But why ElGamal?
Moscow's blockchain voting system cracked a month before election
81–90 of 112 posts
Re: Moscow's blockchain voting system cracked a month before election
#82Earlier quoted context omitted.
When I click the reference footnote on that page leading to iad.gov I get an invalid certificate authority error, heh. https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for... )
For obvious reasons, the US government was never an authorized CA in firefox, and the application to be put on the list of trusted CAs was denied. The DoD root cert (for .mil addresses) is similarly distrusted. AFAIK most other browsers operate similarly. If you so desire, you can simply add the FCPCA and DoD certs to your trust store. Or... you know.. not. https://wiki.mozilla.org/CA:GovernmentCAs https://bugzilla.m…
Re: Moscow's blockchain voting system cracked a month before election
#83Users submit an application to vote remotely through a government-controlled site and confirm it by receiving a SMS with code. It is obvious that government is able to submit such an application to its own server without bothering the real user.
The users vote remotely and confirm their identity by providing a code from SMS (again) and the government can just look at the code on the server. It isn't important what cryptography is used there. You don't need to guess random numbers when you have root access to the server.
The observers are supposed to see a tape where some hashes will be printed when someone votes. Maybe they will be allowed to see the registry of voters who chose to vote remotely, maybe they will not be allowed.
I cannot prove this, and this is my personal opinion, so you shouldn't believe me, but I think the government wants an opaque procedure to produce legitimate looking election results with desired outcome. With paper voting, there are too many points of failure: it is difficult to throw the ballots in the box when there is a vigilant observer. Remote voting doesn't have such flaws.
If there was a fraud, it would be difficult to explain to a non-programmer. They don't understand anything, they just see how the program says "hash doesn't match". But maybe it is just a program written by foreign agents (and stored on foreign "Github" servers) producing fake results. For comparison, with paper voting anyone can understand that there is a fraud if you show them the video.
Also, the government party is slowly losing its rating and starts losing regional elections. Remote voting might be a cure for this undesired situation.
And probably any other government (for example Estonian) that implements such an opaque system has similar aims.
Re: Moscow's blockchain voting system cracked a month before election
#84Researchers overlook more important issue. As the government controls the servers, it can impersonate any number of users. Users submit an application to vote remotely through a government-controlled site and confirm it by receiving a SMS with code. It is obvious that government is able to submit such an application to its own server without bothering the real user. The users vote remotely and confirm their identity…
Re: Moscow's blockchain voting system cracked a month before election
#85The only benefit a "Blockchain" can provide is decentralized time ordering. All other properties must be verified by the client, don't require a blockchain, and are typically some other cryptographic proof. There are many properties of a blockchain that are an anti-feature of voting.
> There are many properties of a blockchain that are an anti-feature of voting. I don't know much of anything about blockchains and voting. What properties do you consider antifeatures?
In case of voting, there are no independent nodes, all modifications to the registry are done by the election committee (or authorised by them) and users can only verify the transaction list. So it would be easier to just present election events as a Merkle tree (voter X has submitted an encrypted ballot Y, and the hash of the registry before this was Z).
But in this case there would be no "blockchain" and no feeling of reliability and security.
If I made a mistake here, I would be happy if someone would point at it.
Re: Moscow's blockchain voting system cracked a month before election
#86It’s shame that this wasn't used in production and then nefariously used against Putin.
I think Putin is quite popular in Russia and would have won in a free and fair election.
If they could win easily, why would they falsify election results or ban opposition candidates? They don't want to play fair.
This is actually a problem for Putin, that he has certain popularity and trust, but it isn't transferred to people from his party, to governors etc.
Re: Moscow's blockchain voting system cracked a month before election
#87Earlier quoted context omitted.
Yes I am, in fact, a citizen of Russia. I'm also a US citizen. I know this because there's been both video and statistical evidence, as well as numerous reports of electoral district vote counters simply falsifying final vote tallies, people being bused around to vote in multiple districts, etc, etc. Statistical evidence of vote count manipulation is actually pretty damning. If you calculate the distribution of vote…
Don’t those spikes happen in small districts though, where you’re likely to have 1,2,4,5,10,or20 votes which would all guarantee a result with a multiple of 5 or 10%?
Here is an article in Russian with graphs [1]. This [2] is a graph where axis X contains a turnout percent (how many voters took part in voting at a polling station) and axis Y contains a number of polling stations with that value of turnout.
Here is another graph [3]: axis X contains turnout percent, axis Y contains number of people registered at the polling stations and each point is a station (there are about 90 000 total in Russia). You can see that there are large polling stations with turnout above 90% and number of voters above 2000. You can also see that elections seem to be very popular as majority of the points lie in the right part of the graph.
This graph [4] is built by the same rules, but contains data only on polling stations from one southern region - Ingushetia. You can see how neatly points align along the line at 80% turnout. People of Ingushetia are very active.
These graphs [5] are built by the same rules, but for other region - Chechnya and for 4 different elections in 2011, 2012, 2016 and 2018. The perfect line in 2011 becomes diffused by 2018 and slightly shifts to the left. On the graph for year 2018 one can see that there are "atypical" polling stations who have suspiciously low turnout. One of possible explanations for this could be that in 2018 several dozens of brave volunteers decided to take a risk to go to Chechnya as observers.
[1] https://habr.com/ru/post/352424/
[2] https://hsto.org/webt/2y/xh/wf/2yxhwffbr7oy0escvp1ecvmcjdc.p...
[3] https://hsto.org/webt/4h/3e/ko/4h3ekola6f-to10zgpvlbg9bd1g.p...
[4] https://hsto.org/webt/ri/c6/ul/ric6ulcyzuefrxvnjm7n6g7qcz8.p...
[5] https://hsto.org/webt/dw/j2/bl/dwj2blnsrah7_fwkzbqk4eyucga.p...
Re: Moscow's blockchain voting system cracked a month before election
#88Electronic voting could also be used simply as a way to save and fast-track the voting process, making it more convenient. Confirm your votes on the app, get to upload them in-bulk to the machine (via QR code or something), and all you have to do is confirm. Lots more time to think about the vote, but you still have t confirm in person.
Longer, more casual access to voting booths and mandatory paid time off is the best thing most democratic/semi-democratic systems could do to help voting these days.
Re: Moscow's blockchain voting system cracked a month before election
#89The only benefit a "Blockchain" can provide is decentralized time ordering. All other properties must be verified by the client, don't require a blockchain, and are typically some other cryptographic proof. There are many properties of a blockchain that are an anti-feature of voting.
Re: Moscow's blockchain voting system cracked a month before election
#90Researchers overlook more important issue. As the government controls the servers, it can impersonate any number of users. Users submit an application to vote remotely through a government-controlled site and confirm it by receiving a SMS with code. It is obvious that government is able to submit such an application to its own server without bothering the real user. The users vote remotely and confirm their identity…