Verifying privacy-type properties of electronic voting protocols

Abstract

Electronic voting promises the possibility of a convenient, efficient and secure facility for recording and tallying votes in an election. Recently highlighted inadequacies of implemented systems have demonstrated the importance of formally verifying the underlying voting protocols. We study three privacy-type properties of electronic voting protocols: in increasing order of strength, they are vote-privacy, receipt-freeness, and coercionresistance.We use the applied pi calculus, a formalism well adapted to modelling such protocols, which has the advantages of being based on well-understood concepts. The privacy-type properties are expressed using observational equivalence and we show in accordance with intuition that coercion-resistance implies receipt-freeness, which implies vote-privacy.We illustrate our definitions on three electronic voting protocols from the literature. Ideally, these three properties should hold even if the election officials are corrupt. However, protocols that were designed to satisfy receipt-freeness or coercion-resistance may not do so in the presence of corrupt officials. Our model and definitions allow us to specify and easily change which authorities are supposed to be trustworthy.Key words: voting protocol, applied pi calculus, formal methods, privacy and anonymity properties. This work has been partly supported by the EPSRC projects EP/E029833, Verifying Properties in Electronic Voting Protocols and EP/E040829/1, Verifying anonymity and privacy properties of security protocols, the ARA SESUR project AVOTÉ and the ARTIST2 NoE.

Epistemic Logic for the Applied Pi Calculus

“…Many electronic voting protocols have been proposed in the literature and their formal analysis has received considerable attention [14,4]. One important security goal is privacy of votes-an intruder should not be able to learn (by its interaction with the protocol) how an honest voter Alice voted.…”

“…We then specify privacy in voting protocols, which relies on the epistemic knowledge of the intruder. We show that a definition of vote privacy in terms of process equivalence as defined in [14] implies vote privacy in terms of epistemic logic, as defined in [4]. Then we slightly weaken the equivalence based definition, replacing observational equivalence with trace equivalence.…”

“…This calculus has been successfully used to study a variety of security protocols, e.g. the direct anonymous attestation protocol [3], some electronic voting protocols [14]. Moreover, there exists tool support [5] for assisting the verification of protocols in the applied pi calculus.…”

“…As the calculus is parametrized by an arbitrary equational theory, several complex cryptographic primitives have been conveniently modeled in literature. For example, blind signatures were modeled in [14] and non-interactive zero-knowledge proofs were modeled in [3]. This calculus has been successfully used to study a variety of security protocols, e.g.…”

DEEPSEC: Deciding Equivalence Properties in Security Protocols Theory and Practice

“…A typical example is real-or-random secrecy: after interacting with a protocol, an adversary is unable to distinguish the real secret used in the protocol from a random value. Privacy-type properties can also be expressed as such: anonymity may be modeled as the adversary's inability to distinguish two instances of a protocol executed by different agents; vote privacy [DKR09] has been expressed as indistinguishability of the situations where the votes of two agents have been swapped or not; unlinkability [ACRR10] is seen as indistinguishability of two sessions, either both executed by the same agent A, or by two different agents A and B.…”