Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An idea for encrypted, verifiable voting

blag.mpcsh.xyz

Post reply on HN
Print view View original

41–50 of 62 posts

Re: An idea for encrypted, verifiable voting

#41

Post by Findeton »

You already have open-source end-to-end verifiable secure voting systems.

Full Disclosure: yes I work at nVotes/Agora Voting https://nvotes.com https://github.com/agoravoting/agora-dev-box

This approach uses a mixnet (like Tor) to anonymize the ballot so that the secrecy of the vote is preserved. Only if all the election authorities are compromised, the secrecy of the ballot is at stake, but in any case the election is end to end verifiable (this is a sentence that means that specific requirements are fulfilled).

This particular internet/electronic voting system is already being used by many organizations in Spain and Europe.

PD: Yep, nothing is 100% secure. PD2: Yep, census/user authentication is still an unresolved problem in computer science. In Spain we have a government-issued electronic ids but it's no use because of the difficulty of using them.

Re: An idea for encrypted, verifiable voting

#42

Post by kaoD »

Honestly, a very naïve solution.

I tried formalizing the protocol but there are so many inconsistencies. E.g. the ephemeral key is mentioned briefly... Who generates this key? Who encrypts the message? What's the purpose?

Critique of the few parts that are clear:

1. It mentions a vote blockchain. Why blockchain? There's (apparently) no reason to have a chain of votes here. Even a spreadsheet would be fine. Buzzword alert! I know it's irrelevant but it's a huge red flag that a blockchain is crammed there for no reason at all.

2. "the government can know who individuals voted for" This is a no-no. HUGE no-no. TFA trivializes the impact but I definitely wouldn't vote in a system where anyone but me can verify my vote.

3. Even if you can verify your own vote, that's pretty much it for verifiability. Everything else relies on trusting election officials. What?

And I stopped analyzing there because frankly that's pretty much a broken system.

Re: An idea for encrypted, verifiable voting

#43

Post by no_protocol »

secondhandvape wrote: post #26
no_protocol wrote: post #7

Earlier quoted context omitted.

Right, it's important that no one else would be able to know how you voted. Perhaps the election commission would also have a paper receipt with a different unique key. Then both your receipt and the county's receipt would be necessary to locate your vote on the blockchain. Then vote verification could be restricted to the same level of privacy as when voting takes place.

How does this solve the problem? Previously, if I wanted to verify someone else's vote, I would need their SSN and Voter ID. Now I also need the county's receipt. If someone would so readily hand over their SSN and Voter ID, what will stop them from handing over the county receipt?

It is held by the county, think of it like the bank holding the second key to your safe deposit box.

Re: An idea for encrypted, verifiable voting

#44

Post by nickff »

iainmerrick wrote: post #40

There's a bunch of academic research in this area -- how to build an encrypted ballot box that lets you audit that your vote was counted correctly, but prevents anyone else from seeing what your vote was. However, a fundamental problem with any kind of online voting is that it doesn't prevent your vote from being coerced: https://freedom-to-tinker.com/2006/12/12/erosion-secret-ball... The best known way to do that is…

There is little evidence of voter fraud because nobody who wants to look for fraud is able to do so (due to many measures put in place to keep voting private, make it easy, and keep it simple), and as Feynman said "absence of evidence is not evidence of absence". Evidence of fraud does exist, but it is difficult to discern whether it is the tip of an iceberg, or just an ice-cube.[1][2] Given the fact that presidential candidates are spending $5-$200+ per vote, it seems like voting fraud would be cost effective, and is likely done at some scale.

[1] https://en.wikipedia.org/wiki/Lyndon_B._Johnson#Contested_19...

[2] http://ktla.com/2016/11/03/possible-voter-fraud-being-invest...

Re: An idea for encrypted, verifiable voting

#45

Post by Findeton »

iainmerrick wrote: post #40

There's a bunch of academic research in this area -- how to build an encrypted ballot box that lets you audit that your vote was counted correctly, but prevents anyone else from seeing what your vote was. However, a fundamental problem with any kind of online voting is that it doesn't prevent your vote from being coerced: https://freedom-to-tinker.com/2006/12/12/erosion-secret-ball... The best known way to do that is…

> a fundamental problem with any kind of online voting is that it doesn't prevent your vote from being coerced

That's not exactly true. In many countries the vote is not strictly secret, in the sense that the secrecy of the vote is not enforced: you can show what you are going to put in the ballot to others before casting your vote... and therefore your vote can be coerced or bought as others can verify that you voted as they wanted.

In electronic/online elections, vote coercion is not generally solved BUT the situation is better: normally you can cast your vote as many times as you want and only your last vote will count. Therefore you can vote in presence of your boss, for example, and vote whatever you actually want afterwards.

Re: An idea for encrypted, verifiable voting

#46

Post by iainmerrick »

Findeton wrote: post #45
iainmerrick wrote: post #40

There's a bunch of academic research in this area -- how to build an encrypted ballot box that lets you audit that your vote was counted correctly, but prevents anyone else from seeing what your vote was. However, a fundamental problem with any kind of online voting is that it doesn't prevent your vote from being coerced: https://freedom-to-tinker.com/2006/12/12/erosion-secret-ball... The best known way to do that is…

> a fundamental problem with any kind of online voting is that it doesn't prevent your vote from being coerced That's not exactly true. In many countries the vote is not strictly secret, in the sense that the secrecy of the vote is not enforced: you can show what you are going to put in the ballot to others before casting your vote... and therefore your vote can be coerced or bought as others can verify that you vote…

Ah, I didn't know that! I'm only familiar with the UK and US systems, where you cast a secret ballot and you have no way afterwards to prove how you voted (unless you used mail-in voting).

And that's a good point about being able to change your vote.

Re: An idea for encrypted, verifiable voting

#48

Post by delinka »

castratikron wrote: post #30

The main problem with digitally signing/encrypting a vote is that the public key must be known, which means that someone's vote cannot be anonymous. I like the idea of a county/precinct/district being the entity who signs the results of a vote. This would protect the anonymity of individual voters, since results are reported on a per county basis today anyways. And if a county is suspected of voter fraud, you could a…

You assume that a key pair is (publicly?) associated with an individual. I can generate a key pair, sign something (publishing the public part of the key, but not the fact that it was me owning it), then discard the key pair.

How will you associate the public key to me?

Re: An idea for encrypted, verifiable voting

#49

Post by Findeton »

godot wrote: post #8

As a software engineer who knows very little about government security and voting security, can someone explain why you can't just build it like a regular web app (with very good security measures -- the usual HTTPS, database encryption, proper firewall rules to servers, etc.), and have the user enter their voter ID and social security and submit their vote via a web form? From reading this article, it would seem tha…

You need the voting system to be end-to-end verifiable.

The secrecy of the vote must be preserved, meaning that not even the servers can know, at any step of the process, that voter A voted for option X.

Voters must be able to verify that when they choose option A, option A is correctly coded into their ballot.

Voters must be able to verify that their ballot is included in the tally and that their ballot is unmodified.

Anyone must be able to verify the process of mixing/anonymizing, decrypting and tallying the ballots.

So it's not easy at all because the requirements are quite contradictory. But you can do it with mixnets, for example, using them in a similar fashion as Tor. That's the way Scytl or nVotes do it :)

Re: An idea for encrypted, verifiable voting

#50

Post by iainmerrick »

nickff wrote: post #44
iainmerrick wrote: post #40

There's a bunch of academic research in this area -- how to build an encrypted ballot box that lets you audit that your vote was counted correctly, but prevents anyone else from seeing what your vote was. However, a fundamental problem with any kind of online voting is that it doesn't prevent your vote from being coerced: https://freedom-to-tinker.com/2006/12/12/erosion-secret-ball... The best known way to do that is…

There is little evidence of voter fraud because nobody who wants to look for fraud is able to do so (due to many measures put in place to keep voting private, make it easy, and keep it simple), and as Feynman said "absence of evidence is not evidence of absence". Evidence of fraud does exist, but it is difficult to discern whether it is the tip of an iceberg, or just an ice-cube.[1][2] Given the fact that presidentia…

[1] is from 1948, but [2] is definitely worth looking into. 83 ballots isn't widespread fraud unless it's happening a lot, everywhere. Maybe it is! But it would require a massive and very disciplined conspiracy working at many levels across the country. To me, the burden of proof lies on anyone claiming there is such a conspiracy.

(Trump complained of a vote-rigging conspiracy, of course, but unsurprisingly he shut up once he actually won. He changes his position too often to be credible.)

Post reply on HN