Page 266 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

S. Popoveniuc and B. Hosp
258
symbols on the bottom page, the election authority only needs to generate two
random numbers between 1 and c, and record these numbers as P 1 and P 2 to
indicate the shift distance for the pages of ballot x.
Each D-matrix instance will require its own set of decrypting mark permu-
tations (columns D 2 and D 4 ). (It is for this reason that at least the decrypting
mark permutations must be performed after the row permutations.) For each
i
row of each D , the election authority generates a random number between 1
i
i
and c, and records this number in D . D is set such that the modular sum of
2
4
the ballot’s entries in P 1 and P 2 equals the sum of its entries in D 2 and D 4 .
Random Number Generation. The permutation algorithm described above
can also be used for the random number generation. The election authority can
compute a permutation π of 1, 2,...,c and use π(1) as the random number.
B Commitments
This section describes how the commitments in PunchScan are computed. We
use the comma (“,”) to represent the concatenation operation. There are two
secret AES 128-bit keys, MK 1 and MK 2, and a public 128-bit constant, C.

B.1 Computing AES Keys

This section requires the use of two 128-bit AES keys. Given message M,let
M 128 be the first 128 bits of M (if M is shorter then 128 bits, M will be padded
with trailing zeros); a random key SK m is generated as follows:

(M 128 )))
SK m = D MK 1 (C ⊕ E MK 2 (C ⊕ E MK 1
where ⊕ is the XOR operation and E and D are AES Encrypt and Decrypt
EBC NoPadding operations.

B.2 Commitment Algorithm

Given a message M, the commitment to M is computed as follows:
1. Generate a 128-bit AES key K m as described in Section B.1.
2. Encrypt the public constant C with K m, using AES 128-bit ECB NoPadding.
(C). Note that SK m has 128 bits.
Let the result be SK m = AES K m
3. Concatenate M with SK m and hash everything using SHA256, resulting in
h 1 .So, h 1 = SHA256(M, SK m).
(h 1 )), where the AES encryption is AES
4. Let h 2 = SHA256(M, AES SK m
128bit ECB PKCS#5Padding.
5. The commitment is h 1 ,h 2 (h 1 concatenated with h 2 ).
We now describe the computation of M for all the commitments needed in
PunchScan.