4 % 2 3 % # 5 2 )4 0 5 9 › ... › bell_evtwote13_slides.pdfkeynote speech, evt/wote 2011 we’re...

STAR-Vote: A Secure, Transparent, Auditable, and Reliable Voting SystemJosh Benaloh (Microsoft Research) Mike Byrne (Rice University) Bryce Eakin (independent consultant)Philip Kortum (Rice University) Neal McBurnett (ElectionAudits) Olivier Pereira (Université catholique de Louvain) Philip B. Stark (University of California Berkeley) Dan S. Wallach (Rice University)and the Travis County Elections Office Staff

A rare opportunityDana DeBeauvoir (Travis County Clerk),

Keynote speech, EVT/WOTE 2011

We’re going to design a new voting system from scratch and we need your help.

Travis County (Austin, Texas)Population: ~1 million~392k votes cast November 2012Two weeks of early voting23 locationsElection-day vote centersEvery local precinct now lets you vote any ballot style in the county

Ballots can have as many as 100 contests (typical for Texas)

Travis County voting technologyPre-2001: centrally tabulated optical scan ballotsHuge logistical challenges2001: Hart InterCivic eSlate systemNo ambiguity of voter intentGood accessibility featuresFast resultsUnhappy activists2011: Time for something neweSlate systems reaching end of lifeNothing attractive on the market

Crazy idea: call in the academics!

First meeting: April 2012Long weekend in AustinOlivier flew in on his own moneyJosh took vacation time from MicrosoftTravis County elections staff + academics

Constraint #1: DRE-style UIConsistent UI for all votersAccessibility features (headphones, buttonbox, etc.)Voter-intent disambiguated before they leaveOff-the-shelf hardwareCommercial DRE equipment is $3000+ per machineE.g., Sony Vaio Tap 20, ~$1000Cheaper support contracts as wellPrinter attached to the DREMachine-printed ballot goes into a ballot box

Constraint #2: Paper ballotsTangible, hand-countable records of voter intentMachine-printed to avoid ambiguous marksOnly show selected candidates, save lots of space

Official'Ballot''November'4,'2012Joint'General'and'Special'Elections 11042012 Pct 101A BID11042012 BCID3457894 Pg 1 of 2

Travis'County,'Texas'''Precinct'101A' Travis'County'General'Election'continued

Precinct'145,'Justice'of'the'Peace

Travis'County'General'Election PURP Nancy'NuStraight'Party District'147,'State'Representative

PURP Purple PURP Xena'XiDistrict'210,'United'States'Representative County'Judge

PURP' Anna'Alpha PURP Oscar'OmicronGovernor County'Court'at'Law'677,'Judge

PURP' Betty'Beta PURP Peggy'PiLieutenant'Governor County'Probate'Court'Judge

PURP' Gertrude'Gamma PURP Rhoda'RhoAttorney'General District'Clerk

PURP' Daniel'Delta PURP Samuel'SigmaState'Senator County'Clerk

PURP' Eric'Epsilon GLD Teresa'TauComptroller'of'Public'Accounts County'Treasurer

GLD Zitta'Zeta PURP Uma'UpsilonAttorney'General District'Clerk

PURP' Derick'Delta PURP Selena'SigmaState'Senator County'Clerk

PURP' Edith'Epsilon' GLD Thomas'TauComptroller'of'Public'Accounts County'Treasurer

GLD Zorro'Zeta PURP Ulysses'UpsilonCommissioner'of'the'General'Land'Office County'Commissioner

PURP' Etta'Eta PURP Phillip'PhiCommissioner'of'Agriculture Railroad'Commissioner

PURP' Theodore'Theta PURP Charles'ChiRailroad'Commissioner Place'332,'Justice,'Supreme'Court

PURP' Onne'Iota NO'SELECTIONPlace'334,'Justice,'Supreme'Court Place'554,'Justice,'Supreme'Court

NO'SELECTION NO'SELECTIONPlace'445,'Justice,'Supreme'Court Place'998,'Justice,'Supreme'Court

NO'SELECTION NO'SELECTIONPlace'549,'Justice,'Supreme'Court Place'221,'Judge,'Court'of'Criminal'Appeals

NO'SELECTION NO'SELECTIONPlace'223,'Judge,'Court'of'Criminal'Appeals Place'155,'Judge,'Court'of'Criminal'Appeals


NO'SELECTION NO'SELECTIONRailroad'Commissioner Place'332,'Justice,'Supreme'Court

PURP' Iesha'Iota NO'SELECTIONPlace'334,'Justice,'Supreme'Court Place'554,'Justice,'Supreme'Court

NO'SELECTION NO'SELECTIONPlace'667,'Judge,'Court'of'Criminal'Appeals Distric'245,'Member'State'Board'of'Education

NO'SELECTION PURP Patrice'PsiDistrict'589,'Member'State'Board'of'Education Place'442,'Justice,'33rd'Court'of'Appeals'District

PURP' Kevin'Kappa PURP Orlando'OmegaDistrict'257,'State'Senator

NO'SELECTIONPlace'456,'Justice,'33rd'Court'of'Appeals'District Central'Health'Tax'Ratification'Election

PURP' Larry'Lambda Propositon'1Place'334,'Justice,'Supreme'Court For

NO'SELECTION Propositon'2Place'667,'Judge,'Court'of'Criminal'Appeals Against

NO'SELECTION Propositon'3District'589,'Member'State'Board'of'Education For

PURP' Karla'KappaDistrict'257,'State'Senator

NO'SELECTION Austin'Community'College'Board'of'TrusteesPlace'456,'Justice,'33rd'Court'of'Appeals'District Election

PURP' Leticia'Lambda Place'7,'ACC'TrusteeUmberto'Upsigma

11042012 Pct 101A BID11042012 BCID3457894 Pg 1 of 2

Constraint #3: Vote centersAny voter can go to any precinct and voteOnline voter registration databaseOffline voting machinesCarefully limited data flows across the boundary

Thousands of distinct ballot stylesPre-printed traditional ballots are untenable

Constraint #4: All day batteryPower failures should not close the polls!12+ hours on battery is a requirement

Printers must be thermalLaser consumers too much powerInkjet too unreliable

Touch screen computers with long-life batteries?Laptops vs. small tablets vs. big tabletsSony Vaio Tap 20 can do 4 hours, idle with screen on dim

Sophisticated new featuresVoteBox-style in-precinct networkLocal wired network (no Internet, no wireless)Hash chaining, massive data replicationE2E cryptographyHomomorphic, verifiable talliesPublic bulletin board, full-election ciphertextsEvidence-based elections (risk limiting audits)Verify the paper corresponds to the electronic recordsUsabilityHelp voters and poll workersEnsure security features don’t damage usability

Workflow: RegistrationRegistration

Voter

Precinct 101A

Workflow: AuthorizationRegistration Controller Voting terminals

Auth: 52794

Voter

Precinct 101A

Similar to Hart InterCivic eSlate

Workflow: VotingRegistration Controller Voting terminals

Voter

Workflow: CastingRegistration Controller Voting terminals

Ballot box

Voter



































Controller Voting terminals

Networked ballot box

Ballot box

Notifies other machines that ballot was depositedBallot has random ID

Voter can spoil ballot and start overUsability win!

Ballot box has no UIDeposit and done (just need a scanner for the ballot ID)



































Catch the machine if it cheats!

voter makes selections

voting machine commits irrevocably to

the ballot to be cast

confirmed(ballot is cast)

show commitment(ballot is spoiled)

voter’schoice

“cast” “challenge”

Benaloh challenges [2006]

Benaloh challenges in practiceOriginal idea: print ciphertext behind opaque plateHelios: hash sent to voterVoteBox: ciphertext published on LAN

All require asking the voter to cast or challengeSignificant usability problem

STAR challengesCommitment: ciphertext broadcast to terminalsHappens when the ballot is printed, just like VoteBox

Challenge: voter deposits or keeps ballotChallenger takes home printed ballotBallots that aren’t deposited are decrypted, postedProcedurally: same as a spoiled ballot

Big usability winNo need to ask the voter a challenge questionSimple “live parallel testing”

Post-election verificationSeparate page to take homeBallot hash for lookup on public bulletin board

Cast ballot: ciphertext will match

Challenge ballot: plaintext also present, verifiable

!

Or,$scan$this$code$with$your$phone:$

Voting$Date:$October$30,$2012$$ Location:$Randall's$South$Mopac

Voting$Terminal:$UI12345$ Time:$18:45:56

Look$for$Election$results$and$other$tools$for$confirming$the$election$at:

www.traviscountyelections.org$

YOUR VOTE COUNTS

Thank!you!for!voting!!Take$this$confirmation$of$voting$with$you$

Verify$your$ballot$at:

www.starOvote.org/ballot/HV1235Z7568RK84

Find$your$code$on$the$STAROVote$website$to$ensure$that$your$vote$was$recorded$correctly.

Cryptography outlineEvery machine: public key for signing messagesElection authority is a CAEvery message: signed, broadcast, loggedPlus a hash of the sender’s log headTamper-evident, resilient history of what happened Every ballot: exponential Elgamal countersEncrypted with public key of election authorityHomomorphic tallying, standard kludge for write-insEvery counter includes “zero or one” NIZK proofThreshold crypto for decryption keyTrustees decrypt election totals, challenge ballots

E2E properties verifiableChallenge ballots: match up to plaintext receiptAny ballot: appears on the bulletin boardHomomorphic tallying: provably includes all ballots on the bulletin board

Hash chains: also publicly verifiable

E2E verification processEasy: voter visits URL, server does computation

Better: voter runs open-source tool (provided)

Alternative: voter gives receipt to political party, civic organization, newspaper, etc.Each organization’s smartphone app could scan the QRcode

if (voter == “Josh Benaloh”) do_not_cheat = True

But what if something

goes wrong?

Risk limiting audits (SOBA)Random sampling of individual paper ballotsEach should exactly match up with electronic recordsSuccessful in a number of op-scan elections in California

STAR + SOBA: Requires decrypting ballotsPost-election audit processOnly decrypt ballots as needed for the auditRequires touching tens of ballots, maybe hundreds, unlikely more

Version 1: reencryption mixnet to an auditor keyVersion 2: work in progress, no need for mixnet

Threat Mitigation

Forged votes on one device?Controller Voting terminals

Ballot box

Trivially detectable

No matching authorizations Voting terminal can’t forge because it doesn’t have controller’s public key

No matching paper ballots

Conspiracy with controller?Controller Voting terminals

Ballot box

Votes recorded everywhere?Inconsistent with paperInconsistent with registration dataRecorded only on conspiring machines?Inconsistent with good machinesMitigation: Separate paths from election warehouse to the polling place

Paper ballot stuffing?Controller Voting terminals

Ballot box

Primary tallies use electronic ballotsPaper without corresponding ciphertextis suspiciousChain votingDetect/reject based on timestamps

Malicious machine? (integrity)Controller Voting terminals

Ballot box

Show A, record BPaper ballot inconsistent with ciphertext ballotTwo ways to detectPost-election audit (compare paper to decrypted ciphertexts)

Benaloh-style challenge

Malicious machine? (privacy)Controller Voting terminals

Ballot box

Record plaintextballots in order cast(or subliminal channels)Fundamental problem!

Tentative solution: trusted platform management (TPM)Terminals refuse to boot unsigned codeIntegrity attestations broadcast to network

Malicious / offline ballot boxController Voting terminals

Ballot box

No ballot acknowledgementsObservable by controllerWarn poll workers

Election-night resolutionRescan deposited ballots

Coerce voter w/ ballot randomness?E.g., “cast if even, challenge if odd.”Voter can deliberately spoil and revote many times (“oops!”)

Stronger mitigations possible (e.g., don’t print textual hashes, only barcode)Bad impact on usability

!






YOUR VOTE COUNTS





Voter presents “fake” receiptFalsely impugn the election?Possible mitigations:- Watermarking on physical paper- Digital signature within QRcode

Similar issues with challenge ballotsBallot spoiling process can include wet signatures of poll workers

!






YOUR VOTE COUNTS





StatusVoteBox-based proof-of-concept in progressProduction system would want to start from scratchDesign mostly setRFP almost ready to launch

Legalities?Federal and state certification processesSTAR-Vote is nothing like any other certified voting systemProbably needs to get waivers or amend lawsWhat’s “the ballot”?We’ve got lots of copiesDepending on what fails, one might be better than another“Best record of voter intent” might be a better phraseWhat’s a “recount”?We’ve got lots of evidenceSome is easy to examine mechanically (and will be, regardless)Other stuff requires manual analysisMaybe “risk limiting audit with large sample size” might work

Practicalities?Provisional votingPerhaps have voter use web-based UI to fill out formsPrinted ballot goes in envelope, not ballot boxCiphertext ballot marked as provisionalAnonymity of provisional voters’ preferences preserved“Limited” ballotsVoter moves to Travis from adjacent county, hasn’t re-registeredVoter gets a ballot with only overlapping racesWrite-in votesIn Texas, write-in candidates must register in advanceShould we help the voter select a registered write-in?

Extension #1: remote votingIf the data formats were standard...Ballot style definitionsEncrypted vote output... then we could ship ballot definitions anywhereEmbassies, consulates, military bases... and return the encrypted ballots electronicallyWith the paper ballots to follow via courier services

Handling would be similar to provisional votes

(Note: remote voting ≠ Internet voting)

Extension #2: Hand-marked paperIf an election authority didn’t have Travis County’s constraints

Controller Voting terminals

Fewer voting terminals

New terminals have scanner and printer

Same accessibility features

Identical back-end processingBallot box

Fill out “draft” ballots at home, in advance?

Non-profit consortium?If this works for Travis, it could work for others

Other counties could pitch inConsortium can share costs over a larger community

Some counties already do this for other functions (e.g., records management), so the business model is understood

Vendors can resell hardware, offer training, support contracts

Open source?

STAR-Vote: It’s happeningRegistration Controller Voting terminals

Ballot box

E2E verificationRisk-limiting auditsTons of redundancyUsability/accessibilityCOTS hardware



































4 % 2 3 % # 5 2 )4 0 5 9 › ... › bell_evtwote13_slides.pdfkeynote speech, evt/wote 2011 we’re...

Documents