This document summarizes a presentation on Helios, an open-source online voting system. It discusses how Helios uses [1] probabilistic encryption and threshold decryption to post encrypted ballots publicly, [2] homomorphic tallying to privately tally votes, and [3] a casting protocol where voters can either cast or audit their encrypted ballots. The document provides technical details on Helios and notes it was successfully used in a university president election with over 25,000 eligible voters.
7. Public Ballots
Bulletin Board
Bob:
McCain
Carol:
Obama
Alice
6
8. Public Ballots
Bulletin Board
Alice: Bob:
Obama McCain
Carol:
Obama
Alice
6
9. Public Ballots
Bulletin Board
Alice: Bob:
Obama McCain
Carol:
Obama
Tally
Obama....2
McCain....1
Alice
6
10. Encrypted Public Ballots
Bulletin Board
Alice: Bob:
Rice Clinton
Carol:
Rice
Tally
Obama....2
McCain....1
Alice
7
11. Encrypted Public Ballots
Bulletin Board
Alice: Bob:
Rice Clinton
Carol:
Ali Rice
ce
ver Tally
ifie
s he
rv Obama....2
ote
McCain....1
Alice
7
12. Encrypted Public Ballots
Bulletin Board
Alice: Bob:
Rice Clinton
Carol:
Ali
ce Rice ta lly
ver e
thTally
ifie rifies
s he ne ve
rv ver yo Obama....2
ote E
McCain....1
Alice
7
13. How can we verify
operations on
encrypted data?
Mathematical Proofs.
8
18. “And there are cryptographic
techniques that can be used to
achieve software independence so
that even if there's a bug in the
software, you'll detect if there's a
problem. But those are not ready for
prime time in my opinion.”
Avi Rubin, 7/9/2008
19. “But with cryptography, you’re just
moving the black box. Few people really
understand it or trust it.”
Debra Bowen
California Sec. of State, 7/30/2008
(paraphrased)
22. Helios
Simplify
Low-coercion elections
Web-based: all can experience
23. “Low-Coercion?”
- A more appropriate term might be
“stratified coercion”
- If the voting public is a subset of the population,
there may be inherent limits to coercion.
- e.g. university voting
- e.g. EFCA in the US
26. Technical Concepts
- Probabilistic Encryption & Threshold Decryption.
posting ciphertexts safely on a bulletin board
- Homomorphic Tallying.
no write-ins, proofs of correct plaintext
27. Technical Concepts
- Probabilistic Encryption & Threshold Decryption.
posting ciphertexts safely on a bulletin board
- Homomorphic Tallying.
no write-ins, proofs of correct plaintext
- Benaloh Challenge.
cast or audit, authenticate only upon cast
28. Technical Concepts
- Probabilistic Encryption & Threshold Decryption.
posting ciphertexts safely on a bulletin board
- Homomorphic Tallying.
no write-ins, proofs of correct plaintext
- Benaloh Challenge.
cast or audit, authenticate only upon cast
- In-Browser Encryption.
plaintext only in user’s browser
34. Public-Key Encryption
Keypair consists of a public key pk and a secret key sk.
quot;Obamaquot; Enc pk 8b5637
quot;McCainquot; Enc pk c5de34
quot;Obamaquot; Enc pk a4b395
35. Threshold Decryption
Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.
8b5637
36. Threshold Decryption
Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.
Dec sk1 b739cb
8b5637
37. Threshold Decryption
Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.
Dec sk1 b739cb
Dec sk2 261ad7
8b5637
38. Threshold Decryption
Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.
Dec sk1 b739cb
Dec sk2 261ad7
8b5637
Dec sk3 7231bc
39. Threshold Decryption
Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.
Dec sk1 b739cb
Dec sk2 261ad7
8b5637
Dec sk3 7231bc
Dec sk4 8239ba
40. Threshold Decryption
Secret key is shared amongst multiple parties:
all (or at least a quorum) need to cooperate to decrypt.
Dec sk1 b739cb
Dec sk2 261ad7
8b5637 quot;Obamaquot;
Dec sk3 7231bc
Dec sk4 8239ba
45. Homomorphic Property
Enc(m1 ) × Enc(m2 ) = Enc(m1 + m2 )
then we can simply
add votes “under cover” of encryption!
First: r’th residuosity [Benaloh85]
Also: Paillier Cryptosystem [P99] 22
46. Homomorphic Tally
Vote for None Adam
0001 0000 0000 0000 Vote for
Vote for Vote for Bob
0000 0001 0000 0000 Obama
Vote for McCain
0000 0000 0001 0000 Vote for Charlie
0000 0000 0000 0001 Vote for David
0003 0001 0008 0002
0004 0006 0005 Sample Tally
[B+2001, P1999]
23
51. quot;Obamaquot;
Encrypted
Ballot
Alice
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
52. quot;Obamaquot;
Encrypted
Ballot
Alice
Alice
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
53. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot;
Alice
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
54. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot;
Decrypted
Ballot
Alice
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
55. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot;
Decrypted
Ballot
Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
56. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot;
Decrypted
Ballot
Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
57. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot;
Decrypted
Ballot
Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
58. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot;
Decrypted
Ballot
Alice Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
59. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot; quot;CASTquot;
Decrypted
Ballot
Alice Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
60. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot; quot;CASTquot;
Decrypted Signed
Ballot Encrypted
Ballot
Alice Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
61. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot; quot;CASTquot;
Decrypted Signed
Ballot Encrypted
Ballot
Alice Alice
Encrypted Decrypted
Ballot Ballot
VERIFICATION
Alice
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
62. quot;Obamaquot;
Encrypted
Ballot
Alice
quot;AUDITquot; quot;CASTquot;
Decrypted Signed
Ballot Encrypted
Ballot
Alice Alice
Encrypted Decrypted
Ballot Ballot
Signed
Encrypted
Ballot
VERIFICATION
Alice
http://en.wikipedia.org/wiki/Image:Barcode-scanner.jpg
66. Helios System Details
- Python & JavaScript logic & crypto
- Free/Open-Source stack
- Deployed on Google App Engine
67. Helios System Details
- Python & JavaScript logic & crypto
- Free/Open-Source stack
- Deployed on Google App Engine
- Deployed on Apache/Python/PostgreSQL
68. Helios System Details
- Python & JavaScript logic & crypto
- Free/Open-Source stack
- Deployed on Google App Engine
- Deployed on Apache/Python/PostgreSQL
- Customizable
authentication, look-and-feel, translations
69. So, does it work?
- Université catholique de Louvain
- 25,000 eligible voters
- University president election
- Helios 2.0, optimized
- customized for UCL (French, improved UI)
