\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{17}{November 5, 1996}{Ron Rivest}{Jean-Emile Elien} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Voting}
Today's lecture talked about requirements, and proposals for an secure
electronic voting scheme.  A handout presented several schemes for possible
voting protocols.
\subsection{Requirements}
A list of requirements for a voting scheme (not necessarily all feasible
together, some may even be redundant or inconsistant)
\begin{itemize}
\item Easy to use.
\begin{itemize}
\item ``recount'' can be called.
\item Integration with traditional voting methods (districts, regions)
\end{itemize}
\item Clear design and clear rules on record-keeping after the vote.
\begin{itemize}
\item Dispute processes need to be clear.
\item Who's trusting whom for what?  Who are the trusted authorities, how
reliable are they supposed to be?
\item Distribution of system - central server vs. distributed setup.
\item Notion of ``freshness'' of a vote, that the vote was made for this election and vot ``reused'' somehow.
\end{itemize}
\item Voters are authenticated.
\item Each voter votes only once.
\item Votes are anonymous.
\item Voters can confirm that their vote was counted.
\item Voter can get receipt.
\item Voter gets a receipt-free system - no one but voter can find out how
the voter voted.
\item Server physically secure.
\item No tampering with the votes - only valid votes are counted and each
vote counts once.
\item Resistant to denial of service - Voters can vote if they want to.
\item Autditability of the tally.
\item No ballot-stuffing - non-voting registered voters aren't voted for by
someone else.
\item No duplicate voting - a valid voter votes as someone else.
\item Cannot change vote once made.
\item Voters can find out who else voted.
\end{itemize}

This list was compared to the handout's list of what was required for an
electronic voting scheme. It goes on to describe several voting schemes of
increasing complexity.

\subsection{Implementations}
In the voting process, there are three steps to the vote:
\begin{itemize}
\item {\bf Registration} - Voters register with some authority to vote.
\item {\bf Casting} - Registered voters actually cast a vote.
\item {\bf Tallying} - The final count of the votes after all of the votes
are casted.
\end{itemize}

\subsubsection{Voting Scheme 1}
\begin{itemize}
\item Each voter encrypts his vote with the public key of the CTF (Central Tabulating Facility)
\item Each voter sends his vote to the CTF.
\item The CTF decrypts the votes, and tabulaates them, making the results
public.
\end{itemize}

This protocol is full of holes, and doesn't satisfy many of the important
features of a secure voting scheme.  Nothing preserves anonimity, prevents
double-voting, or provides authentication of the voters.  The rest of the
schemes serves to address some of these problems.

\subsubsection{Voting Scheme 2}
This is like the previous scheme, but every message is signed:

\begin{itemize}
\item Each voter signs his vote with his private key.
\item Each voter then encrypts his signed vote with the public key of the CTF.
\item Each voter sends his vote to the CTF.
\item The CTF decrypts the votes, verifies the signatures,then tabulates the
votes and makes the results public.
\end{itemize}

This scheme is a little better, as it can prevent double voting, and
authenticates the voters as registered voters.  The tradeoff here, though is
the inability to vote anonymously, which can happen currently.  There is also
an implicit trust in the CTF to be honest, and not try to corrupt the votes
somehow.

The common problem with the above schemes is the association of the vote
counted with the voter who made it.  Is it possible for the voter to register
to vote and cast a vote such that it is not possible to correlate the voter
with the vote?  We would like a server to sign a vote without knowing what
them.

The idea follows the metaphor of an envelope: The server would like to be
able to sign pairs of ``Yes'' and ``No'' sealed envelopes, so it cannot see
the information inside.  However, the voter can ``open'' the envelope and
reveal a signed ``Yes'' and a signed ``No'' vote.  The electronic scheme
analogous to this envelope is performing a {\it Blind Signature}.

\subsubsection{Blind Signatures}
Use RSA for this example:

We have a public key: $(n,e)$ and private key $d$.

\paragraph{}
{\bf To sign a message $m$}: compute $m^d \bmod n$.

\paragraph{}
{\bf To sign a message without seeing it}:
\begin{itemize}
\item Pick a $r \in Z_n$ at random.  $r$ is called the {\it blinding factor}.
\item compute: $m' \equiv mr^e \bmod n$.  This is called {\it blinding a
message}.
\item The signer takes $m'$ and computes: $m'^d \bmod n$.
\item Now the message looks like: $m'^d \equiv (mr^d)^e \equiv m^dr$
\item Now just divide by $r$ to retrieve $m^d$.
\end{itemize}

Using this scheme, we now have a method for getting signed votes without the
server seeing the signed vote:

\begin{itemize}
\item Generate a ``Clinton'' or ``Dole''.\footnote{We could add a ``Perot'' vote, but we are looking for a realistic voting scheme.}
\item Blind the signature and send it to the server (anonymously)
\item It is sent back signed. Presumably, it is published, and you retrieve
the value somehow.
\item The vote now becomes the message signed by the server.
\end{itemize}


This leads to several questions:
\begin{enumerate}
\item How do we prevent against signing of ballots of the form (``Yes'',
``Yes'') or (``No'', ``No'')? {\it One method, called the {\em cut and choose
method} allows us to know that the blinded votes are valid with high
probablility.  The voter sends 10 blinded ballots, and the signer randomly
selects 9, and asks for the blinding factors.  The voter releases them,
leaving one blank.  The server verifies that the other ballots are formed
correctly, and signs the last one.  The probablilty of the voter knowing the
ballot left alone $1/2^9$ and can be made arbritrarily small with more
messages.}
\item Why send both ``Yes'' and ``No'' votes to the server? One could just
send the vote that they want to submit to be signed.  {\it There are several
motivations for this: One of convience, it is possible to seperate the
process getting a ballot from the process of actually voting.  One doesn't
have to vote until the long after the ballot is made.  Another could be if
the server uses cut and choose to validate the votes, the signer would know
what a person wanted to vote, which violates a goal we are trying to acheive,
especially is the votes are of the ``Clinton'' and ``Dole'' variety.}
\end{enumerate}

All this now enables us to propose another protocol:
\subsubsection{Voting Scheme 3}
In this scheme, we distribute the trust to two servers: 
\begin{itemize}
\item {\bf CLA} Central Legitimization Agency.  This server registers voters.
\item {\bf CTF} Central Tabulating Facility.  The same as above, counts votes.
\end{itemize}

The idea is to separate the tallying from the registering role.  Each server
alone cannot figure out what person made what vote.

\begin{itemize}
\item Go to the CLA, register, and retreive a random authentication number.
\item After all registration of valid voters, the CLA sends the CTF the list
of valid authentication numbers.
\item Construct a vote in some blinded fashion, and send the vote, the
authentication number from the CLA, and a random number generated by the
voter to the CTF.
\item The CTF verifies that the authentication number is valid, and tally's
the vote.
\item The CTF then publishes the list of random numbers it received.
\end{itemize}

Privacy is more protected here, the role of authenticating the voter is
different from the role of tallyinmg the votes, so who made what vote is more
difficult to find.  It still requires trust of the servers not to collude
with each other.

The verication of the vote is supposed to be via the published vote, but it
does not guarantee that the vote was tallied, if the CTF is corrupt.

A scheme is presented next lecture which tries to address some of these
problems.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
