Democratic Digital Elections

[benStre]

What do we want?

A completely anonymous and transparent election process:

A transparent digital election process in the supranet where each endpoint verified by an authority (trust level 2) has exactly one vote.
In the end, the election results should be publicly visible, as a list in which each vote is listed as a combination of the decision (yes/no, multiple choices) and a secret anonymous identifier linked to the endpoint.
This allows everyone to verify that there vote was counted, and everyone can count all the votes by themselves to verify the results.
At the same time, the votes cannot be traced back to the endpoints and the people behind them.

How do we achieve this?

[benStre]

https://e-estonia.com/solutions/e-governance/e-democracy/

[benStre]

https://cryptography.fandom.com/wiki/Blind_signature

[benStre]

Voting System Concept:

• 3 Public lists (containing DXB Blocks):
  • [1] Endpoints that want to vote create a vote request to an authority including the encrypted vote
  • [2] Response to 1., signed by authority (endpoint only voted once)
  • [3] Published Blind signature of actual vote, issued by authority (first sent back to voting endpoint, blind signature data decrypted, published by endpoint with an anonymous id)
• Election end: all lists should have the same number of entries
  • Scenario 1: more votes (List 3) than registered endpoints (List 2) -> election invalid, unauthorized vote certificates where issued (! should not happen if the authorities are trusted)
  • Scenario 2: fewer or equal votes than registered endpoints (-> some endpoints might not have published their vote) -> election valid
  • Scenario 3: authority never responds to a List 1 entry, can be detected -> authority disqualified

[benStre]

https://eprint.iacr.org/2004/281.pdf

[jonasstrehle]

I'd like to share some of my thoughts:

For digital voting (similar or better compared to the common paper-ballot) we have two essential requirements: **Anonymity ** and Trust

Anonymity
* votes must be casted anonymous and unlinkable to human identities
* nobody should able to proof to others how they voted (during election and in the aftermath)

Trust
* It must be proofed that the system can be trusted
* System must make sure that each participant that is eligible to vote just has a single vote and make this transparent to all
* System needs to make sure that each valid vote is counted and make this transparent to all
* Voter shall be able to make sure their personal vote was counted in the end-result

Most of these issues we can resolve:

• proof that voter is eligible to vote -> using government issued ID card
• anonymous voting to not be able to link votes directly to identities -> ring signatures / blind signatures
• proof that a voters vote was actualy counted -> include identifier that is only recognizable by voter
• proof that system can be trusted -> Open-Source verifiable SW and no central servers (just transparent client side computation)

But the issue stays that a voter is able to make sure that his personal vote was considered (by adding custom identifier) but on the other hand also is able to proof others how he voted. This is fatal and must be considered since this will infiltrate the unlinkable and anonymity aspect of the requirements (e.g. a party tells users to proof them that they voted this exact party to get benefits)
How can a voter make sure that his vote counted and that his vote was not changed while not beeing able to proof his actualy vote to third-parties?

[benStre]

... so the problem even exists without the custom identifier on the ballot

[benStre]

With the same argument, I think it's logically impossible, that you can prove for yourself that your vote is in the list, but not be able share this proof with anyone else.

[jonasstrehle]

Yes - I share the same opinion - I‘m considering it as Paradoxon. You can not solve both problems probably.
I’m paper ballot election it is done by the officials stuff that prevents you from taking selfies as proof and they cast votes as invalid if there are some custom signature or markers except the cross for the vote.

[benStre]

And no one can force you to publish your vote proof, you can always immediately destroy everything (private keys, message cache).
But yes, it might be a slight disadvantage compared to analog voting

[jonasstrehle]

It is not only a slight disadvantage, I think it is a serious thread to the elections.
This would allow to break anonymity and so thread the whole democracy concept

[jonasstrehle]

In this regard - I think a digital anonymous but trustful election as we plan to implement is not really feasible without having trusted authorities (sad pepe)

[benStre]

Are the authorities the problem? We need them anyways, but even with authorities, we cannot get vote proof without linkability?

[jonasstrehle]

I don’t think we need those trusted authorities at all for the election process - except government issued ID cards for anonymous human verification. unyt Auth as authority does not necessarily have to play the role of a trusted instance in this matter. I need to think about that - prevent linkability is absolutely mandatory - maybe we need some kind of mixnet.. tbh I‘m not sure. Doesn’t solve the problem of sharing your vote - yeah. Gonna continue this conversation in near future.

[benStre]

https://ihej.org/wp-content/uploads/2017/03/Verifiability-of-electronic-voting-revised.pdf

---

One of the basic requirements of election systems is the resistance against coercion and vote buying.
Therefore, people should not be able to prove how they voted, even if they want to. This makes it
impossible for someone who forces them to vote in a certain way, or
someone who buys their vote, to check if they actually complied.
This requirement is hard, if not impossible, to realise in an environment without public control, as opposed to the classical polling
booth. People can watch over your shoulder if you are not guaranteed a private environment for voting, and thereby obtain proof of
your vote (Pieters and Becker, 2005).7 Some scientists hold the view
that this and other security problems make it advisable not to implement Internet voting at all (Jefferson et al., 2004).

There is empirical evidence, however, that vote buying may
“survive the secret ballot”, despite isolating the voter in a polling
booth (Brusco et al., 2004). This means that buying does happen,
even if individual votes are secret.

[Rockpick]

In order make it hard for voters to prove their vote after the fact, I propose the following:
The unique identifier, which is used by the voter to confirm that their own vote was counted, is given in a way, that is easy to fake afterwards. In offline voting, it could be displayed on the voting machine for a time (Computer-/Smartphone screen for online elections). The style of the page displaying the identifier should be as bland and simple as possible in Comic Sans, akin to a handwritten note. Replication with a false identifier should be very easy, so that the trust in the proof of vote is nit likely given by a third party. Make a Meme out of it, encourage people (teenagers) to make funny fakes. That way everybody knows, that a reliable proof of vote is unlikely. Basically secrecy through obfuscation. The voter will still know their identifier to identify their own vote on the public list.

[Rockpick]

The polling station could also hand out authentic fake identifiers (on paper), or the screen could give you the option to view some other identifiers, if you want or need a quick fake

[benStre]

Thanks for your input, that sounds like an interesting concept xD

This discussion has been stale for too much time and definitely needs to be continued.

I think that even if we get completely rid of unique identifiers or create some kind of obfuscation, the core problem still remains. The voter can always proof who/what he voted for by sharing his unique anonymous ballot before actually publishing it in the vote registry (See https://github.com/orgs/unyt-org/discussions/2#discussioncomment-6489045).

Someone who wants to verify if a voter actually voted for a certain party just needs to ask the voter to send them their anonymous ballot before publishing it and can then later verify that the exact same ballot was actually added to the public vote registry.
Of course we can make it more difficult on technical level to intercept the ballot casting process in this way, but we can't actually guarantee that there is no linkability.

[Rockpick]

Hmm true. In today's offline elections, a picture of a ballot with a cross doesn't seem like enough proof of vote. Sharing it with an identifier before casting the vote does.

1. the idea to make the identifier known to the voter after the ballot is cast fails, because the election holder can change the vote and give the voter a false identifier. So the identifier needs to be known to the voter beforehand.
2. visual separation of identifier and vote seems like a weak solution, that can probably be circumvented, like via video.

Staying with the idea, that we want to make it easy to give false (but verifyable) information, and assuming a big enough election, something like this could work:
The voting machine shows your real identifier (r), but offers you a random other valid identifier for each option (f1, f2, f3), that you can print out/display instead. That way, if somebody offers you money to vote for 2, you can still vote as you like, but show f2, which can be verified, because it is a real vote.
For the video problem, maybe the machine could be configurated to display a "show", that makes it look like f2 is your real identifier r.

I believe that a good and easy possibility to fake the sharing of your identifier would decrease vote buying and coercion, since the perpetrators could not be sure, they got the identifier they were looking for. Unless they buy all the votes and/or get duplicate identifiers.