security property of a protocol ⇧ is formulated as the computational indistinguishability of two protocols ⇧ 1 and ⇧ 2 constructed (depending on the security property) from the original ⇧.…”

“…We give a game-based definition of vote privacy of the FOO protocol and present a labelled transition system for authentication, voting, and opening, of the protocol. Note that most of the content of this chapter is from the publication [BCE18].…”

“…NameEQL: For any two names n 0 and n 1 , we have EQL(n 0 , n 1 ) = true a In [BCE18], we also check EQL(t 0 2 , t 1 2 ) which makes the axiom stronger. We weaken the axiom here by dropping it Table 3.1: Axioms that formalize the additional assumptions of the primitives Additional axioms used in the security game for the FOO protocol are given in Table 3.1.…”