Verifiability, Privacy, and Coercion-Resistance: New Insights from a Case Study

Abstract

In this paper, we present new insights into central properties of voting systems, namely verifiability, privacy, and coercion-resistance. We demonstrate that the combination of the two forms of verifiability considered in the literature-individual and universal verifiability-are, unlike commonly believed, insufficient to guarantee overall verifiability. We also demonstrate that the relationship between coercion-resistance and privacy is more subtle than suggested in the literature.Our findings are partly based on a case study of prominent voting systems, ThreeBallot and VAV, for which, among others, we show that, unlike commonly believed, they do not provide any reasonable level of verifiability, even though they satisfy individual and universal verifiability. Also, we show that the original variants of ThreeBallot and VAV provide a better level of coercion-resistance than of privacy.

End-to-End Verifiable Elections in the Standard Model

“…In the only previous works [37,35] where end-to-end verifiability was considered at a "global level" as we do here, it was expressed with respect to a set of "good" runs γ of the e-voting protocol in the sense that a judge could test whether the protocol operated within the set γ. Even though sufficiently expressive, this formulation has the disadvantage that the set γ remains undetermined and thus the level of verifiability that is offered by the definition hinges on the proper definition of γ which may not be simple.…”

“…In [37], the same authors showed that individual verifiability and universal verifiability are not sufficient to guarantee the "global" verifiability of an evoting system. A number of other e-voting systems in the cryptographic setting that do not explicitly deal with E2E verifiability include [19,7,22,23].…”

“…In [37], the level of privacy of an e-voting system is measured w.r.t. to the observation power the adversary has in a protocol run, via a definition which is close to the Dolev-Yao model.…”

Automated Anonymity Verification of the ThreeBallot Voting System

“…Finally, Küsters et al [21] computationally analysed the level of privacy offered by the ThreeBallot voting system and the proposed system by de Marneffe et al [14], and concluded that the latter provides better privacy than the original.…”

To Du or Not to Du: A Security Analysis of Du-Vote

“…Vote privacy ensures that the voting system should not release any information about your vote other than the information revealed by the final outcome (in an unanimous vote, of course, the outcome would leak your exact vote, independent of the system in use). This notion of privacy has been precisely defined in both symbolic [6], [7] and computational [8], [9] models for reasoning about cryptographic protocols. The second property is end-to-end verifiability which guarantees the integrity of the election and ensures its transparency by providing verifiable evidence of the accuracy of the result.…”