Page 80 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

M. Hirt
72
Ballots
5.2
A ballot consists of a vector of votes, v =(v 1 ,...,v L ), where v i is the vote for
the i-th candidate. In a K-out-of-L election, a ballot is valid if and only if each
vote v i is either 0 or 1, and the votes on the ballot sum up to K. If voters should
be allowed to vote for less than K candidates, then this is modeled as K-out-
of-(L + K) election, where the latter K candidates represent “abstain” and will
not be tallied.
As simple notation, we write E( v, α)for L-vectors v =(v 1 ,...,v L )and
α =(α 1 ,... ,α L ), meaning the component-wise application of the encryption

function, i.e., E( v, α)= E(v 1 ,α 1 ),...,E(v L ,α L) . Analogously, we defined
R( e, ξ), v 1 + v 2 , α 1 α 2 ,and e 1 ⊕ e 2 .

5.3 Set-Up
In the set-up phase, the authorities jointly generate a uniformly distributed
secret key and the corresponding public key for the encryption scheme, where
the secret key is shared among the authorities, and the public key is publicly
known. A protocol for (verifiable) generating a sharing of a randomly chosen
secret key and a public key is a requirement on the encryption function.

5.4 Casting a Ballot

A ballot is cast as follows: The voter constructs a random encryption e = E( v, α)
L
for his vote vector v and randomness α ∈ R R , and posts it onto the bulletin
board. Furthermore, the voter posts a proof of validity. A ballot v =(v 1 ,...,v L )

is valid if and only if v i ∈{0, 1} for i =1,... ,L and v i = K. In the following
we construct a (finally non-interactive) validity proof for the encrypted ballot
e =(e 1 ,...,e L ).
The validity proof is constructed as the AND-combination of a Σ-proof for
each i =1,... ,L, each stating that e i is an encryption of either 0 or 1, and a
Σ-proof stating that e 1 ⊕ ... ⊕ e L is an encryption of K. The proofs that e i is
an encryption of either 0 or 1 is constructedas anOR-combination of a proof
stating that e i encrypts 0and aproof statingthat e i encrypts 1.
is an
For easier notation, we write e i,0 = e i and e i,1 = e i E(1, 0), that is, e i,v i
encryption of 0 with randomness α i .Furthermore,wewrite e Σ =(e 1 ⊕...⊕e L ),
α Σ = α 1 ... α L ,and e Σ,K = e Σ E(K, 0). A ballot is valid exactly if
for each i,either e i,0 or e i,1 encrypts 0, and e Σ,K encrypts 0. This proof can be
constructed straight-forward as AND-combination of OR-combinations of proofs
that a given encryption contain 0 (Section 4).
The following protocol is a OR-combined Σ-proof of knowledge of a witness
α i such that e i,0 = E(0,α i )OR e i,1 = E(0,α i ). In the protocol for proving
, the prover applies the simulator.
e i,1−v i