Verifiable Homomorphic Tallying for the Schulze Vote Counting Scheme

Abstract

The encryption of ballots is crucial to maintaining integrity and anonymity in electronic voting schemes. It enables, amongst other things, each voter to verify that their encrypted ballot has been recorded as cast, by checking their ballot against a bulletin board. We present a verifiable homomorphic tallying scheme for the Schulze method that allows verification of the correctness of the count-on the basis of encrypted ballots-that only reveals the final tally. We achieve verifiability by using zero knowledge proofs for ballot validity and honest decryption of the final tally. Our formalisation takes places inside the Coq theorem prover and is based on an axiomatisation of cryptogtaphic primitives, and our main result is the correctness of homomorphic tallying. We then instantiate these primitives using an external library and show the feasibility of our approach by means of case studies.

A Toolbox for Verifiable Tally-Hiding E-Voting Systems

“…In some cases, there is no Condorcet winner, and several variants exist to further determine a winner in such a case. In [19] a tallyhiding algorithm is proposed for the Condorcet-Schultze variant. However, we found out that [19] is subject to a major privacy flaw.…”

“…In [19] a tallyhiding algorithm is proposed for the Condorcet-Schultze variant. However, we found out that [19] is subject to a major privacy flaw. Indeed, everyone learns, for each voter, how many candidates have been placed at equality.…”

“…It is the counting methods offered by the voting platform CIVS [1] and used in many elections. Literature for tally-hiding schemes includes [19] which shows how to compute the result in Condorcet, while [35] and [7] provide several methods for STV. They all leak some partial information, but much less than the complete set of votes.…”

“…In [10], the authors show how to compute Majority Judgment in MPC. All these approaches except [19] rely on Paillier encryption since it is better suited than ElGamal for the arithmetic comparison of the content of two ciphertexts.…”

“…In particular, we propose the first tally-hiding schemes with no leakage for four major counting functions: D'Hondt, STV, Condorcet, and Majority Judgment. We summarize our main contributions in the following table . Single vote -Fix shortcoming in [22] in case of equality -Adaptation to D'Hondt method Majority Judgment -Fix the fact that [10] fails in not-so-rare cases -Complete leakage-free algorithm, based on ElGamal Condorcet -Fix privacy issue in [19] -Several efficiency/leakage compromises -Original ballot encoding and ZKP by the voters -Complete leakage-free algorithm…”