Ballot secrecy: Security definition,sufficient conditions,and analysis of Helios

Abstract

We propose a definition of ballot secrecy as an indistinguishability game in the computational model of cryptography. Our definition improves upon earlier definitions to ensure ballot secrecy is preserved in the presence of an adversary that controls ballot collection. We also propose a definition of ballot independence as an adaptation of an indistinguishability game for asymmetric encryption. We prove relations between our definitions. In particular, we prove ballot independence is sufficient for ballot secrecy in voting systems with zero-knowledge tallying proofs. Moreover, we prove that building systems from non-malleable asymmetric encryption schemes suffices for ballot secrecy, thereby eliminating the expense of ballot-secrecy proofs for a class of encryption-based voting systems. We demonstrate applicability of our results by analysing the Helios voting system and its mixnet variant. Our analysis reveals that Helios does not satisfy ballot secrecy in the presence of an adversary that controls ballot collection. The vulnerability cannot be detected by earlier definitions of ballot secrecy, because they do not consider such adversaries. We adopt non-malleable ballots as a fix and prove that the fixed system satisfies ballot secrecy.

Keywords

Anonymity democracy elections Helios independence non-malleability privacy secrecy voting

Get full access to this article

View all access options for this article.

References

Adida, Helios: Web-based open-audit voting, in: USENIX Security’08: 17th USENIX Security Symposium, USENIX Association, 2008, pp. 335–348.

Adida,

Marneffe,

Pereira and

Quisquater, Electing a university president using open-audit voting: Analysis of real-world use of Helios, in: EVT/WOTE’09: Electronic Voting Technology Workshop/Workshop on Trustworthy Elections, USENIX Association, 2009.

Adida and

C.A.

Neff, Ballot casting assurance, in: EVT’06: Electronic Voting Technology Workshop, USENIX Association, 2006.

R.M.

Alvarez and

T.E.

Hall, Electronic Elections: The Perils and Promises of Digital Democracy, Princeton University Press, 2010. doi:10.1515/9781400834082.

Arapinis,

Bursuc and

Ryan, Reduction of equational theories for verification of trace equivalence: Re-encryption, associativity and commutativity, in: POST’12: First Conference on Principles of Security and Trust, LNCS, Vol. 7215, Springer, 2012, pp. 169–188. doi:10.1007/978-3-642-28641-4_10.

Bellare,

Desai,

Jokipii and

Rogaway, A concrete security treatment of symmetric encryption, in: FOCS’97: 38th Annual Symposium on Foundations of Computer Science, IEEE Computer Society, 1997, pp. 394–403.

Bellare,

Desai,

Pointcheval and

Rogaway, Relations among notions of security for public-key encryption schemes, in: CRYPTO’98: 18th International Cryptology Conference, LNCS, Vol. 1462, Springer, 1998, pp. 26–45. doi:10.1007/BFb0055718.

Bellare and

Rogaway, Random oracles are practical: A paradigm for designing efficient protocols, in: CCS’93: 1st ACM Conference on Computer and Communications Security, ACM, 1993, pp. 62–73. ISBN 0-89791-629-8. doi:10.1145/168588.168596.

Bellare and

Rogaway, Symmetric encryption, in: Introduction to Modern Cryptography, 2005, Chapter 4. http://cseweb.ucsd.edu/~mihir/cse207/w-se.pdf.

10.

Bellare and

Sahai, Non-malleable encryption: Equivalence between two notions, and an indistinguishability-based characterization, in: CRYPTO’99: 19th International Cryptology Conference, LNCS, Vol. 1666, Springer, 1999, pp. 519–536. doi:10.1007/3-540-48405-1_33.

11.

Benaloh, Verifiable Secret-Ballot Elections, PhD thesis, Department of Computer Science, Yale University, 1996.

12.

Benaloh,

Vaudenay and

Quisquater, Final Report of IACR Electronic Voting Committee, 2010, International Association for Cryptologic Research. http://www.iacr.org/elections/eVoting/finalReportHelios_2010-09-27.html.

13.

Benaloh and

Yung, Distributing the power of a government to enhance the privacy of voters, in: PODC’86: 5th Principles of Distributed Computing Symposium, ACM Press, 1986, pp. 52–62. doi:10.1145/10590.10595.

14.

J.C.

Benaloh and

Tuinstra, Receipt-free secret-ballot elections, in: STOC’94: 26th Theory of Computing Symposium, ACM Press, 1994, pp. 544–553. doi:10.1145/195058.195407.

15.

Bernhard, Zero-Knowledge Proofs in Theory and Practice, PhD thesis, Department of Computer Science, University of Bristol, 2014.

16.

Bernhard,

Cortier,

Galindo,

Pereira and

Warinschi, SoK: A comprehensive analysis of game-based ballot privacy definitions, in: S&P’15: 36th Security and Privacy Symposium, IEEE Computer Society, 2015, pp. 499–516.

17.

Bernhard,

Cortier,

Galindo,

Pereira and

Warinschi, A comprehensive analysis of game-based ballot privacy definitions, 2015, Cryptology ePrint Archive, Report 2015/255 (version 20150319:100626).

18.

Bernhard,

Cortier,

Pereira,

Smyth and

Warinschi, Adapting Helios for provable ballot privacy, in: ESORICS’11: 16th European Symposium on Research in Computer Security, LNCS, Vol. 6879, Springer, 2011, pp. 335–354.

19.

Bernhard,

Pereira and

Warinschi, How not to prove yourself: Pitfalls of the Fiat-Shamir heuristic and applications to Helios, in: ASIACRYPT’12: 18th International Conference on the Theory and Application of Cryptology and Information Security, LNCS, Vol. 7658, Springer, 2012, pp. 626–643.

20.

Bernhard,

Pereira and

Warinschi, On Necessary and Sufficient Conditions for Private Ballot Submission, 2012, Cryptology ePrint Archive, Report 2012/236 (version 20120430:154117b).

21.

Bernhard and

Smyth, Ballot secrecy with malicious bulletin boards, 2015, Cryptology ePrint Archive, Report 2014/822 (version 20150413:170300).

22.

Bernhard,

Benaloh,

J.A.

Halderman,

R.L.

Rivest,

P.Y.A.

Ryan,

P.B.

Stark,

Teague,

P.L.

Vora and

D.S.

Wallach, Public evidence from secret ballots, in: E-Vote-ID’17: 10th International Conference for Electronic Voting, LNCS, Springer, 2017, pp. 84–109.

23.

Bertrand,

J.-L.

Briquet and

Pels, Introduction: Towards a historical ethnography of voting, in: The Hidden History of the Secret Ballot, Indiana University Press, 2007.

24.

E.C.

Bjornlund, Beyond Free and Fair: Monitoring Elections and Building Democracy, Woodrow Wilson Center Press / Johns Hopkins University Press, 2004.

25.

Blanchet and

Smyth, Automated reasoning for equivalences in the applied pi calculus with barriers, in: CSF’16: 29th Computer Security Foundations Symposium, IEEE Computer Society, 2016, pp. 310–324.

26.

Blanchet and

Smyth, Automated reasoning for equivalences in the applied pi calculus with barriers, Journal of Computer Security 26(3) (2018), 367–422. doi:10.3233/JCS-171013.

27.

Blanchet,

Smyth,

Cheval and

Sylvestre, ProVerif 1.96: Automatic Cryptographic Protocol Verifier, User Manual and Tutorial, 2016.

28.

Bowen, Secretary of State Debra Bowen Moves to Strengthen Voter Confidence in Election Security Following Top-to-Bottom Review of Voting Systems, 2007, California Secretary of State, press release DB07:042.

29.

Brent, The Australian ballot: Not the secret ballot, Australian Journal of Political Science 41(1) (2006), 39–50. doi:10.1080/10361140500507278.

30.

Bulens,

Giry and

Pereira, Running Mixnet-based elections with Helios, in: EVT/WOTE’11: Electronic Voting Technology Workshop/Workshop on Trustworthy Elections, USENIX Association, 2011.

31.

Bundesverfassungsgericht (Germany’s Federal Constitutional Court), Use of Voting Computers in 2005 Bundestag Election Unconstitutional, 2009, Press release 19/2009.

32.

Chaidos,

Cortier,

Fuschbauer and

Galindo, BeleniosRF: A non-interactive receipt-free electronic voting scheme, in: CCS’16: 23rd ACM Conference on Computer and Communications Security, ACM Press, 2016, pp. 1614–1625. doi:10.1145/2976749.2978337.

33.

Chang-Fong and

Essex, The cloudier side of cryptographic end-to-end verifiable voting: A security analysis of Helios, in: ACSAC’16: 32nd Annual Conference on Computer Security Applications, ACM Press, 2016, pp. 324–335. doi:10.1145/2991079.2991106.

34.

Chaum,

Carback,

Clark,

Essex,

Popoveniuc,

R.L.

Rivest,

P.Y.A.

Ryan,

Shen and

A.T.

Sherman, Scantegrity II: End-to-end verifiability for optical scan election systems using invisible ink confirmation codes, in: EVT’08: Electronic Voting Technology Workshop, USENIX Association, 2008.

35.

Chaum,

Evertse,

van de Graaf and

Peralta, Demonstrating possession of a discrete logarithm without revealing it, in: CRYPTO’86: 6th International Cryptology Conference, LNCS, Vol. 263, Springer, 1987, pp. 200–212. doi:10.1007/3-540-47721-7_14.

36.

Chaum and

T.P.

Pedersen, Wallet databases with observers, in: CRYPTO’92: 12th International Cryptology Conference, LNCS, Vol. 740, Springer, 1993, pp. 89–105. doi:10.1007/3-540-48071-4_7.

37.

Chaum,

P.Y.

Ryan and

Schneider, A practical voter-verifiable election scheme, in: ESORICS’05: 10th European Symposium on Research in Computer Security, LNCS, Vol. 3679, Springer, 2005, pp. 118–139.

38.

D.L.

Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms, Communications of the ACM 24 (1981), 84–90. doi:10.1145/358549.358563.

39.

Chor,

Goldwasser,

Micali and

Awerbuch, Verifiable secret sharing and achieving simultaneity in the presence of faults, in: FOCS’85: 26th Foundations of Computer Science Symposium, IEEE Computer Society, 1985, pp. 383–395.

40.

Chor and

M.O.

Rabin, Achieving independence in logarithmic number of rounds, in: PODC’87: 6th Principles of Distributed Computing Symposium, ACM Press, 1987, pp. 260–268. doi:10.1145/41840.41862.

41.

Clarkson,

Hay,

Inge, abhi shelat ,

Wagner and

Yasinsac, Software Review and Security Analysis of Scytl Remote Voting Software, http://election.dos.state.fl.us/voting-systems/pdf/FinalReportSept19.pdf.

42.

Cortier,

Galindo,

Glondu and

Izabachene, Distributed ElGamal à la Pedersen: Application to Helios, in: WPES’13: Workshop on Privacy in the Electronic Society, ACM Press, 2013, pp. 131–142. doi:10.1145/2517840.2517852.

43.

Cortier,

Galindo,

Glondu and

Izabachène, Election verifiability for Helios under weaker trust assumptions, in: ESORICS’14: 19th European Symposium on Research in Computer Security, LNCS, Vol. 8713, Springer, 2014, pp. 327–344.

44.

Cortier,

Galindo,

Glondu and

Izabachene, A generic construction for voting correctness at minimum cost - Application to Helios, 2013, Cryptology ePrint Archive, Report 2013/177 (version 20130521:145727).

45.

Cortier,

Schmidt,

C.C.

Drăgan,

P.-Y.

Strub,

Dupressoir and

Warinschi, Machine-checked proofs of privacy for electronic voting protocols, in: S&P’17: 37th IEEE Symposium on Security and Privacy, IEEE Computer Society, 2017.

46.

Cortier and

Smyth, Attacking and fixing Helios: An analysis of ballot secrecy, in: CSF’11: 24th Computer Security Foundations Symposium, IEEE Computer Society, 2011, pp. 297–311.

47.

Cortier and

Smyth, Attacking and fixing Helios: An analysis of ballot secrecy, Journal of Computer Security 21(1) (2013), 89–148. doi:10.3233/JCS-2012-0458.

48.

Cramer,

M.K.

Franklin,

Schoenmakers and

Yung, Multi-authority secret-ballot elections with linear work, in: EUROCRYPT’96: 15th International Conference on the Theory and Applications of Cryptographic Techniques, LNCS, Vol. 1070, Springer, 1996, pp. 72–83.

49.

Cramer,

Gennaro and

Schoenmakers, A secure and optimally efficient multi-authority election scheme, in: EUROCRYPT’97: 16th International Conference on the Theory and Applications of Cryptographic Techniques, LNCS, Vol. 1233, Springer, 1997, pp. 103–118.

50.

Cremers and

Hirschi, Improving Automated Symbolic Analysis for E-voting Protocols: A Method Based on Sufficient Conditions for Ballot Secrecy, 2017, arXiv, Report 1709.00194.

51.

Delaune,

Kremer and

Ryan, Coercion-resistance and receipt-freeness in electronic voting, in: CSFW’06: 19th Computer Security Foundations Workshop, IEEE Computer Society, 2006, pp. 28–42.

52.

Delaune,

Kremer and

M.D.

Ryan, Verifying privacy-type properties of electronic voting protocols, Journal of Computer Security 17(4) (2009), 435–487. doi:10.3233/JCS-2009-0340.

53.

Delaune,

Kremer,

M.D.

Ryan and

Steel, Formal analysis of protocols based on TPM state registers, in: CSF’11: 24th Computer Security Foundations Symposium, IEEE Computer Society, 2011, pp. 66–80.

54.

Delaune,

M.D.

Ryan and

Smyth, Automatic verification of privacy properties in the applied pi-calculus, in: IFIPTM’08: 2nd Joint iTrust and PST Conferences on Privacy, Trust Management and Security, International Federation for Information Processing (IFIP), Vol. 263, Springer, 2008, pp. 263–278.

55.

Desmedt and

Chaidos, Applying divertibility to blind ballot copying in the Helios Internet voting system, in: ESORICS’12: 17th European Symposium on Research in Computer Security, LNCS, Vol. 7459, Springer, 2012, pp. 433–450.

56.

Desmedt and

Kurosawa, Electronic voting: Starting over?, in: ISC’05: International Conference on Information Security, LNCS, Vol. 3650, Springer, 2005, pp. 329–343. doi:10.1007/11556992_24.

57.

Dolev,

Dwork and

Naor, Non-malleable cryptography, in: STOC’91: 23rd Theory of Computing Symposium, ACM Press, 1991, pp. 542–552. doi:10.1145/103418.103474.

58.

Dolev,

Dwork and

Naor, Nonmalleable cryptography, Journal on Computing 30(2) (2000), 391–437.

59.

Fiat and

Shamir, How to prove yourself: Practical solutions to identification and signature problems, in: CRYPTO’86: 6th International Cryptology Conference, LNCS, Vol. 263, Springer, 1987, pp. 186–194. doi:10.1007/3-540-47721-7_12.

60.

Fraser,

E.A.

Quaglia and

Smyth, A critique of game-based definitions of receipt-freeness for voting, in: ProveSec’19: 13th International Conference on Provable and Practical Security, LNCS, Springer, 2019.

61.

R.W.

Gardner,

Garera and

A.D.

Rubin, Coercion resistant end-to-end voting, in: FC’09: 13th International Conference on Financial Cryptography and Data Security, LNCS, Vol. 5628, Springer, 2009, pp. 344–361. doi:10.1007/978-3-642-03549-4_21.

62.

Gennaro, Achieving independence efficiently and securely, in: PODC’95: 14th Principles of Distributed Computing Symposium, ACM Press, 1995, pp. 130–136. doi:10.1145/224964.224979.

63.

Gennaro, A protocol to achieve independence in constant rounds, IEEE Transactions on Parallel and Distributed Systems 11(7) (2000), 636–647. doi:10.1109/71.877748.

64.

Gjøsteen, The Norwegian Internet voting protocol, in: VoteID’11: 3rd International Conference on e-Voting and Identity, Springer, 2012, pp. 1–18.

65.

Gonggrijp and

W.-J.

Hengeveld, Studying the Nedap/Groenendaal ES3B Voting Computer: A computer security perspective, in: EVT’07: Electronic Voting Technology Workshop, USENIX Association, 2007.

66.

Groth, Efficient maximal privacy in boardroom voting and anonymous broadcast, in: FC’04: 8th International Conference on Financial Cryptography, LNCS, Vol. 3110, Springer, 2004, pp. 90–104. doi:10.1007/978-3-540-27809-2_10.

67.

Groth, Simulation-sound NIZK proofs for a practical language and constant size group signatures, in: ASIACRYPT’02: 12th International Conference on the Theory and Application of Cryptology and Information Security, LNCS, Vol. 4284, Springer, 2006, pp. 444–459.

68.

Gumbel, Steal This Vote: Dirty Elections and the Rotten History of Democracy in America, Nation Books, 2005.

69.

Haber,

Benaloh and

Halevi, The Helios e-Voting Demo for the IACR, 2010, International Association for Cryptologic Research. http://www.iacr.org/elections/eVoting/heliosDemo.pdf.

70.

Haines and

Smyth, Surveying definitions of coercion resistance, 2020.

71.

Hao,

P.Y.A.

Ryan and

Zieliński, Anonymous voting by two-round public discussion, Journal of Information Security 4(2) (2010), 62–67.

72.

Heather and

Schneider, A formal framework for modelling coercion resistanc and receipt freeness, in: FM’12: 18th International Symposium on Formal Methods, LNCS, Springer, 2012, pp. 217–231.

73.

Hevia and

M.A.

Kiwi, Electronic jury voting protocols, in: LATIN’02: Theoretical Informatics, LNCS, Vol. 2286, Springer, 2002, pp. 415–429.

74.

Hevia and

M.A.

Kiwi, Electronic jury voting protocols, Theoretical Computer Science 321(1) (2004), 73–94. doi:10.1016/j.tcs.2003.06.003.

75.

D.W.

Jones and

Simons, Broken Ballots: Will Your Vote Count?, CSLI Lecture Notes, Vol. 204, Center for the Study of Language and Information, Stanford University, 2012.

76.

Juels,

Catalano and

Jakobsson, Coercion-resistant electronic elections, in: WPES’05: 4th Workshop on Privacy in the Electronic Society, ACM Press, 2005, pp. 61–70. doi:10.1145/1102199.1102213.

77.

Juels,

Catalano and

Jakobsson, Coercion-resistant electronic elections, in: Towards Trustworthy Elections: New Directions in Electronic Voting,

Chaum,

Jakobsson,

R.L.

Rivest and

P.Y.

Ryan, eds, LNCS, Vol. 6000, Springer, 2010, pp. 37–63. doi:10.1007/978-3-642-12980-3_2.

78.

Katz and

Lindell, Introduction to Modern Cryptography, Chapman & Hall/CRC, 2007. doi:10.1201/9781420010756.

79.

J.G.

Kelley, Monitoring Democracy: When International Election Observation Works, and Why It Often Fails, Princeton University Press, 2012.

80.

Khader,

Smyth,

P.Y.A.

Ryan and

Hao, A fair and robust voting system by broadcast, in: EVOTE’12: 5th International Conference on Electronic Voting, Lecture Notes in Informatics, Vol. 205, Gesellschaft für Informatik, 2012, pp. 285–299.

81.

Khazaei and

Rezaei-Aliabadi, A rigorous security analysis of a decentralized electronic voting protocol in the universal composability framework, Journal of Information Security and Applications 43 (2018), 99–109. doi:10.1016/j.jisa.2018.10.010.

82.

Kiayias and

Yung, Self-tallying elections and perfect ballot secrecy, in: PKC’01: 3rd International Workshop on Practice and Theory in Public Key Cryptography, LNCS, Vol. 2274, Springer, 2002, pp. 141–158.

83.

Kiayias,

Zacharias and

Zhang, End-to-end verifiable elections in the standard model, in: EUROCRYPT’15: 34th International Conference on the Theory and Applications of Cryptographic Techniques, LNCS, Vol. 9057, Springer, 2015, pp. 468–498.

84.

Klus,

Smyth and

M.D.

Ryan, ProSwapper: Improved equivalence verifier for ProVerif, 2010, http://www.bensmyth.com/proswapper.php.

85.

Kohno,

Stubblefield,

A.D.

Rubin and

D.S.

Wallach, Analysis of an electronic voting system, in: S&P’04: 25th Security and Privacy Symposium, IEEE Computer Society, 2004, pp. 27–40.

86.

Küsters,

Truderung and

Vogt, Accountability: Definition and relationship to verifiability, in: CCS’10: 17th ACM Conference on Computer and Communications Security, ACM Press, 2010, pp. 526–535. doi:10.1145/1866307.1866366.

87.

Küsters,

Truderung and

Vogt, Clash attacks on the verifiability of E-voting systems, in: S&P’12: 33rd IEEE Symposium on Security and Privacy, IEEE Computer Society, 2012, pp. 395–409.

88.

Küsters,

Truderung and

Vogt, A game-based definition of coercion-resistance and its applications, Journal of Computer Security 20(6) (2012), 709–764. doi:10.3233/JCS-2012-0444.

89.

Lepore, Rock, Paper, Scissors: How we used to vote, Annals of Democracy, The New Yorker (2008).

90.

Lijphart and

Grofman, Choosing an Electoral System: Issues and Alternatives, Praeger, 1984.

91.

Maaten, Towards remote e-voting: Estonian case, Electronic Voting in Europe-Technology, Law, Politics and Society 47 (2004), 83–100.

92.

McCarthy,

Smyth and

E.A.

Quaglia, Hawk and aucitas: E-auction schemes from the Helios and Civitas e-voting schemes, in: FC’14: 18th International Conference on Financial Cryptography and Data Security, LNCS, Vol. 8437, Springer, 2014, pp. 51–63.

93.

Meyer and

Smyth, Exploiting re-voting in the Helios election system, Information Processing Letters (2019), 14–19.

94.

Michels and

Horster, Some remarks on a receipt-free and universally verifiable mix-type voting scheme, in: ASIACRYPT’96: International Conference on the Theory and Application of Cryptology and Information Security, LNCS, Vol. 1163, Springer, 1996, pp. 125–132. doi:10.1007/BFb0034841.

95.

Mill, The Ballot, in: The Westminster Review, Vol. 13, Robert Heward, 1830.

96.

Moran and

Naor, Receipt-free universally-verifiable voting with everlasting privacy, in: CRYPTO’06: 26th International Cryptology Conference, LNCS, Vol. 4117, Springer, 2006, pp. 373–392.

97.

C.A.

Neff, Practical High Certainty Intent Verification for Encrypted Votes, Technical Report, VoteHere, 2004.

98.

C.A.

Neff and

Adler, Verifiable e-Voting: Indisputable electronic elections at polling places, Technical Report, VoteHere, 2003.

99.

NIST , Secure Hash Standard (SHS), FIPS PUB, 180-4, Information Technology Laboratory, National Institute of Standards and Technology, 2012.

100.

Norris, Why Elections Fail, Cambridge University Press, 2015. doi:10.1017/CBO9781107280908.

101.

Organization for Security and Co-operation in Europe, Document of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE, 1990.

102.

Organization of American States, American Convention on Human Rights, “Pact of San Jose, Costa Rica”, 1969.

103.

Paiola and

Blanchet, Verification of security protocols with lists: From length one to unbounded length, in: POST’12: First Conference on Principles of Security and Trust, LNCS, Vol. 7215, Springer, 2012, pp. 69–88. doi:10.1007/978-3-642-28641-4_5.

104.

Pfitzmann, Breaking efficient anonymous channel, in: EUROCRYPT’94: 11th International Conference on the Theory and Applications of Cryptographic Techniques, LNCS, Vol. 950, Springer, 1994, pp. 332–340. doi:10.1007/BFb0053448.

105.

Pfitzmann and

Pfitzmann, How to break the direct RSA-implementation of mixes, in: EUROCRYPT’89: 6th International Conference on the Theory and Applications of Cryptographic Techniques, LNCS, Vol. 434, Springer, 1989, pp. 373–381.

106.

G.V.

Post, Using re-voting to reduce the threat of coercion in elections, Electronic Government, an International Journal 7(2) (2010), 168–182. doi:10.1504/EG.2010.030926.

107.

E.A.

Quaglia and

Smyth, Authentication with weaker trust assumptions for voting systems, in: AFRICACRYPT’18: 10th International Conference on Cryptology in Africa, LNCS, Springer, 2018.

108.

E.A.

Quaglia and

Smyth, Secret, verifiable auctions from elections, Theoretical Computer Science 730 (2018), 44–92. doi:10.1016/j.tcs.2018.03.022.

109.

E.A.

Quaglia and

Smyth, A short introduction to secrecy and verifiability for elections, 2018, arXiv, Report 1702.03168.

110.

Saalfeld, On dogs and whips: Recorded votes, in: Parliaments and Majority Rule in Western Europe,

Döring, ed., St. Martin’s Press, 1995, Chapter 16.

111.

Sako and

Kilian, Receipt-free mix-type voting scheme: A practical solution to the implementation of a voting booth, in: EUROCRYPT’95: 12th International Conference on the Theory and Applications of Cryptographic Techniques, LNCS, Vol. 921, Springer, 1995, pp. 393–403.

112.

Schoenmakers, A simple publicly verifiable secret sharing scheme and its application to electronic voting, in: CRYPTO’99: 19th International Cryptology Conference, LNCS, Vol. 1666, Springer, 1999, pp. 148–164. doi:10.1007/3-540-48405-1_10.

113.

Schweikardt, Arithmetic, first-order logic, and counting quantifiers, ACM Transactions on Computational Logic 6(3) (2005), 634–671. doi:10.1145/1071596.1071602.

114.

Shoup, Sequences of games: A tool for taming complexity in security proofs, 2004.

115.

Smyth, Formal verification of cryptographic protocols with automated reasoning, PhD thesis, School of Computer Science, University of Birmingham, 2011.

116.

Smyth, Verifiability of Helios Mixnet, in: Voting’18: 3rd Workshop on Advances in Secure Electronic Voting, LNCS, Springer, 2018.

117.

Smyth, Athena: A verifiable, coercion-resistant voting system with linear complexity, 2019.

118.

Smyth, First-past-the-post suffices for ranked voting, 2017, https://bensmyth.com/publications/2017-FPTP-suffices-for-ranked-voting/.

119.

Smyth, Replay attacks that violate ballot secrecy in Helios, 2012, Cryptology ePrint Archive, Report 2012/185.

120.

Smyth, A foundation for secret, verifiable elections, 2018, Cryptology ePrint Archive, Report 2018/225 (version 20180301:164045).

121.

Smyth, Ballot secrecy with malicious bulletin boards, 2014, Cryptology ePrint Archive, Report 2014/822 (version 20141012:004943).

122.

Smyth, Secrecy and independence for election schemes, 2015, Cryptology ePrint Archive, Report 2015/942 (version 20150928:195428).

123.

Smyth, Secrecy and independence for election schemes, 2016, Cryptology ePrint Archive, Report 2015/942 (version 20160713:142934).

124.

Smyth, Verifiability of Helios Mixnet, 2018, Cryptology ePrint Archive, Report 2018/017.

125.

Smyth and

Bernhard, Ballot secrecy and ballot independence coincide, in: ESORICS’13: 18th European Symposium on Research in Computer Security, LNCS, Vol. 8134, Springer, 2013, pp. 463–480.

126.

Smyth and

Bernhard, Ballot secrecy and ballot independence: Definitions and relations, 2014, Cryptology ePrint Archive, Report 2013/235 (version 20141010:082554).

127.

Smyth and

Cortier, A note on replay attacks that violate privacy in electronic voting schemes, Technical Report, RR-7643, INRIA, 2011.

128.

Smyth,

Frink and

M.R.

Clarkson, Election Verifiability: Cryptographic Definitions and an Analysis of Helios and JCJ, 2017, Cryptology ePrint Archive, Report 2015/233 (version 20170213:132559).

129.

Smyth and

Hanatani, Non-malleable encryption with proofs of plaintext knowledge and applications to voting, International Journal of Security and Networks 14(4) (2019), 191–204. doi:10.1504/IJSN.2019.103150.

130.

Smyth,

Hanatani and

Muratani, NM-CPA secure encryption with proofs of plaintext knowledge, in: IWSEC’15: 10th International Workshop on Security, LNCS, Vol. 9241, Springer, 2015, pp. 115–134.

131.

Smyth and

Pironti, Truncating TLS connections to violate beliefs in web applications, in: WOOT’13: 7th USENIX Workshop on Offensive Technologies, USENIX Association, 2013 (First appeared at Black Hat USA 2013).

132.

Smyth and

Pironti, Truncating TLS Connections to Violate Beliefs in Web Applications, Technical Report, hal-01102013, INRIA, 2015.

133.

Springall,

Finkenauer,

Durumeric,

Kitcat,

Hursti,

MacAlpine and

J.A.

Halderman, Security analysis of the Estonian Internet Voting System, in: CCS’14: 21st ACM Conference on Computer and Communications Security, ACM Press, 2014, pp. 703–715. doi:10.1145/2660267.2660315.

134.

Staff, ACM’s 2014 General Election: Please take this opportunity to vote, Communications of the ACM 57(5) (2014), 9–17. doi:10.1145/2597769.

135.

Tsiounis and

Yung, On the security of ElGamal based encryption, in: PKC’98: First International Workshop on Practice and Theory in Public Key Cryptography, LNCS, Vol. 1431, Springer, 1998, pp. 117–134.

136.

Tsoukalas,

Papadimitriou,

Louridas and

Tsanakas, From Helios to Zeus, Journal of Election Technology and Systems 1(1) (2013).

137.

UK Electoral Commission, Key Issues and Conclusions: May 2007 Electoral Pilot Schemes, 2007.

138.

United Nations, Universal Declaration of Human Rights, 1948.

139.

Unruh and

Müller-Quade, Universally composable incoercibility, in: CRYPTO’10: 30th International Cryptology Conference, LNCS, Vol. 6223, Springer, 2010, pp. 411–428.

140.

Wikström, Simplified submission of inputs to protocols, in: SCN’08: 6th International Conference on Security and Cryptography for Networks, LNCS, Vol. 5229, Springer, 2008, pp. 293–308. doi:10.1007/978-3-540-85855-3_20.

141.

Wikström, Verificatum: How to Implement a Stand-Alone Verifier for the Verificatum Mix-Net (VMN Version 3.0.2), 2016, http://www.verificatum.com/files/vmnum-3.0.2.pdf .

142.

Wikström, Simplified Submission of Inputs to Protocols, 2006, Cryptology ePrint Archive, Report 2006/259.

143.

Wolchok,

Wustrow,

J.A.

Halderman,

H.K.

Prasad,

Kankipati,

S.K.

Sakhamuri,

Yagati and

Gonggrijp, Security analysis of India’s electronic voting machines, in: CCS’10: 17th ACM Conference on Computer and Communications Security, ACM Press, 2010, pp. 1–14.

144.

Wolchok,

Wustrow,

Isabel and

J.A.

Halderman, Attacking the Washington, D.C. Internet voting system, in: FC’12: 16th International Conference on Financial Cryptography and Data Security, LNCS, Vol. 7397, Springer, 2012, pp. 114–128. doi:10.1007/978-3-642-32946-3_10.