Page 293 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

A Verifiable Voting Protocol Based on Farnel
285
Tallying authorities. These authorities are responsible for running a mix net,
and for decrypting and counting the votes. They also define the number of
initial votes and generates them; in addition, they define the number of votes

that each voter verifies. They hold the keys T ,T. We suppose that a subset
of the talliers are trustworthy.
5.3 The Protocol
Initialization phase. In this phase, the following parameters of the voting are
established and published on the bulletin board: the voting options (or candi-
dates), the number of initial votes, the number of IDs that should be printed on
the receipt. Let’s say that there are m options i (i =1, ··· ,m), a number x of
initial votes, and a number l of IDs printed on the receipt.
The talliers generate the initial votes according to x and to the commitment
scheme explained before. Then the talliers publish commitments of the form:
commit(i, r)= E T (i, s 1 ),E T (r, s 2 ),E M (ir, s 3 ) for different r, s 1 ,s 2 ,s 3 ∈ R Z q
in each commitment. The values E M (ir, s 3 ) are handled by the special ballot
box as its private list L of encryptions.

Voting phase. After proving her eligibility to the voting authorities, the voter
is allowed to interact with the DRE in the voting booth. The following steps are
executed to cast a vote and to obtain the receipt. Figures 4 and 5 exemplify the
scheme for three voting options.
1. (Generating the ballot). For each option i (i =1, ··· ,n), the DRE generates
the triple: i, commit(i, r i1 ), commit(i, r i2 ) for r i2 ,r i1 ∈ R Z q . As described
before, each commitment is composed of: E T (i, s 1 ),E T (r, s 2 ),E M (ir, s 3 )
for r, s 1 ,s 2 ,s 3 ∈ R Z q . After that, the DRE prints the ballot on the receipt
(a). Here as well as in the next two steps the ballot is not shown to the voter.
2. (Opening some commitments). The voter informs the DRE to open the first
or the second commitment for each option i. After this, the DRE opens
the corresponding commitments (b). In other words, for a commitment
E T (i, s 1 ),E T (r, s 2 ),E M (ir, s 3 ) already printed on the receipt, the DRE
prints r, s 1 ,s 2 ,s 3 on the receipt as decommitment.
3. (Voting). In order to vote, the voter informs her option i and the DRE prints
the corresponding, not opened, commitment on the receipt (c). In particular,
the DRE prints E T (i, s 1 ),E T (r, s 2 ),E M (ir, s 3 ) .
4. (Verifying the ballot). Now, the DRE shows the receipt (A) to the voter.
The voter should verify if the commitments selected were opened and if the
commitment corresponding to her vote was printed. If the receipt is cor-
rect, the voter confirms her vote. The DRE then prints a stripe on the not
opened commitments of the ballot to erase them. She also prints the bar-
code of E M (ir, s 3 ) of the voter’s vote and adds a digital signature to the
receipt; the voter holds this receipt (B). The other elements of the vote,
E T (i, s 1 ),E T (r, s 2 ) , are sent to the bulletin board.