Page 67 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

Coercion-Resistant Electronic Elections

Now if the adversary outputs a guess bit b the simulator returns b as his own guess for
the decisional Diffie-Hellman challenge.
Observe that if the simulator’s input is a Diffie-Hellman triplet (that is d =1)then
the simulation above is perfectly indistinguishable from the experiment Exp c-resist . 59
ES,A,H
b
a
As a matter of fact, assuming g 1 = g, g 2 = g ,h 1 = g ,h 2 = g ab for some g,
h
r i
any ciphertext of the form (α i,1 = h ,α i,1 = h ,β i,1 = h r i x 1 r i x 2 m) is actually
r i
2
2
1
1
a valid one. Indeed h r i = g br i = g br i , h r i = g abr i = g br i and h r i x 1 r i x 2 m =
h
1 1 2 2 1 2
g
g br i x 1 abr i x 2 m = g br i x 1 br i x 2 m = h br i m.
g
1 2
This means that
Pr[S =1|d =1] = Pr[Exp c-resist (V)= 1] = Succ c-resist (V)
ES,A,H
ES,A
where we denoted with V the view of the adversary.
On the other hand if the simulator’s input is not a Diffie-Hellman triplet (that is
d =0) then the view produced by the simulation above does not give any information
(in a strong information theoretic sense) about the votes posted by the honest parties.
c
a
b
This is because, assuming g 1 = g, g 2 = g ,h 1 = g ,h 2 = g for some c ∈ U Z q ,
r i
r i
h
one has that a ciphertext of the form (α i,1 = h ,α = h ,β i,1 = h r i x 1 r i x 2 m)
1 i,1 2 1 2
actually “masks” the message m perfectly. Indeed h r i = g br i = g 1 br i , h r i = g cr i =
2
1

r i x 1 r i x 2 br i x 1 c r i x 2 br i x 1 br i x 2 c r i x 2
g
g c r i and h 1 h 2 m = g br i x 1 cr ix 2 m = g 1 g 2 m = g 1 g 2 g 2 m =
2

h br i c r i x 2 m.
g
2
This means that, in this case, the probability that the simulator outputs one is equal
to the probability that the adversary outputs one in experiment Exp c-resist-ideal .
More formally
Pr[S =1|d =0] =Pr[Exp c-resist-ideal (V)= 1] = Succ c-resist-ideal (V)
ES,A,H ES,A
This means that
Adv ddh =Pr[S =1|d =1] − Pr[S =1|d =0] = Adv c-resist
S ES,A
under the Decisional DIffie-Hellman Assumption this quantity is negligible.
6Conclusion
Beyond the fundamental properties of correctness and verifiability, an electronic elec-
tion system can ultimately inspire confidence in voters only if it is well protected against
criminal interference. We have sought here to define coercion resistance in the broadest
possible manner, encompassing not just abuse of voting receipts, but randomization,
forced-abstention, and simulation attacks. Our investigations also capture the funda-
mental statistical limits of adversarial interference in an election, showing how voters
can achieve true protection only by concealment in larger population. Our proposed
coercion-resistant voting scheme underscores that these limits may be within practical
reach. The main limitation on the scalability of our scheme is its quadratic complex-
ity. That said, since the initial publication [30] of the ideas presented here, Clarkson,