Page 62 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

A. Juels, D. Catalano, and M. Jakobsson
54
The first is a ciphertext on the candidate choice of the voter, the second a ciphertext on
the credential of the voter.
Additionally, V i includes NIZK proofs of knowledge of σ i and c j ,a NIZK that α i ,α
have the same discrete logarithm with respect to basis g 1 and g 2 and also a NIZK proof i
that c j ∈ C, i.e., that c j represents a valid candidate choice. The latter can be ac-
complished, for example, using a disjuctive proof that the ciphertext constitutes a valid
encryption of a candidate choice in C. These three NIZK proofs, which we denote
collectively by Pf, may be accomplished efficiently using standard techniques. As is
standard practice, the challenge values for Pf are constructed using a call to a crypto-
˜
graphic hash function, modeled in our security analysis by a random oracle OW. Input
˜
to OW for these challenge values includes , E 1 ,E 2 and commitment values required
for realization of the NIZK proofs. V i posts B i =(E 1 ,E 2 ,Pf) to BB via an anony-
mous channel.
Tallying: To tally the ballots posted to BB, the authority T performs the following
steps:
1. Checking proofs: T verifies the correctness of all proofs on BB. Any ballots with
invalid proofs are discarded. For the valid, remaining ballots, let A 1 denote the list
of ciphertexts on candidate choices (i.e., the E 1 ciphertexts), and let B 1 denote the
list of ciphertexts on credentials (i.e., the E 2 ciphertexts).
2. Eliminating duplicates: The tallying authority T performs pairwise PETs on all
ciphertexts in B 1, and removes duplicates according to some pre-determined pol-
icy, using e.g., order of postings to BB. When an element is removed from B 1 ,the
corresponding element (i.e., that with the same index) is removed from A 1 .Welet
B and A be the resulting “weeded” vectors. This is equivalent to retaining at

1
1
most one ballot per given credential.

3. Mixing: T applies MN to A and B (using the same, secret permutation for
1 1
both). Let A 2 and B 2 be the resulting lists of ciphertexts.
4. Checking credentials: T applies mix network MN to the encrypted list L of
credentials from the voter roll. T then compares each ciphertext of B 2 to the ci-
phertexts of L using PET. T retains a vector A 3 of all ciphertexts of A 2 for which
the corresponding elements of B 2 matchanelement of L according to PET. This
step achieves the weeding of ballots based on invalid voter credentials.
5. Tallying: T decrypts all ciphertexts in A 3 and tallies the final result.
How to cheat a coercer: One possible implementation of the function fakekey is sim-
ply for the coerced voter V i to select and reveal a random group element ˜σ i , claiming
that this is the credential σ i . (If coerced multiple times – whether for one or more
elections—the voter V i would, of course, release the same value ˜σ i .) In addition, partial
or full transcripts from the registration phase may be given to the adversary, depending
on the scenario, as we now explain.
Upon receiving a claimed credential ˜σ i , the adversary would like to verify if it is
correct. Let us consider the possibility of doing so under each of our three possible
assumptions on the registration phase; in doing so, recall that we always assume that
the adversary can corrupt only a minority of servers in T , and so, will not be able to
decrypt any of the semantically secure encryptions of credentials.