Rapid Mixing and Security of Chaum’s Visual Electronic Voting

Abstract

Abstract. Recently, David Chaum proposed an electronic voting scheme that combines visual cryptography and digital processing. It was designed to meet not only mathematical security standards, but also to be accepted by voters that do not trust electronic devices. In this scheme mix-servers are used to guarantee anonymity of the votes in the counting process. The mix-servers are operated by different parties, so an evidence of their correct operation is necessary. For this purpose the protocol uses randomized partial checking of Jakobsson et al., where some randomly selected connections between the (encoded) inputs and outputs of a mix-server are revealed. This leaks some information about the ballots, even if intuitively this information cannot be used for any efficient attack. We provide a rigorous stochastic analysis of how much information is revealed by randomized partial checking in the Chaum's protocol. We estimate how many mix-servers are necessary for a fair security level. Namely, we consider probability distribution of the permutations linking the encoded votes with the decoded votes given the information revealed by randomized partial checking. We show that the variation distance between this distribution and the uniform distribution is O 1 n already for a constant number of mix-servers (n is the number of voters). This means that a constant number of trustees in the Chaum's protocol is enough to obtain provable security. The analysis also shows that certain details of the Chaum's protocol can be simplified without lowering security level.

Formal Analysis of Chaumian Mix Nets with Randomized Partial Checking

“…Let L R = {x : ∃w such that (x, w) ∈ R}. A non-interactive proof system for a language L R is a tuple of probabilistic polynomial-time algorithms (Setup, Prover, Verifier), where -Setup (the common reference string generator) takes as input a security parameter 1 and the statement length n and produces a common reference string σ ← Setup(n), 8 -Prover (the prover) takes as input the security parameter 1 , a common reference string σ, a statement x, and a witness w and produces a proof π ← Prover(σ, x, w), -Verifier (the verifier) takes as input the security parameter 1 , a common reference string σ, a statement x, and a proof π and outputs 1/0 ← Verifier(σ, x, π) depending on whether it accepts π as a proof of x or not, such that the following conditions (completeness and soundness) are satisfied. Perfect completeness: For n = O(1) and all adversaries A outputting (x, w) ∈ R with |x| = n Pr[σ ← Setup(n); (x, w) ← A(σ); π ← Prover(σ, x, w); b ← Verifier(σ, x, π) :…”

“…So, for each such index, the probability that it is not challenged to its unsafe side is at most As the indices are audited independently and the cases above do not overlap, we immediately get (8).…”

“…As mentioned, Kahazei and Wikström [13] point out and discuss attacks. In [8], the authors study the distance between the probability distribution of the permutation links in RPC mix nets and the uniform distribution, however, as also pointed out in [13], this result does not capture privacy or verifiability of RPC mix nets. Structure of this paper.…”

Randomized Partial Checking Revisited

“…Gomulkiewicz et al [10] study the probability distribution of the permutations linking the input and outputs of a mix-net with RPC given the information revealed. They show that the distance between this distribution and the uniform distribution is O( 1 N ) even when there is only a constant number of mix-servers.…”

Civitas: Toward a Secure Voting System

“…In the worst case, when all but one teller is corrupted, the size of the set within which a vote or credential is anonymous is halved. By a result of Gomułkiewicz et al [43], the revealed information can be made statistically small by requiring each teller to perform a total of five permutations. We estimate this would increase tabulation time by at most 3%.…”