Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Swiss evoting system – IsProbablePrime is incorrect for input 19

gitlab.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#31

Post by nairboon »

sampo wrote: post #28
nairboon wrote: post #12

For context: Switzerland doesn't have evoting. This is just some big company trying to re-sell a evoting system to the government. It has been in the news a few times, due to software and cryptographic quality issues.

> Switzerland doesn't have evoting. Looks like they had it in varying number of areas from 2003 to 2019. Then all systems were withdrawn due to security concerns. https://en.wikipedia.org/wiki/Electronic_voting_in_Switzerla... https://www.ch.ch/en/votes-and-elections/e-voting/#revision-...

Cantons may experiment with evoting in limited pilot schemes.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#32

Post by hutzlibu »

tarakat wrote: post #24
hutzlibu wrote: post #16

Earlier quoted context omitted.

Hm, but it sounds quite solid(I only know, what is written in the links): They made an open public intrusion test with a bug bounty and they released the sources. And so far no one could find a real weakness.

How many nation-states burned their best zero-days on this public intrusion test?

Likely none, but nation-states can also manipulate traditional voting with enough effort.

(classic spycraft, blackmailing of key persons, intercept mailvoting, etc.)

Nothing is 100% secure.

So the question is, is it good enough?

They said they took great effort to verificate the voting and detect manipulation. I cannot confirm or verify it, but since it is open, I could. That is a great step forward, compared to the closed black boxes, e-voting systems I have heard of before.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#33

Post by mkl »

gsk22 wrote: post #27
mkl wrote: post #10

Earlier quoted context omitted.

It's not really easily testable, because the bug is in pseudocode which cannot be executed.

I must be missing some context, then. It's unclear to me how pseudocode would be used in e-voting?

I think this is the specification for the software that would be used for e-voting. There is code in that repository too, and it calls a method named isProbablePrime, but I can't see a definition of it.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#34

Post by Igrom »

popcalc wrote: post #22
eps wrote: post #19

Earlier quoted context omitted.

That's exactly the company and the product. You could've scrolled a bit more: https://www.evoting.ch/en#transparenz Voting in Switzerland is either in person or by mail.

>Swiss Post has been providing an e-voting system for the cantons since 2016. It has been developing its new system with complete verifiability at its IT site in Neuchâtel since 2020, providing an e-voting system from Switzerland. https://www.post.ch/en/business-solutions/e-voting?shortcut=...

Then next paragraph says:

>It plans to make the system available to the cantons for the trial operation once the development and evaluation of the system has been completed.

https://www.post.ch/en/business-solutions/e-voting

In addition, another page on the same website says:

>The cantons of Neuchâtel, Fribourg, Thurgau and Basel-Stadt used Swiss Post’s previous e-voting system until 2019. The following cantons (among others) are planning to use the new Swiss Post system once this becomes legally and technically possible: [list of cantons follows]

>https://www.post.ch/en/business-solutions/e-voting/success-t...

A Swiss Post press statement says:

>Since the beginning of 2021, Swiss Post’s future e-voting system has been put through its paces by independent experts from all over the world. Another testing opportunity is now available: in addition to the ongoing test options, ethical hackers can now attack the e-voting infrastructure for a period of four weeks. This means that, for the first time, they can accurately simulate and target the vote casting process on the voting portal using sample voting cards. The aim is to detect potential vulnerabilities and rectify them in good time. Swiss Post expects to make its new e-voting system available for use by interested cantons during the course of 2023.

https://www.post.ch/en/about-us/media/press-releases/2022/et...

I don't understand why you must be so haughty (vide "Do the bare minimum research before posting please."). Certainly, you are correct for some definition of "Switzerland has an e-voting system" --- there is one under development, and it had been piloted for a limited time period. However, at the moment, it's only in the public testing stage, it's not officially recognized, cannot be used to cast votes, and there is no guarantee that it will get a green light. I think that's the more accepted definition of "to have an e-voting system", in which case the OP was right, and it was you who did not do adequate research.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#35

Post by mkl »

raverbashing wrote: post #20

I would be very weary of changing such constants as this 19 should have been tested by a lookup table, there's no need to apply such heavy test to it However, by changing that constant (if not properly verified) I'd worry it might change the primality test for some classes of numbers. Where this might be later manipulated to produce a weak key

I think you're misunderstanding the constant: it is only used for small numbers (≤ 23), which are tested with a lookup table, and the constant is itself that lookup table. The test for small numbers is literally just checking a bit, so is not heavy at all.

They intended to do 2^2+2^3+2^5+2^7+2^11+2^13+2^17+2^19+2^23 = 9054380, but they accidentally left out 2^19, and got 2^2+2^3+2^5+2^7+2^11+2^13+2^17+2^23 = 8530092.

You can see the problematic Algorithm 4.16 on p31 here: https://gitlab.com/swisspost-evoting/crypto-primitives/crypt...

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#36

Post by tarakat »

hutzlibu wrote: post #32
tarakat wrote: post #24

Earlier quoted context omitted.

How many nation-states burned their best zero-days on this public intrusion test?

Likely none, but nation-states can also manipulate traditional voting with enough effort. (classic spycraft, blackmailing of key persons, intercept mailvoting, etc.) Nothing is 100% secure. So the question is, is it good enough? They said they took great effort to verificate the voting and detect manipulation. I cannot confirm or verify it, but since it is open, I could. That is a great step forward, compared to the…

Your examples are all less scalable and easier to detect that hacking.

> That is a great step forward, compared to the closed black boxes, e-voting systems I have heard of before.

It's still a black box. You have only their word to go that the published source is what is actually running on the machine in front of you in the voting booth. And they have only the word of their computers.

So yes, it's a great step forward, in the same way that going up a flight of stairs is a great step towards reaching orbit.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#37

Post by Igrom »

mthld wrote: post #26
nairboon wrote: post #12

For context: Switzerland doesn't have evoting. This is just some big company trying to re-sell a evoting system to the government. It has been in the news a few times, due to software and cryptographic quality issues.

Well, I'm swiss and evoting at least twice a year... https://www.eda.admin.ch/eda/en/fdfa/living-abroad/schweizer...

I can't really dispute it if that's what you claim that you're doing, but how can that be? Article 2.3 from the file "Political rights of the Swiss abroad", which is available under your link, asserts:

>2.3 E-voting

>The option to vote online in federal votes and elections has been on hold since mid-2019.

>Adjustments are to be made to the pilot scheme by the end of 2020. The aim is to establish a stable scheme, using the latest technology, and create an accurate and transparent end-to-end voting system that also preserves the secrecy of the ballot. Efforts are also being made to raise levels of public confidence in e-voting by extending independent monitoring, ensuring greater transparency with regard to e-voting systems and how they operate, and involving the scientific community more effectively. The necessary conditions for resuming the e-voting trials will be redefined by 2020.

Is the government information out of date? If so, this should be reported.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#38

Post by hn_zorba »

gerdesj wrote: post #17
sschueller wrote: post #7

Earlier quoted context omitted.

It is brain dead but this is old code from what I recall. We do not have e-voting at this time although the Post which outsourced this first nightmare of a version is still trying to push for it. I highly doubt we will see e-voting here until there is a verifiable proof that it is verifiable. There was a lot of bad press about this and people don't trust this crap. They tried a similar thing for E-ID which was suppos…

"their claim at the poles was" Sorry for being a bit of a pedant but: A pole is a simple structure (eg flag pole), a Pole is a person from Poland and a poll is what you meant 8)

You might be a pedant but it actually helped me understand that message, I was really confused by the poles.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#39

Post by huhtenberg »

mthld wrote: post #26
nairboon wrote: post #12

For context: Switzerland doesn't have evoting. This is just some big company trying to re-sell a evoting system to the government. It has been in the news a few times, due to software and cryptographic quality issues.

Well, I'm swiss and evoting at least twice a year... https://www.eda.admin.ch/eda/en/fdfa/living-abroad/schweizer...

That's not the same system and it's just for the people living outside of the country.

Re: Swiss evoting system – IsProbablePrime is incorrect for input 19

#40

Post by xupybd »

popcalc wrote: post #15
nairboon wrote: post #12

For context: Switzerland doesn't have evoting. This is just some big company trying to re-sell a evoting system to the government. It has been in the news a few times, due to software and cryptographic quality issues.

https://www.evoting.ch/en Do the bare minimum research before posting please.

There is also a bare minimum of manners for polite conversation. I for one prefer when people act politely here. HN is one of the few places online that's normally civil in the comments section.
Post reply on HN