Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell...
-
Upload
leona-charla-martin -
Category
Documents
-
view
216 -
download
3
Transcript of Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell...
![Page 1: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/1.jpg)
CivitasCivitasA Secure Remote Voting SystemA Secure Remote Voting System
Michael Clarkson, Stephen Chong, Andrew MyersCornell University
Dagstuhl Seminaron Frontiers of Electronic Voting
July 31, 2007
![Page 2: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/2.jpg)
Clarkson: CIVS 2
GoalsGoals
Practicalperformance
Strong,provablesecurity
Remotevoting
Civitas (name was originally CIVS)
![Page 3: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/3.jpg)
Clarkson: CIVS 3
TerminologyTerminology
• Voting system: (software) implementation
• Voting scheme: cryptographic construction
• Voting method: algorithm for choosing between candidates
![Page 4: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/4.jpg)
Clarkson: CIVS 4
Security of CivitasSecurity of Civitas
• Satisfies strong security properties– Coercion-resistant– Universally verifiable
• Against a powerful adversary• With distributed trust in authorities
– Election authority: An agent providing some component of the election system
– Three different types: registration teller, ballot box, tabulation teller
• Using principled techniques– Cryptographic security proofs (by us and others)– Language-based security: Jif (Java + Information
Flow)
![Page 5: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/5.jpg)
Clarkson: CIVS 5
Remote Voting with CivitasRemote Voting with Civitas
• No supervision of voting or voters• The right problem to solve:
– More general problem than supervised voting
– Internet voting (Debian, ACM, SERVE)– Absentee ballots
![Page 6: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/6.jpg)
Clarkson: CIVS 6
Practicality of CivitasPracticality of Civitas
• Implementation– 22,000 LOC in Jif, Java, and C
• Performance study– Election tallied in 35 sec / voter /
authority– Cost is about 4¢ / voter– Cf. current election costs of $1-$3 / voter
[International Foundation for Election Systems]
![Page 7: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/7.jpg)
Clarkson: CIVS 7
Civitas: OutlineCivitas: Outline
• Security requirements• Design
– Based on scheme due to Juels, Catalano, and Jakobsson (JCJ) [WPES ’05]
– We added:• Distributed registration• Lightweight ballot box• Blocking
– But this talk is not about mechanisms• Security evaluation• Performance study
![Page 8: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/8.jpg)
Clarkson: CIVS 8
Confidentiality (Privacy)Confidentiality (Privacy)
• No adversary can learn any more about votes than is revealed by the final tally– Anonymity: hide map from voter to vote– Receipt-freeness: prohibit proof of vote– Coercion-resistance: adaptive
• Including forced abstention or randomization
[JCJ; Delaune, Kremer, and Ryan ‘06]
Voters cannot prove whether or how they voted, even if they can interact with the
adversary while voting.
Stronger
![Page 9: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/9.jpg)
Clarkson: CIVS 9
Integrity (Correctness)Integrity (Correctness)
• Universal verifiability:
• Including:– The votes they cast are included– Only authorized votes are counted– No votes are changed during tallying
[JCJ, Sako and Killian ’95]
All voters can verify that the final tally is correct
![Page 10: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/10.jpg)
Clarkson: CIVS 10
AvailabilityAvailability
• Unavailability of votes can compromise integrity– Missing votes not universally detectable– So need to guarantee availability of votes
• Otherwise, availability not guaranteed– Software systems implementing authorities– Results of election
• Orthogonal extensions possible– Byzantine fault tolerance– Threshold cryptography
![Page 11: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/11.jpg)
Clarkson: CIVS 11
AdversaryAdversary
• May corrupt all but one of each type of election authority
• May coerce voters, demanding any secrets or behavior, remotely or physically
• May control network• May perform any polynomial time
computation
[JCJ]
![Page 12: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/12.jpg)
Clarkson: CIVS 12
Civitas ArchitectureCivitas Architecture
JCJ scheme
bulletinboard
voterclient
tabulation teller
tabulation teller
tabulation teller
registrar
![Page 13: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/13.jpg)
Clarkson: CIVS 13
Civitas ArchitectureCivitas Architecture
Civitas scheme
bulletinboard
voterclient
registration teller
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
![Page 14: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/14.jpg)
Clarkson: CIVS 14
Civitas ArchitectureCivitas Architecture
bulletinboard
voterclient
registration teller
tabulation teller
tabulation teller
tabulation teller
Civitas scheme
registration teller
registration teller
ballot boxballot boxballot box
What makes this secure? Why do we believe it is?
![Page 15: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/15.jpg)
Clarkson: CIVS 15
Security EvaluationSecurity Evaluation
• Cryptographic reduction proof by JCJ– Voting scheme provably achieves coercion
resistance and universal verifiability– We extended that proof for our distributed
registration construction– And we instantiated various oracles, ZK
proofs
• Gain insight by reviewing election process and assumptions used in proofs
![Page 16: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/16.jpg)
Clarkson: CIVS 16
CryptographyCryptography
Assumption 1. DDH, RSA, random oracle model.
bulletinboard
voterclient
registration teller
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
ballot boxballot boxballot box
![Page 17: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/17.jpg)
Clarkson: CIVS 17
RegistrationRegistration
voterclient
registration teller
registration teller
registration teller
Assumption 2. The adversary cannot masquerade as voter during registration.
bulletinboard
tabulation teller
tabulation teller
tabulation teller
ballot boxballot boxballot box
Implement with: strong authentication, non-transferable secrets.
obtain credential
![Page 18: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/18.jpg)
Clarkson: CIVS 18
RegistrationRegistration
voterclient
registration teller
registration teller
registration teller
Assumption 3. Each voter trusts at least oneregistration teller and has untappable channel to that teller.
bulletinboard
tabulation teller
tabulation teller
tabulation teller
ballot boxballot boxballot box
Why: weakest known assumption for coercion resistanceImplement with: advance, in person registration; information-theoretic encryption
obtain credential
![Page 19: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/19.jpg)
Clarkson: CIVS 19
VotingVoting
voterclient
ballot boxballot boxballot box
Assumption 4. Voters trust their voting client.
bulletinboard
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
registration teller
Reasonable: voter can choose client
![Page 20: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/20.jpg)
Clarkson: CIVS 20
VotingVoting
voterclient
ballot boxballot boxballot box
Assumption 5. The channels from the voter tothe ballot boxes are anonymous.
bulletinboard
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
registration teller
Why: otherwise coercion resistance trivially violated.
submit vote
![Page 21: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/21.jpg)
Clarkson: CIVS 21
VotingVoting
voterclient
ballot boxballot boxballot box
Assumption 6. Each voter trusts at least oneballot box to make vote available for tallying.
bulletinboard
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
registration teller
Why: expensive fault tolerance not required.
submit vote
![Page 22: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/22.jpg)
Clarkson: CIVS 22
TabulationTabulation
bulletinboard
voterclient
registration teller
tabulation teller
tabulation teller
tabulation teller
registration teller
registration teller
ballot boxballot boxballot box
Assumption 7. At least one tabulation teller is honest.
Why: keeps tellers from decrypting votes too earlyor cheating throughout tabulation.
retrieve votes
anonymize and authenticate votes
audit
![Page 23: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/23.jpg)
Clarkson: CIVS 23
ImplementationImplementation
• Civitas implemented in Jif [Myers ’99, Chong and Myers ’04 ‘05]– Security-typed language– Static-type checking and dynamic
enforcement of information-flow policies
• Yields assurance– Code is correct with respect to policies– Policies can be audited and certified
![Page 24: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/24.jpg)
Clarkson: CIVS 24
ProtocolsProtocols
• Proof of knowledge of discrete log [Schnorr]• Proof of equality of discrete logarithms
[Chaum & Pederson]• Designated-verifier reencryption proof [Hirt
& Sako]• 1-out-of-L reencryption proof [Hirt & Sako]• Signature of knowledge of discrete
logarithms [Camenisch & Stadler]• Reencryption mix network with randomized
partial checking [Jakobsson, Juels & Rivest]• Plaintext equivalence test [Jakobsson &
Juels]
![Page 25: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/25.jpg)
Clarkson: CIVS 25
ProtocolsProtocols
• Proof of knowledge of discrete log [Schnorr]• Proof of equality of discrete logarithms
[Chaum & Pederson]• Designated-verifier reencryption proof [Hirt
& Sako]• 1-out-of-L reencryption proof [Hirt & Sako]• Signature of knowledge of discrete
logarithms [Camenisch & Stadler]• Reencryption mix network with randomized
partial checking [Jakobsson, Juels & Rivest]• Plaintext equivalence test [Jakobsson &
Juels]
Quadratic in # voters and votes
![Page 26: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/26.jpg)
Clarkson: CIVS 26
BlockingBlocking
• Assign voters into blocks– Block is a “virtual precinct”– Anonymity guaranteed within a block– Each block tallied independently of other
blocks, even in parallel
• Implementation– Protocols extended to include blocks– Registrar implements policy on assignment
• Best policy might be uniform random
– Reasonable block size? We use 100.
• Tabulation time is:– Quadratic in block size (thus anonymity)– Linear in number of voters
![Page 27: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/27.jpg)
Clarkson: CIVS 27
Performance StudyPerformance Study
• Experimental design– Emulab: 3 GHz CPUs for tab. tellers– Keys: 1024 ElGamal, 2048 RSA, 256 AES– Experiments repeated three times,
sample mean reported, stdev < 2%
• Parameters:– V: number of voters– A: number of authorities of each type– K: minimum number of voters in a block
![Page 28: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/28.jpg)
Clarkson: CIVS 28
Tabulation Time vs. # VotersTabulation Time vs. # Voters
(K = 100, A = 4)
35 sec / voter / authority$1/CPU/hr = 4¢/voter
sequential
parallelUse once then throw away:$1500/machine = $12/voter
![Page 29: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/29.jpg)
Clarkson: CIVS 29
Tabulation Time vs. AnonymityTabulation Time vs. Anonymity
(V = K, A = 4)
![Page 30: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/30.jpg)
Clarkson: CIVS 30
Tabulation Time vs. # Tabulation Time vs. # AuthoritiesAuthorities
(K = V = 100)
![Page 31: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/31.jpg)
Clarkson: CIVS 31
Extension: Ranked VotingExtension: Ranked Voting
• Voters submit (partial) order on candidates– E.g. Condorcet, Borda, STV
• Civitas implements coercion-resistant Condorcet– Tricky because rankings can be used to
signal identity (“Italian attack”)– Use ballot decomposition from FEE’05
• Civitas also implements approval and FPTP ballots
![Page 32: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/32.jpg)
Clarkson: CIVS 32
Related WorkRelated Work
• Voting schemes […]• Implemented (academic) voting systems:
– Sensus [Cranor and Cytron]– EVOX [Herschberg, DuRette]– REVS [Joaquim, Zúquette, Ferreira; Lebre]– ElectMe [Shubina and Smith]– Adder [Kiayias, Korman, Walluck]
• VoComp:– Prêt à Voter [Schneider, Heather, et al.; Ryan;
Chaum]– Prime III [Gilbert, Cross, et al.]– Punchscan [Stanton, Essex, Popoveniuc, et al.;
Chaum]– Voting Ducks [Kutyłowski, Zagórski, et al.]
![Page 33: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/33.jpg)
Clarkson: CIVS 33
SummarySummary
• Civitas is a secure, practical, remote voting system
• Security:– Based on JCJ proof– Assumptions– Implementation in Jif
• Performance:– Linear (or constant) in number of voters,
quadratic in anonymity– As low as 4¢ per voter
![Page 34: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/34.jpg)
Clarkson: CIVS 34
Future WorkFuture Work
• Improve performance/anonymity trade-off
• Construct untappable channel• Security proof for composition
– UC definitions and constructions?
• Distribute trust in voter client• Implement high availability
![Page 35: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/35.jpg)
Clarkson: CIVS 35
ResourcesResources
• Technical report with concrete protocolshttp://www.cs.cornell.edu/people/clarkson/papers/clarkson_civs_tr.pdf
• Source code to be released
![Page 36: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/36.jpg)
CivitasCivitasA Secure Remote Voting SystemA Secure Remote Voting System
Michael Clarkson, Stephen Chong, Andrew MyersCornell University
Dagstuhl Seminaron Frontiers of Electronic Voting
July 31, 2007
![Page 37: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/37.jpg)
Clarkson: CIVS 37
Extra SlidesExtra Slides
![Page 38: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/38.jpg)
Clarkson: CIVS 38
Registration and Voting TimesRegistration and Voting Times
• For A=4, total voter time to register and vote is 1.5sec– 350ms for voter to retrieve credential
from registration teller– 230ms CPU time for registration teller to
retrieve a voter’s credential– 25ms for voter to submit vote to ballot
box
• Registration teller throughput > 15,000 voters / hr
![Page 39: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/39.jpg)
Clarkson: CIVS 39
Tab. Time vs. % ChaffTab. Time vs. % Chaff
(K = V = 100, A = 4)
![Page 40: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/40.jpg)
Clarkson: CIVS 40
% CPU Util. vs. # Voters% CPU Util. vs. # Voters
(K = 100, A = 4)
![Page 41: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/41.jpg)
Clarkson: CIVS 41
Attacks: Voter ClientAttacks: Voter Client
• Unlike DRE systems, voter can choose supplier of client (hardware and software)– Transfer trust to an organization they
trust
• Publicly available protocols and implementation
![Page 42: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/42.jpg)
Clarkson: CIVS 42
Attacks: RegistrationAttacks: Registration
• Strong authentication to prevent adversary from masquerading as voter
• Registration by mail or in person
![Page 43: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/43.jpg)
Clarkson: CIVS 43
Attacks: NetworkAttacks: Network
• Tappable channel exploitable only if adversary:– Compromises network and – Induces voter to use compromised client
during registration
• Valid registration clients can erase credential shares
![Page 44: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/44.jpg)
Clarkson: CIVS 44
Attacks: AvailabilityAttacks: Availability
• BFT, threshold cryptography• Rate-limiting and puzzles to mitigate
application-level DOS– But PETs still a fundamental problem
![Page 45: Civitas A Secure Remote Voting System Michael Clarkson, Stephen Chong, Andrew Myers Cornell University Dagstuhl Seminar on Frontiers of Electronic Voting.](https://reader034.fdocuments.us/reader034/viewer/2022050714/56649cf95503460f949c9d85/html5/thumbnails/45.jpg)
Clarkson: CIVS 45
Attacks: AuthoritiesAttacks: Authorities
• Corrupt registration teller– Need third-party intervention
• Failed bulletin board– Integrity guaranteed, not availability
• Corrupt registrar or supervisor– Must verify against external policy
(electoral roll, ballot design, etc.)