Page 256 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

S. Popoveniuc and B. Hosp
248
During the election phase, the election authority publishes all the marked
pages (half ballots) as voted on by voters. After the election, it publishes the
intermediary state of the ballots (ballots ⊕ flip1) and the decrypted ballots
(ballots ⊕ flip1 ⊕ flip2). These are commitments to the values of flip1 and flip2
used in the decryption of the voted half ballots.
During the postelection phase, the election authority is asked to open either
flip1 or flip2 but not both, since opening both would allow the linking of a voted
ballot to the corresponding decrypted one. Also, it is necessary that the partially-
decrypted ballots and the decrypted ones be in a random order (distinct from
each other and from the order of the voted ballots).
The election authority defines the following tables:
– P (for Print)
– D (for Decrypt)
– R (for Results)

The P table is indexed by ballot serial number and contains the top page (P 1 ),
bottom page (P 2 ), and space for the filled-in vote (to be entered after the elec-
tion). It also contains commitments to P 1 and P 2 .
The D table contains the first (D 2 ) and second (D 4 ) mark permutations
(flips), the partially-decrypted vote (D 3 ) to be filled in during decryption, and
information to connect it with the P table (D 1 )and the R table (D 5 ). It also
contains a commitment for each row of D, as well as a commitment for columns
D 1 and D 2 , and another commitment for columns D 4 and D 5 .
The R table contains the cleartext votes (after postelection decryption).
For example, consider an election with six votes. The clear data in all the
tables is in Table 2. (No single person will ever see all of this information.)
Before the election, but after the election authority has made the commitments,
the tables look as they do in Table 3.

Table 2. PDR tables as the election authority sees them, with all the information
available. The tables are properly formed, because, for all the ballots, D 2 ⊕D 4 correctly
represents whether P 2 is a flipped version of P 1 or not. For example, for ballot number
3, on the top page, “a” is associated with “Yes”, and b with “No”. On the bottom
page, the order is “ba”, thus P 2 is a flipped version of P 1.Inthe D table, in the row
corresponding to 3, we have →⊕ = flip. For ballot 1, C 1,1 is a commitment to P 1,
C 1,2 is a commitment to P 2 and so on.

D 1 D 2 D 3 D 4 D 5 DC
Ballot ID P 1 P 2 P 3 CP 1 CP 2 R id R 1
6 → 5 C A
1 ab ab C 1,1 C 1,2 5 1
2 ab ba C 2,1 C 2,2 2 → 4 C B 2
3 ba ab C 3,1 C 3,2 1 → 1 C C 3
4 ba ba C 4,1 C 4,2 3 C D 4
4 → → 2 C E
5 ab ba C 5,1 C 5,2 5
3 → 6 C F
6 ba ab C 6,1 C 6,2 6
CD 1,2 CD 4,5