The Effectiveness of Receipt-Based Attacks on ThreeBallot

Henry, Kevin; Stinson, Douglas R.; Sui, Jiayuan

doi:10.1109/tifs.2009.2031914

Cited by 12 publications

(9 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The degradation itself is not surprising since certain patterns become very unlikely to occur. This has been noted for variants of ThreeBallot, e.g., in [12,13]. However, our definition allows us to measure the degradation rigorously in the context of coercion-resistance, showing that the level of coercion-resistance ThreeBallot provides is completely insufficient already with five to seven candidates and a few hundred voters.…”

Section: Threeballot With Multiple Candidatesmentioning

confidence: 64%

A game-based definition of coercion resistance and its applications1

Küsters

Truderung

Vogt

2012

JCS

View full text Add to dashboard Cite

Coercion-resistance is one of the most important and intricate security requirements for voting protocols. Several definitions of coercion-resistance have been proposed in the literature, both in cryptographic settings and more abstract, symbolic models. However, unlike symbolic approaches, only very few voting protocols have been rigorously analyzed within the cryptographic setting. A major obstacle is that existing cryptographic definitions of coercion-resistance tend to be complex and limited in scope: They are often tailored to specific classes of protocols or are too demanding.In this paper, we therefore present a simple and intuitive cryptographic definition of coercion-resistance, in the style of game-based definitions. This definition allows to precisely measure the level of coercion-resistance a protocol provides. As the main technical contribution of this paper, we apply our definition to two voting systems, namely, the Bingo voting system and ThreeBallot. The results we obtain are out of the scope of existing approaches. We show that the Bingo voting system provides the same level of coercion-resistance as an ideal voting system. We also precisely measure the degradation of coercion-resistance of ThreeBallot in case the so-called short ballot assumption is not met and show that the level of coercion-resistance ThreeBallot provides is significantly lower than that of an ideal system, even in case of short ballots.

show abstract

Section: Threeballot With Multiple Candidatesmentioning

confidence: 64%

A game-based definition of coercion resistance and its applications1

Küsters

Truderung

Vogt

2012

JCS

View full text Add to dashboard Cite

show abstract

“…The main attacks against Three-Ballot concern either multiple races on a single ballot [19,11] or small numbers of voters [1]. The first is avoided here by having a single race per ballot -as is already the case in a number of voting systems.…”

Section: Attacks On the Proposed Systemsmentioning

confidence: 99%

“…First, when voting for more than a few different races, it made unique identifying voting patterns on ballots possible, reintroducing the risk of coercion and vote-selling. This effect and its probability of happening in real races has been well studied in a variety of articles [1,19,46]. Although it poses a real risk in places with many concurrent races 6 , many countries -such as Spain, Greece, France or Malawi [38] -don't have many concurrent elections, and this article will focus on this case (called the Short Ballot Assumption in the original articles).…”

Section: Introductionmentioning

confidence: 99%

Origami Voting: A Non-cryptographic Approach to Transparent Ballot Verification

Blanchard

Selker

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Over the past four decades, fear of election manipulation and hacking has spurred the security technology community to propose a variety of voting systems to implement verifiable voting. Most of these rely on hard to understand cryptographic protocols, which can affect whether users actually verify their selections. Three-Ballot and Vote/Anti-Vote/Vote, two related systems among the few non-cryptographic end-to-end verifiable voting systems, made improvements in security while eliminating complex protocols. They unfortunately suffered from usability issues, and although they did not require cryptographic primitives, they still relied on electronic devices. To address this, we introduce three foldedpaper based systems that allow verifiable voting and resist common attacks despite not relying on any cryptography or electronic devices. The proposals are based on 1) semi-translucent ballots, 2) masking tape, or 3) folding and punching. These Origami voting methods help users understand the underlying mechanisms and give them a direct geometric approach to verification.

show abstract

“…The ThreeBallot voting system has been subjected to analysis of one sort or another many times since its publication [15,16,17,18,14,19,13,20,21]. Perhaps the earliest analysis was conducted by Strauss [15,16], who established the success probabilities of attacks for various numbers of candidates and voters with multiple races.…”

Section: Related Workmentioning

confidence: 99%

Integrated Formal Methods

Johnsen¹,

Petre²

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In recent years, a large number of secure voting protocols have been proposed in the literature. Often these protocols contain flaws, but because they are complex protocols, rigorous formal analysis has proven hard to come by. Rivest's ThreeBallot voting system is important because it aims to provide security (voter anonymity and voter verifiability) without requiring cryptography. In this paper, we construct a CSP model of ThreeBallot, and use it to produce the first automated formal analysis of its anonymity property.Along the way, we discover that one of the crucial assumptions under which ThreeBallot (and many other voting systems) operates-the Short Ballot Assumption-is highly ambiguous in the literature. We give various plausible precise interpretations, and discover that in each case, the interpretation either is unrealistically strong, or else fails to ensure anonymity. Therefore, we give a version of the Short Ballot Assumption for ThreeBallot that is realistic but still provides a guarantee of anonymity.

show abstract

The Effectiveness of Receipt-Based Attacks on ThreeBallot

Cited by 12 publications

References 5 publications

A game-based definition of coercion resistance and its applications1

A game-based definition of coercion resistance and its applications1

Origami Voting: A Non-cryptographic Approach to Transparent Ballot Verification

Integrated Formal Methods

Contact Info

Product

Resources

About