%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{18}{November 7, 1996}{Ron Rivest}{Dan Weber} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%% First revision, November 1996 by Dan Weber.

Administrivia
\begin{itemize}
\item Term project proposals should be turned in as soon as possible.
\end{itemize}

%Topics covered in this lecture:
%\begin{itemize}
%\item Continued discussion of a secure voting system
%\item A look at the FOO voting scheme of Fujioka, Okamoto, and Ohta
%\end{itemize}

\section{An Overview of the FOO Voting Scheme}

The FOO paper can be found in Handout 24.

The FOO voting scheme assumes that there are four cryptographic techniques
that can be done safely:
\begin{itemize}
\item Digital Signatures
\item Blinded Signatures
\item Commitments
\item Anonymous Channels
\end{itemize}

\section{Commitment Schemes}

A commitment scheme allows one to commit to a message, but not reveal
what it is until sometime later.

To commit to a message $m$, someone can pick a random, secret $r$ and then use
a commitment function to get $x = \xi(m, r)$.  Knowing $x$ should give no
information about $r$, and it should be infeasible to come up with an $r\prime$
and an $m\prime \neq m$ such that $\xi(m, r) = \xi(m\prime, r\prime)$.

A few examples of commitment functions are:
\begin{itemize}
\item A good hash function operating on $m$ concatted with $r$.
\item ${g_1}^m {g_2}^r$, where $g_1, g_2$ are generators (mod p) of 
	order $(p-1)/2$.
\item A symmetric cypher $E_k(m, r)$.
\end{itemize}


\section{Blinded Signatures}

Blinding is a commutative operation with signing.  This means that A can
blind a message, then B can sign it, thenA can unblind it, and the 
result will be
an unblinded message signed by B, the contents of which B does not know.

Let us look at a sample implementation using RSA.  The public key is 
$(e, n)$, the secret key $(d, n)$, and $de = 1 \pmod n$.
%% Is that last statement correct?
The normal way to sign a message is to calculate $s = m^d$.

A message $m$ can be blinded by multiplying it by $r^e$, where $r$ is
chosen at random; let 
$m\prime = m r^e$.  

This message is signed with $d$.  Let 
$s\prime = (m\prime)^d = m^d r ^ {ed} = m^d r$.  $s\prime$, the signed,
blinded message can be changed into an unblinded, signed message by 
dividing by $r$, which gives $s = m^d$.

Signing any message that you are given is not a good idea in general.
Therefore, a {\em cut-and-choose} protocol can be used.  If A wants B
to blindly sign a message saying ``I authorize A to withdraw \$10 from
my account'', A could send 100 blinded messages to B with that message.
B then chooses 99 of those messages, and asks for the $r$ for each of
them.  B unblinds them, sees that they all say the same thing, and 
then signs the remaining, still-blinded message, and sends it back to A.
If just one of the 100 messages are different from what B intends to 
sign, there will be a 99\% chance of him discovering it and taking
whatever actions against A he sees fit; if this
isn't high enough for B, he can choose a number larger than 100.


\section{FOO Notations}

Each voter is referred to by $V_i$; each voter also has identification
$ID_i$ and vote $v_i$.  A message $m$ signed by $V_i$ is designated
by $\sigma_i(m)$.

The administrator is $A$, and will blindly sign messages.  The result
of this signing is $\sigma_A(m)$.

There is also a vote counter $C$.

The commitment function for signing message $v$ with key $k$ is $\xi(v, k)$.

Messages are blinded with $\chi_A(m, r)$, and you can retrieve blind
signatures with $\delta_A(s, r)$.

\section{The voting}

The scheme consists of six stages:  vote preparation, administration,
voting, collection of votes, opening of votes, and counting votes.

\subsection{Voters prepare votes}

Each voter
\begin{itemize} 
\item picks his or her vote, $v_i$.
\item commits to that: $x_i = \xi(v_i, k_i)$.
\item blinds that: $e_i = \chi_A(x_i, r_i)$.
\item signs that: $s_i = \sigma_i(e_i)$.
\item sends $(ID_i, e_i, s_i)$ to $A$.  This does {\em not} need to be
	anonymous.
\end{itemize}

\subsection{Administration}

The administrator, for each $(ID, e, s)$ entry,
\begin{itemize}
\item checks that $V_i$ is allowed to vote, and that this is $V_i$'s only
	application for a signature.  If not, $A$ rejects that entry.
\item checks that the signature $s_i$ corresponds with $e_i$.  If not, $A$
	rejects that entry.
\item signs each vote: $d_i = \sigma_A(e_i)$, and sends $d_i$ to $V_i$.
\end{itemize}

Then, the administrator
\begin{itemize}
\item publishes all valid $(ID_i, e_i, s_i)$ triples, including the total
	count.
\end{itemize}

\subsection{Votes submitted}

Each voter
\begin{itemize}
\item gets the corresponding triple off of the published list and checks
	$A$'s signature.  If this fails, the voter goes to the authorities.
\item unblinds the signed vote.  $y_i = \delta(d_i,r_i)$, which is also
	equal to $\sigma_A(x_i)$.
\item sends his or her ballot, $(x_i, y_i)$, to $C$ through an 
	anonymous channel.  Note that this message contains the 
	voter's commitment and signed vote.
\end{itemize}

\subsection{Collection of votes}

For each ballot, the counter
\begin{itemize}
\item checks the that $y_i$ is $A$'s signature of $x_i$, using $A$'s public
	key.  If the check fails the ballot is thrown out.
\item collects up a list of the valid ballots.
\item publishes the list after all voters have voted.  Each entry in the
	list is a triple of the form $(l, x_i, y_i)$, where $l$ is a 
	simple counter.
\end{itemize}

\subsection{Votes opened}

Each voter
\begin{itemize}
\item checks that the right number of voters voted.
\item checks that her ballot is on $C$'s published list.  If it isn't,
	$V_i$ can insist to be placed upon the list by publicly announcing
	her $(x_i, y_i)$ pair, preferably through an anoymous channel,
	or maybe through her party's headquarters.  This proves that $V_i$ 
	had her vote signed by $A$.
\item sends $(i, k_i)$ anonymously to $C$.  Remember that $k_i$ was the key
	used in the commitment scheme.
\end{itemize}

\subsection{Votes counted}

$C$, for each vote,
\begin{itemize}
\item checks the commitment of $x_i = \xi(v_i, k_i)$.
\item appends $v_i$ and $k_i$ to the corresponding entries in the published
	list.
\item counts up the votes and publishes the results.
\end{itemize}

\section{Analysis}

In class, we analyzed various aspects of the FOO voting scheme.  Among
the observations:

\begin{observation}
The counter cannot omit votes without being caught by the (alert) voter.
\end{observation}

\begin{observation}
The administrator can cheat if some people don't vote, by giving
out signatures for people that aren't voting to others.
\end{observation}

\begin{observation}
Voters cannot vote twice without a corrupt $A$.
\end{observation}

\begin{observation}
Voters can be coerced.  There is a definite receipt that the voter
can take away from the polls ($r_i$).
\end{observation}

The entire voting scheme relies upon the fact that the various encryption
mechanisms are difficult to break.  If a poor implementation is chosen
and not made public, it may be hard for a voter to detect a problem with
the scheme.

Another question that was raised was ``What happens in the case of an 
error?''  If the voting starts over if it is discovered one person
didn't vote (in part 5 when the votes are opened), then one person
can filibuster the vote and prevent it from occurring.  A similar question
is when to inform the authorities of voting fraud.  If $A$ must file
a police report every time an invalid vote is received, a malicious
user could flood $A$ with false votes, causing $A$ to spend all its 
time at the police station instead of administering votes.  However,
an attempt at fraud on $A$'s part {\em should} be reported to the
authorities.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}



