An Overview of End-to-End Verifiable Voting Systems
---
paper_title: Security Analysis of the Estonian Internet Voting System

paper_content:

Estonia was the first country in the world to use Internet voting nationally, and today more than 30% of its ballots are cast online. In this paper, we analyze the security of the Estonian I-voting system based on a combination of in-person election observation, code review, and adversarial testing. Adopting a threat model that considers the advanced threats faced by a national election system---including dishonest insiders and state-sponsored attacks---we find that the I-voting system has serious architectural limitations and procedural gaps that potentially jeopardize the integrity of elections. In experimental attacks on a reproduction of the system, we demonstrate how such attackers could target the election servers or voters' clients to alter election results or undermine the legitimacy of the system. Our findings illustrate the practical obstacles to Internet voting in the modern world, and they carry lessons for Estonia, for other countries considering adopting such systems, and for the security research community.
---
paper_title: Untraceable electronic mail, return addresses, and digital pseudonyms

paper_content:

A technique based on public key cryptography is presented that allows an electronic mail system to hide who a participant communicates with as well as the content of the communication - in spite of an unsecured underlying telecommunication system. The technique does not require a universally trusted authority. One correspondent can remain anonymous to a second, while allowing the second to respond via an untraceable return address. The technique can also be used to form rosters of untraceable digital pseudonyms from selected applications. Applicants retain the exclusive ability to form digital signatures corresponding to their pseudonyms. Elections in which any interested party can verify that the ballots have been properly counted are possible if anonymously mailed ballots are signed with pseudonyms from a roster of registered voters. Another use allows an individual to correspond with a record-keeping organization under a unique pseudonym, which appears in a roster of acceptable clients.
---
paper_title: Sensus: A Security-Conscious Electronic Polling System for the Internet

paper_content:

Presents the design and implementation of Sensus, a practical, secure and private system for polling (conducting surveys and elections) over computer networks. Expanding on the work of Fujioka, Okamoto and Ohta (1993), Sensus uses blind signatures to ensure that only registered voters can vote and that each registered voter only votes once, while at the same time maintaining voters' privacy. Sensus allows voters to verify independently that their votes were counted correctly and to anonymously challenge the results should their votes be miscounted. We outline seven desirable properties of voting systems and show that Sensus satisfies these properties well, in some cases better than traditional voting systems.
---
paper_title: How to Prevent Buying of Votes in Computer Elections

paper_content:

We present a new voting scheme. Our scheme is the first one which satisfies both of the following properties: each voter can check that her voting strategy is counted correctly but she cannot prove the voting strategy to anybody except the full coalition of all interest groups involved in the voting. The latter property means that buying of votes is not possible, since the potential buyer does not know whether she gets what she is paying for!
---
paper_title: Coercion-resistance and receipt-freeness in electronic voting

paper_content:

In this paper we formally study important properties of electronic voting protocols. In particular we are interested in coercion-resistance and receipt-freeness. Intuitively, an election protocol is coercion-resistant if a voter A cannot prove to a potential coercer C that she voted in a particular way. We assume that A cooperates with C in an interactive fashion. Receipt-freeness is a weaker property, for which we assume that A and C cannot interact during the protocol: to break receipt-freeness, A later provides evidence (the receipt) of how she voted. While receipt-freeness can be expressed using observational equivalence from the applied pi calculus, we need to introduce a new relation to capture coercion-resistance. Our formalization of coercion-resistance and receipt-freeness are quite different. Nevertheless, we show in accordance with intuition that coercion-resistance implies receipt-freeness, which implies privacy, the basic anonymity property of voting protocols, as defined in previous work. Finally we illustrate the definitions on a simplified version of the Lee et al. voting protocol.
---
paper_title: Receipt-Free Mix-Type Voting Scheme

paper_content:

We present a receipt-free voting scheme based on a mixtype anonymous channel[Cha81, PIK93]. The receipt-freeness property [BT94] enables voters to hide how they have voted even from a powerful adversary who is trying to coerce him. The work of [BT94] gave the first solution using a voting booth, which is a hardware assumption not unlike that in current physical elections. In our proposed scheme, we reduce the physical assumptions required to obtain receipt-freeness. Our sole physical assumption is the existence of a private channel through which the center can send the voter a message without fear of eavesdropping.
---
paper_title: Efficient receipt-free voting based on homomorphic encryption

paper_content:

Voting schemes that provide receipt-freeness prevent voters from proving their cast vote, and hence thwart vote-buying and coercion. We analyze the security of the multi-authority voting protocol of Benaloh and Tuinstra and demonstrate that this protocol is not receiptfree, opposed to what was claimed in the paper and was believed before. Furthermore, we propose the first practicable receipt-free voting scheme. Its only physical assumption is the existence of secret one-way communication channels from the authorities to the voters, and due to the public verifiability of the tally, voters only join a single stage of the protocol, realizing the "vote-and-go" concept. The protocol combines the advantages of the receipt-free protocol of Sako and Kilian and of the very efficient protocol of Cramer, Gennaro, and Schoenmakers, with help of designated-verifier proofs of Jakobsson, Sako, and Impagliazzo. ::: ::: Compared to the receipt-free protocol of Sako and Kilian for security parameter l (the number of repetitions in the non-interactive cut-andchoose proofs), the protocol described in this paper realizes an improvement of the total bit complexity by a factor l.
---
paper_title: Coercion-resistant electronic elections

paper_content:

We introduce a model for electronic election schemes that involves a more powerful adversary than previous work. In particular, we allow the adversary to demand of coerced voters that they vote in a particular manner, abstain from voting, or even disclose their secret keys. We define a scheme to be coercion-resistant if it is infeasible for the adversary to determine if a coerced voter complies with the demands.A first contribution of this paper is to describe and characterize a new and strengthened adversary for coercion in elections. (In doing so, we additionally present what we believe to be the first formal security definitions for electronic elections of any type.) A second contribution is to demonstrate a protocol that is secure against this adversary. While it is clear that a strengthening of attack models is of theoretical relevance, it is important to note that our results lie close to practicality. This is true both in that we model real-life threats (such as vote-buying and vote-canceling), and in that our proposed protocol combines a fair degree of efficiency with an unusual lack of structural complexity. Furthermore, previous schemes have required use of an untappable channel throughout. Ours only carries the much more practical requirement of an anonymous channel during the casting of ballots, and an untappable channel during registration (potentially using postal mail).This extended abstract is a heavily truncated version of the full paper available at http://eprint.iacr.org/2002/165.
---
paper_title: Vote buying and social desirability bias: Experimental evidence from Nicaragua

paper_content:

Qualitative studies of vote buying generally find the practice to be common in many countries, but quantitative studies using surveys often find little evidence of vote buying. We argue that social desirability bias accounts for this empirical discrepancy and employ a survey-based list experiment to minimize the problem. We conducted a nationally representative survey after the 2008 Nicaraguan municipal elections where we asked about vote buying behavior by campaigns using a list experiment and using the questions traditionally used by studies of vote buying. Our list experiment estimated that 24% of registered voters in Nicaragua were offered a gift or service in exchange for their vote, whereas only 2% reported the behavior when asked directly. We then demonstrate that the social desirability bias is non-random and that the analysis based on traditional obtrusive measures of vote buying is unreliable. We also provide systematic evidence that shows the importance of monitoring strategies by parties in determining who is targeted for vote buying.
---
paper_title: Poverty and Vote Buying: Survey-Based Evidence from Africa

paper_content:

Alongside the spread of democracy in the developing world, vote buying has emerged as an integral part of election campaigns. Yet, we know little about the causes of vote buying in young democracies. In this paper, we analyse the sources of vote buying in sub-Saharan African. Using data from the Afrobarometer, we focus on the impact of poverty on vote buying at the individual- and country-level. Results from multilevel regressions show that poor voters are significantly more likely to be targets of vote buying than wealthier voters. This effect increases when elections are highly competitive. Thus, micro-level poverty seems to be an important source of vote buying in Africa and has major implications for the way electoral democracy operates.
---
paper_title: introduction Elections with Unconditionally-Secret Ballots and Disruption Equivalent to Breaking RSA

paper_content:

Election protocols embodying robustness, verifiability of returns by voters, and unconditional security for voters’ privacy have been presented. The techniques also allow untraceable payments and credentials.
---
paper_title: An electronic voting scheme

paper_content:

This paper proposes a practical large scaled secret voting scheme which satisfies the receipt-free property* as well as the fairness property†. This scheme uses three realistic tools: a non-anonymous channel, a bulletin board, and a private channel. The participants of the scheme are the voters and voting commissioners (administrators, privacy commission members, and timeliness commission members). There are four stages to this scheme: the authorizing stage, voting stage, claiming stage, and counting stage. A voter performs just one round message exchange with the administrators in the authorizing stage, and is required to send just one message in the voting stage.
---
paper_title: Receipt-Free Mix-Type Voting Scheme

paper_content:

We present a receipt-free voting scheme based on a mixtype anonymous channel[Cha81, PIK93]. The receipt-freeness property [BT94] enables voters to hide how they have voted even from a powerful adversary who is trying to coerce him. The work of [BT94] gave the first solution using a voting booth, which is a hardware assumption not unlike that in current physical elections. In our proposed scheme, we reduce the physical assumptions required to obtain receipt-freeness. Our sole physical assumption is the existence of a private channel through which the center can send the voter a message without fear of eavesdropping.
---
paper_title: Privacy and Verifiability in Voting Systems: Methods, Developments and Trends

paper_content:

Abstract One of the most challenging aspects in computer-supported voting is to combine the apparently conflicting requirements of privacy and verifiability. On the one hand, privacy requires that a vote cannot be traced back from the result to a voter, while on the other hand, verifiability states that a voter can trace the effect of her vote on the result. This can be addressed using various privacy-enabling cryptographic primitives which also offer verifiability. As more and more refined voting systems were proposed, understanding of first privacy and later verifiability in voting increased, and notions of privacy as well as notions of verifiability in voting became increasingly more refined. This has culminated in a variety of verifiable systems that use cryptographic primitives to ensure specific kinds of privacy. However, the corresponding privacy and verifiability claims are not often verified independently. When they are investigated, claims have been invalidated sufficiently often to warrant a cautious approach to them. The multitude of notions, primitives and proposed solutions that claim to achieve both privacy and verifiability form an interesting but complex landscape. The purpose of this paper is to survey this landscape by providing an overview of the methods, developments and current trends regarding privacy and verifiability in voting systems.
---
paper_title: Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy

paper_content:

On November 3, 2009, voters in Takoma Park, Maryland, cast ballots for the mayor and city council members using the Scantegrity II voting system--the first time any end-to-end (E2E) voting system with ballot privacy has been used in a binding governmental election. This case study describes the various efforts that went into the election--including the improved design and implementation of the voting system, streamlined procedures, agreements with the city, and assessments of the experiences of voters and poll workers. ::: ::: The election, with 1728 voters from six wards, involved paper ballots with invisible-ink confirmation codes, instant-runoff voting with write-ins, early and absentee (mail-in) voting, dual-language ballots, provisional ballots, privacy sleeves, any-which-way scanning with parallel conventional desktop scanners, end-to-end verifiability based on optional web-based voter verification of votes cast, a full hand recount, thresholded authorities, three independent outside auditors, fully-disclosed software, and exit surveys for voters and pollworkers. ::: ::: Despite some glitches, the use of Scantegrity II was a success, demonstrating that E2E cryptographic voting systems can be effectively used and accepted by the general public.
---
paper_title: Usability analysis of helios - an open source verifiable remote electronic voting system

paper_content:

Currently, rather secure cryptographic voting protocols providing verifiability exist. However, without adequate usability and abstraction concepts to explain the voting process and, in particular, the verifiability steps, they are not ready for legally binding elections. This holds in particular for remote electronic voting systems because of the absence of poll workers who can support voters by explaining single steps. In this paper, the usability of the ballot casting and verifiability procedures of the Helios open source end to end verifiable remote electronic voting system is analyzed using the cognitive walkthrough approach by security, electronic voting and usability experts. We demonstrate the need for improvements to the usability and verifiability of Helios, before it is used in large scale elections outside of an academic context. Based on our results, we propose new interfaces for improved usability of Helios and future end to end verifiable electronic voting systems.
---
paper_title: Making Mix Nets Robust for Electronic Voting by Randomized Partial Checking

paper_content:

We propose a new technique for making mix nets robust, called randomized partial checking (RPC). The basic idea is that rather than providing a proof of completely correct operation, each server provides strong evidence of its correct operation by revealing a pseudo-randomly selected subset of its input/output relations. Randomized partial checking is exceptionally efficient compared to previous proposals for providing robustness; the evidence provided at each layer is shorter than the output of that layer, and producing the evidence is easier than doing the mixing. It works with mix nets based on any encryption scheme (i.e., on public-key alone, and on hybrid schemes using public-key/symmetric-key combinations). It also works both with Chaumian mix nets where the messages are successively encrypted with each servers’ key, and with mix nets based on a single public key with randomized re-encryption at each layer. Randomized partial checking is particularly well suited for voting systems, as it ensures voter privacy and provides assurance of correct operation. Voter privacy is ensured (either probabilistically or cryptographically) with appropriate design and paRSA Laboratories, Bedford, MA 01730, mjakobsson@rsasecurity.com RSA Laboratories, Bedford, MA 01730, ajuels@rsasecurity.com Laboratory for Computer Science, Massachusetts Institute of Technology, Cambridge, MA 02139, rivest@mit.edu Support provided by the Carnegie Foundation. rameter selection. Unlike previous work, our work provides voter privacy as a global property of the mix net rather than as a property ensured by a single honest server. RPC-based mix nets also provide very high assurance of a correct election result, since a corrupt server is very likely to be caught if it attempts to tamper with even a couple of ballots.
---
paper_title: Untraceable electronic mail, return addresses, and digital pseudonyms

paper_content:

A technique based on public key cryptography is presented that allows an electronic mail system to hide who a participant communicates with as well as the content of the communication - in spite of an unsecured underlying telecommunication system. The technique does not require a universally trusted authority. One correspondent can remain anonymous to a second, while allowing the second to respond via an untraceable return address. The technique can also be used to form rosters of untraceable digital pseudonyms from selected applications. Applicants retain the exclusive ability to form digital signatures corresponding to their pseudonyms. Elections in which any interested party can verify that the ballots have been properly counted are possible if anonymously mailed ballots are signed with pseudonyms from a roster of registered voters. Another use allows an individual to correspond with a record-keeping organization under a unique pseudonym, which appears in a roster of acceptable clients.
---
paper_title: Punchscan in practice: an E2E election case study

paper_content:

This paper presents a case study of the E2E voting system Punchscan and its first use in a binding election. The election was held in March 2007 at the University of Ottawa for several offices within the university’s graduate student association. This case study presents a walkthrough of the election and offers discussion as to how the voters and poll workers responded to the Punchscan system, with implications to E2E systems in general.
---
paper_title: Voting With Unconditional Privacy by Merging PrÊt À Voter and PunchScan

paper_content:

We present a detailed comparison of the Pret a Voter (PaV) and PunchScan (PS) protocols for booth voting. We also describe a simpler variation that keeps the ballot layout of PaV-Voter but borrows the cryptography from PS, which is based on any commitment scheme. By using unconditionally hiding commitments we obtain a conceptually very simple voting protocol with unconditional privacy.
---
paper_title: A simple technique for safely using Punchscan and Prêt à Voter in mail-in elections

paper_content:

We apply a technique inspired by Scantegrity to Punchscan and Pret a Voter and show how this results in a mail-in ballot system that is auditable, simple to use and easy to understand.
---
paper_title: Distributing the power of a government to enhance the privacy of voters

paper_content:

The present invention relates to a new and distinct variety of the Compositae family, Osteospermum fruticosum (L.) Norl., common name Cape Daisy, denominated 'Highside.'The new variety is distinguished from its parents and all other members of the genera known to the inventor by: the ability of its flower heads to remain open in low light conditions, its distinctive coloring-the ray florets being red-purple and the disk florets being violet blue; its strong peduncles; and its dwarf, vigorous, medium-spreading growth habit.
---
paper_title: Attacking Paper-Based E2E Voting Systems

paper_content:

In this paper, we develop methods for constructing vote-buying/coercion attacks on end-to-end voting systems, and describe vote-buying/coercion attacks on three proposed end-to-end voting systems: Punchscan, Pret-a-voter, and ThreeBallot. We also demonstrate a different attack on Punchscan, which could permit corrupt election officials to change votes without detection in some cases. Additionally, we consider some generic attacks on end-to-end voting systems.
---
paper_title: vVote: A Verifiable Voting System

paper_content:

The Pret a Voter cryptographic voting system was designed to be flexible and to offer voters a familiar and easy voting experience. In this article, we present our development of the Pret a Voter design to a practical implementation used in a real state election in November 2014, called vVote. As well as solving practical engineering challenges, we have also had to tailor the system to the idiosyncrasies of elections in the Australian state of Victoria and the requirements of the Victorian Electoral Commission. This article includes general background, user experience, and details of the cryptographic protocols and human processes. We explain the problems, present solutions, then analyze their security properties and explain how they tie in to other design decisions.
---
paper_title: Scantegrity III: Automatic Trustworthy Receipts, Highlighting Over/Under Votes, and Full Voter Verifiability

paper_content:

Building on lessons learned from the November 2009 Scantegrity II election in Takoma Park, MD, we propose improvements to the Scantegrity II voting system that (1) automatically print trustworthy receipts for easier on-line verification, (2) highlight ballot features including over/under votes to comply with the Help America Vote Act, and (3) achieve full voter verifiability by eliminating print audits. We call the improved voting system Scantegrity III, which features a new ballot style and a special casting station that highlights ballots and prints receipts. Scantegrity III addresses the major limitations of Scantegrity II and delivers the feature most requested by voters and election officials at the Takoma Park election: printing receipts automatically. ::: ::: We present, analyze, and compare three designs for a Scantegrity receipt printer: a simple image duplicator available to voters in an optional separate station before casting; a mark sense translator, connected to the official ballot scanner, which reads encrypted codenumbers printed on the ballot; and the Scantegrity III casting station, which is an embellished mark sense translator. At the Scantegrity III station, voters cast ballots that include both Scantegrity II codes in invisible ink and Scantegrity I codes in conventional ink; this combination of codes enables print audits to be eliminated. We also design a Trusted Platform Module (TPM) enhancement to bolster privacy, to store keys and verification codes, and to ensure that the correct software is booted. Election integrity does not depend on the correct operation of the TPM. Receipt printers reduce the amount of special voter instruction required, improve accessibility, enable each voter to detect if any additional mark is added to her ballot after casting, and make vote verification easier.
---
paper_title: Visual Cryptography

paper_content:

In this paper we consider a new type of cryptographic scheme, which can decode concealed images without any cryptographic computations. The scheme is perfectly secure and very easy to implement. We extend it into a visual variant of the k out of n secret sharing problem, in which a dealer provides a transparency to each one of the n users; any k of them can see the image by stacking their transparencies, but any k-1 of them gain no information about it.
---
paper_title: Scantegrity: End-to-End Voter-Verifiable Optical- Scan Voting

paper_content:

Scantegrity is a security enhancement for optical scan voting systems. It's part of an emerging class of "end-to-end" independent election verification systems that permit each voter to verify that his or her ballot was correctly recorded and counted. On the Scantegrity ballot, each candidate position is paired with a random letter. Election officials confirm receipt of the ballot by posting the letter that is adjacent to the marked position. Scantegrity is the first voting system to offer strong independent verification without changing the way voters mark optical scan ballots, and it complies with legislative proposals requiring "unencrypted" paper audit records.
---
paper_title: Experiences Gained from the first Prêt à Voter Implementation

paper_content:

Implementing an electronic voting system for the first time can be difficult, since requirements are sometimes hard to specify and keep changing, resources are scarce in an academic setting, the gap between theory and practice is wider than anticipated, adhering to a formal development lifecycle is inconvenient and delivery on time is very hard. This paper describes all of the work done by the Pr^et `a Voter team in the run-up to VoComp in 2007 and enumerates a number of lessons learned.
---
paper_title: Scratch & vote: self-contained paper-based cryptographic voting

paper_content:

We present Scratch & Vote (S&V), a cryptographic voting system designed to minimize cost and complexity: (1) ballots are paper-based and can be printed using today’s technology, (2) ballots are universally verifiable without electionofficial intervention, and (3) tallying requires only one trustee decryption per race, thanks to homomorphic aggregation. Scratch & Vote combines the multi-candidate election techniques of Baudron et al. with the ballot-casting simplicity of Chaum and Ryan’s paper-based techniques. In addition, S&V allows each voter to participate directly in the audit process on election day, prior to casting their own ballot.
---
paper_title: Simple verifiable elections

paper_content:

Much work has been done in recent decades to apply sophisticated cryptographic techniques to achieve strong end-to-end verifiability in election protocols. The properties of these protocols are much stronger than in any system in general use; however, the complexity of these systems has retarded their adoption. This paper describes a relatively simple but still effective approach to cryptographic elections. Although not as computationally efficient as previously proposed cryptographic approaches, the work presented herein is intended to be more accessible and therefore more suitable for comparison with other voting systems.
---
paper_title: An efficient and highly sound voter verification technique and its implementation

paper_content:

This paper presents MarkPledge3 (MP3), the most efficient specification of the MarkPledge (MP) technique. The MP technique allows the voter to verify that her vote is correctly encrypted with a soundness of 1−2−α, with 20≤α≤30, just by performing a match of a small string (4-5 characters). Due to its simplicity, verifying the election public data (vote encryptions and tally) in MP3 is 2.6 times faster than with MP2 and the vote encryption creation on devices with low computational power, e.g. smart cards, is approximately 6 times better than the best of the previous MP specifications (MP1 and MP2).
---
paper_title: VoteBox: A Tamper-evident, Verifiable Electronic Voting System

paper_content:

Commercial electronic voting systems have experienced many high-profile software, hardware, and usability failures in real elections. While it is tempting to abandon electronic voting altogether, we show how a careful application of distributed systems and cryptographic techniques can yield voting systems that surpass current systems and their analog forebears in trustworthiness and usability. We have developed the VoteBox, a complete electronic voting system that combines several recent e-voting research results into a coherent whole that can provide strong end-to-end security guarantees to voters. VoteBox machines are locally networked and all critical election events are broadcast and recorded by every machine on the network. VoteBox network data, including encrypted votes, can be safely relayed to the outside world in real time, allowing independent observers with personal computers to validate the system as it is running. We also allow any voter to challenge a VoteBox, while the election is ongoing, to produce proof that ballots are cast as intended. The VoteBox design offers a number of pragmatic benefits that can help reduce the frequency and impact of poll worker or voter errors.
---
paper_title: Untraceable electronic mail, return addresses, and digital pseudonyms

paper_content:

A technique based on public key cryptography is presented that allows an electronic mail system to hide who a participant communicates with as well as the content of the communication - in spite of an unsecured underlying telecommunication system. The technique does not require a universally trusted authority. One correspondent can remain anonymous to a second, while allowing the second to respond via an untraceable return address. The technique can also be used to form rosters of untraceable digital pseudonyms from selected applications. Applicants retain the exclusive ability to form digital signatures corresponding to their pseudonyms. Elections in which any interested party can verify that the ballots have been properly counted are possible if anonymously mailed ballots are signed with pseudonyms from a roster of registered voters. Another use allows an individual to correspond with a record-keeping organization under a unique pseudonym, which appears in a roster of acceptable clients.
---
paper_title: Enhancing Electronic Voting Machines on the Example of Bingo Voting

paper_content:

The main purpose of cryptographic voting schemes is to provide transparency while protecting ballot secrecy and to enable a fast tally. In this paper, we address three major issues of cryptographic voting schemes. First we discuss the problem of secrecy and coercion resistance in the situation of a corrupted voting machine. While hard to obtain in general, we propose and analyze a novel approach that uses encapsulated design and minimizes the information that can compromise ballot secrecy. The second issue we address is the assumption that an adversary does not know which receipts are checked and the problem of receipt stealing. Many voting schemes with receipts share this vulnerability. We provide a solution that increases protection of each vote and which can be generalized for voting schemes that use computers to form the receipt. The last issue discussed in this paper is the question of how an election can be contested. For this, an error or a manipulation must not only be detected but also proven. While the problems and solutions are described for Bingo Voting, we argue that the problems are shared by many cryptographic voting schemes and that the solutions presented in this work give insight in the prerequisites needed for a secure election.
---
paper_title: The Case for Networked Remote Voting Precincts

paper_content:

Voting in national elections from the comfort of one's home computer may never be practical or secure, but we argue that remote network voting can be both practical and secure. Provisional and postal absentee ballots, which trade some amount of anonymity for the ability to determine the eligibility of a distant voter, serve as a template for how electronic remote voting might proceed. We propose the "remote voting center": a government-operated facility located in embassies, consulates, and other remote areas where voters might normally need to vote by mail. Each remote voting center would maintain one or more electronic voting systems and a registration system. A voter presents identification to the registrar on site and is then directed to cast a ballot in a private electronic voting booth. The cast ballot is encrypted and forwarded to the registration system, where it is wrapped with the voter's identifying information. This double enclosure is signed by the voting center and posted publicly where it can be examined and canvassed by officials in the voter's home precinct. If and when the ballot is accepted, it can be combined with existing tallies using standard cryptographic techniques to preserve the voter's anonymity. The resulting system has privacy properties comparable to provisional voting in a local polling place, and represents an improvement over postal voting by offering the voter privacy in a supervised voting center.
---
paper_title: Secure data export and auditing using data diodes

paper_content:

Data diodes, that is, devices which permit only one-way communication, without even a reverse channel for acknowledgment, have many potential uses within voting systems. A practical design for a data diode is presented that is simpler and more nearly self-evident than previously published designs. Communication protocols appropriate for use in the voting context are described. Throughout, we emphasize designs that permit a relatively naive observer to determine that it meets key security constraints.
---
paper_title: Bingo Voting: Secure and coercion-free voting using a trusted random number generator

paper_content:

It is debatable if current direct-recording electronic votingmachines can sufficiently be trusted for a use in elections. Reports about malfunctions and possible ways ofmanipulation abound. Voting schemes have to fulfill seemingly contradictory requirements: On one hand the election process should be verifiable to prevent electoral fraud and on the other hand each vote should be deniable to avoid coercion and vote buying. ::: ::: This work presents a new verifiable and coercion-free voting scheme Bingo Voting, which is based on a trusted random number generator. As a motivation for the new scheme two coercion/vote buying attacks on voting schemes are presented which show that it can be dangerous to let the voter contribute randomness to the voting scheme. ::: ::: A proof-of-concept implementation of the scheme shows the practicality of the scheme: all costly computations can be moved to a non time critical pre-voting phase.
---
paper_title: User Manual for the Verificatum Mix-Net Version 1.4.0

paper_content:

The Verificatum mix-net is an implementation of a provably secure El Gamal-based mix-net. This document describes how to use the mix-net. For information about the design and implementation, please visit http://www.verificatum.org.
---
paper_title: An improved electronic voting scheme without a trusted random number generator

paper_content:

Bingo Voting uses trusted random number generator to realize the correctness and coercion-free. If the trusted random number generator is corrupted, the whole scheme is dangerous, which make it a security bottleneck. With the method of verifiable random number based on interpolating polynomial over Fp, an improved electronic voting scheme is proposed, which not only inherits the good properties of Bingo Voting, but also eliminates the dependence of the trusted random number generator. With the receipt, voter can verify whether the content of vote meets his aspiration or not, but he can not prove to others whom he has vote. The improved e-voting scheme based on verifiable random number that is fair, verifiable, and untraceable can efficiently prevent from colluding and buying vote.
---
paper_title: Casting votes in the Auditorium

paper_content:

In elections employing electronic voting machines, we have observed that poor procedures, equipment failures, and honest mistakes pose a real threat to the accuracy of the final tally. The event logs kept by these machines can give auditors clues as to the causes of anomalies and inconsistencies; however, each voting machine is trusted to keep its own audit and ballot data, making the record unreliable. If a machine is damaged, accidentally erased, or otherwise compromised during the election, we have no way to detect tampering or loss of auditing records and cast votes. ::: ::: We see a need for voting systems in which event logs can serve as robust forensic documents, describing a provable timeline of events leading up to and transpiring on election day. To this end, we propose an auditing infrastructure that draws on ideas from distributed systems and secure logging to provide a verifiable, global picture of critical election-day events, one which can survive individual machine malfunction or malice. Our system, the Auditorium, joins the voting machines in a polling place together in a private broadcast network in which all election events are logged redundantly by every machine. Each event is irrevocably tied to the originating machine by a digital signature, and to earlier events from other machines via hash chaining. ::: ::: In this paper we describe in detail how to conduct an election in the Auditorium. We demonstrate our system's robustness to benign failures and malicious attacks, resulting in a believable audit trail and vote count, with acceptable overhead for a network the size of a polling place.
---
paper_title: VeryVote: A Voter Verifiable Code Voting System

paper_content:

Code voting is a technique used to address the secure platform problem of remote voting. A code voting system consists in secretly sending, e.g. by mail, code sheets to voters that map their choices to entry codes in their ballot. While voting, the voter uses the code sheet to know what code to enter in order to vote for a particular candidate. In effect, the voter does the vote encryption and, since no malicious software on the PC has access to the code sheet it is not able to change the voter's intention. However, without compromising the voter's privacy, the vote codes are not enough to prove that the vote is recorded and counted as cast by the election server. ::: ::: We present a voter verifiable code voting solution which, without revealing the voter's vote, allows the voter to verify, at the end of the election, that her vote was cast and counted as intended by just performing the match of a few small strings. Moreover, w.r.t. a general code voting system, our solution comes with only a minor change in the voting interaction.
---
paper_title: Administrative and Public Verifiability: Can We Have Both?

paper_content:

Administrative verifiability gives election officials the means to protect against certain kinds of errors and fraud. This is typically accomplished with tools like paper audit trails that enable manual recounts and spot checks. Public verifiability uses cryptographic and related tools to enable any member of the public to independently fully verify the accuracy of an election tally. Although public verifiability is technically a higher standard, its complexity makes it unappealing for many. This raises the question of whether it is possible to achieve public verifiability without sacrificing the traditional administrative verifiability tools in common use. ::: ::: This paper introducesverified optical scan -- a simple design wherein both administrative and public verifiability are possible and the two are tightly linked to achieve consistent results.
---
paper_title: A New Implementation of a Dual (Paper and Cryptographic) Voting System.

paper_content:

We report on the design and implementation of a new cryptographic voting system, designed to retain the "look and feel" of standard, paper-based voting used in our country Israel while enhancing security with end-to-end verifiability guaranteed by cryptographic voting. Our system is dual ballot and runs two voting processes in parallel: one is electronic while the other is paper-based and similar to the traditional process used in Israel. Consistency between the two processes is enforced by means of a new, specially-tailored paper ballot format. We examined the practicality and usability of our protocol through implementation and field testing in two elections: the first being a student council election with over 2000 voters, the second a political party's election for choosing their leader. We present our findings, some of which were extracted from a survey we conducted during the first election. Overall, voters trusted the system and found it comfortable to use.
---
paper_title: Anonymous voting by two-round public discussion

paper_content:

In 2006, Hao and Zielinski proposed a two-round anonymous veto protocol (called AV-net), which provided exceptional efficiency compared to related techniques. In this study, the authors add a self-tallying function to the AV-net, making it a general-purpose voting protocol. The new protocol works in the same setting as the AV-net – it requires no trusted third parties or private channels, and participants execute the protocol by sending two-round public messages. Compared with related voting protocols in past work, this is significantly more efficient in terms of the number of rounds, computational cost and bandwidth usage.
---
paper_title: Every Vote Counts: Ensuring Integrity in Large-Scale Electronic Voting

paper_content:

This paper presents a new End-to-End (E2E) verifiable e-voting protocol for large-scale elections, called Direct Recording Electronic with Integrity (DRE-i). In contrast to all other E2E verifiable voting schemes, ours does not involve any Tallying Authorities (TAs). The design of DRE-i is based on the hypothesis that existing E2E voting protocols’ universal dependence on TAs is a key obstacle to their practical deployment. In DRE-i, the need for TAs is removed by applying novel encryption techniques such that after the election multiplying the ciphertexts together will cancel out random factors and permit anyone to verify the tally. We describe how to apply the DRE-i protocol to enforce the tallying integrity of a DRE-based election held at a set of supervised polling stations. Each DRE machine directly records votes just as the existing practice in the realworld DRE deployment. But unlike the ordinary DRE machines, in DRE-i the machine must publish additional audit data to allow public verification of the tally. If the machine attempts to cheat by altering either votes or audit data, then the public verification of the tallying integrity will fail. To improve system reliability, we further present a fail-safe mechanism to allow graceful recovery from the effect of missing or corrupted ballots in a publicly verifiable and privacy-preserving manner. Finally, we compare DRE-i with previous related voting schemes and show several improvements in security, efficiency and usability. This highlights the promising potential of a new category of voting systems that are E2E verifiable and TA-free. We call this new category “self-enforcing electronic voting”.
---
paper_title: Self-enforcing electronic voting

paper_content:

Verifiable electronic voting has been extensively researched for over twenty years, but few protocols have achieved real-life deployment. A key impediment, we argue, is caused by the existing protocols' universal reliance on the probity of the tallying authorities. This might seem surprising to many people as dependence on tallying authorities has been a de facto standard in the field. However, this dependence is actually a legacy inherited from traditional physical voting, one that has proved problematic in the electronic context. In this paper, we propose a radically new concept called "self-enforcing electronic voting", which refers to voting systems that are free from reliance on any tallying authority. This proposal goes significantly further than all existing or proposed e-voting systems. We explain the feasibility of this new approach, with a theoretical definition of the system properties, a concrete engineering design, a practical implementation, and real-world trial experiments. We also highlight some open issues for further research.
---
paper_title: A Gentle Introduction to Risk-Limiting Audits

paper_content:

Risk-limiting audits provide statistical assurance that election outcomes are correct by manually examining portions of the audit trail-paper ballots or voter-verifiable paper records. This article sketches two types of risk-limiting audits, ballot-polling audits and comparison audits, and gives example computations. These audits do not require in-house statistical expertise.
---
paper_title: Verifiable Classroom Voting : Where Cryptography Meets Pedagogy

paper_content:

In this paper, we propose – and have implemented – the first verifiable classroom voting system. The subject of secure classroom voting has so far received almost no attention from the security community. Though several commercial classroom voting systems have been available, none of them is verifiable. State-of-the-art verifiable voting protocols all rely on finding a set of trustworthy tallying authorities (who are essentially cryptographers and computer experts) in the first place, and hence are completely unsuitable for classroom voting. Our system design is based on “self-enforcing e-voting” – a new paradigm that was first presented at SPW’12 (Hao, Randell and Clarke). A self-enforcing e-voting scheme provides the same End-to-End (E2E) verifiability as other e-voting schemes but without involving any tallying authorities. The removal of tallying authorities brings several compelling advantages in real-world voting scenarios – here, classroom voting is just one example. We have piloted the use of the developed verifiable classroom voting system in real classroom teaching. Based on our preliminary trial experience, we believe the system is not only scientifically valuable, but also pedagogically useful.
---
paper_title: STAR-Vote: A Secure, Transparent, Auditable, and Reliable Voting System

paper_content:

STAR-Vote is a collaboration between a number of academics and the Travis County (Austin), Texas elections office, which currently uses a DRE voting system and previously used an optical scan voting system. STAR-Vote represents a rare opportunity for a variety of sophisticated technologies, such as end-to-end cryptography and risk limiting audits, to be designed into a new voting system, from scratch, with a variety of real world constraints, such as election-day vote centers that must support thousands of ballot styles and run all day in the event of a power failure. This paper describes the current design of STAR-Vote which is now largely settled and whose development will soon begin.
---
paper_title: Efficient maximal privacy in boardroom voting and anonymous broadcast

paper_content:

Most voting schemes rely on a number of authorities. If too many of these authorities are dishonest then voter privacy may be violated. To give stronger guarantees of voter privacy Kiayias and Yung [1] introduced the concept of elections with perfect ballot secrecy. In this type of election scheme it is guaranteed that the only thing revealed about voters’ choices is the result of the election, no matter how many parties are corrupt. Our first contribution is to suggest a simple voting scheme with perfect ballot secrecy that is more efficient than [1].
---
paper_title: Electing a university president using open-audit voting: Analysis of real-world use of Helios

paper_content:

In March 2009, the Universite catholique de Louvain elected its President using a custom deployment of the Helios web-based open-audit voting system. Out of 25,000 potential voters, 5000 registered, and almost 4000 voted in each round of the election. The precision of the voting system turned out to be crucial: in the first round, the leader came short of winning the election by only 2 votes. ::: ::: In this work, we document the new version of Helios used in this election, the specifics of the UCL deployment, and the lessons learned in this deployment. We offer suggestions on running future open-audit elections. We note at least one interesting conclusion: while it is often assumed that open-audit voting will lead to more complaints and potentially a denial-of-service attack on the auditing process, we found that, instead, complaints are likely to be more easily handled in open-audit elections because evidence and counter-evidence can be presented.
---
paper_title: An Internet Voting System Supporting User Privacy

paper_content:

This work introduces the ADDER system1 , an Internet-based, free and open source electronic voting system which employs strong cryptography. Our system is a fully functional e-voting platform and enjoys a number of security properties, such as robustness, trust distribution, ballot privacy, auditability and verifiability. It can readily implement and carry out various voting procedures in parallel and can be used for small scale boardroom/department-wide voting as well as largescale elections. In addition, ADDER employs a flexible voting scheme which allows the system to carry out procedures such as surveys or other data collection activities. ADDER offers a unique opportunity to study cryptographic voting protocols from a systems perspective and to explore the security and usability of electronic voting systems.
---
paper_title: Running mixnet-based elections with Helios

paper_content:

The Helios voting system is an open-audit web-based voting system that has been used by various institutions in real-stake elections during the last few years. While targeting the simplicity of the election workflow, the homomorphic tallying process used in Helios limits its suitability for many elections (large number of candidates, specific ballot filling rules,...). ::: ::: We present a variant of Helios that allows an efficient mixnet-based tallying procedure, and document the various choices we made in terms of election workflow and algorithm selection. In particular, we propose a modified version the TDH2 scheme of Shoup and Gennaro that we found particularly suitable for the encryption of the ballots. ::: ::: Our Helios variant has been tested in two multithousand voter elections. The lessons taken from the first of these elections motivated some changes into our procedure, which have been successfully experimented during the second election. Voter survey data are also presented.
---
paper_title: Receipt-Free Mix-Type Voting Scheme

paper_content:

We present a receipt-free voting scheme based on a mixtype anonymous channel[Cha81, PIK93]. The receipt-freeness property [BT94] enables voters to hide how they have voted even from a powerful adversary who is trying to coerce him. The work of [BT94] gave the first solution using a voting booth, which is a hardware assumption not unlike that in current physical elections. In our proposed scheme, we reduce the physical assumptions required to obtain receipt-freeness. Our sole physical assumption is the existence of a private channel through which the center can send the voter a message without fear of eavesdropping.
---
paper_title: Pretty good democracy for more expressive voting schemes

paper_content:

In this paper we revisit Pretty Good Democracy, a scheme for verifiable Internet voting from untrusted client machines. The original scheme was designed for first-past-the-post elections. Here, we show how Pretty Good Democracy can be extended to voting schemes in which the voter lists the candidates in their order of preference. Our scheme applies to elections using STV, IRV, Borda, or any other tallying scheme in which a vote is a list of candidates in preference order. We also describe an extension to cover Approval or Range voting.
---
paper_title: Caveat Coercitor: Coercion-Evidence in Electronic Voting

paper_content:

The balance between coercion-resistance, election verifiability and usability remains unresolved in remote electronic voting despite significant research over the last few years. We propose a change of perspective, replacing the requirement of coercion-resistance with a new requirement of coercion-evidence: there should be public evidence of the amount of coercion that has taken place during a particular execution of the voting system. We provide a formal definition of coercion-evidence that has two parts. Firstly, there should be a coercion-evidence test that can be performed against the bulletin board to accurately determine the degree of coercion that has taken place in any given run. Secondly, we require coercer independence, that is the ability of the voter to follow the protocol without being detected by the coercer. To show how coercion-evidence can be achieved, we propose a new remote voting scheme, Caveat Coercitor, and we prove that it satisfies coercion-evidence. Moreover, Caveat Coercitor makes weaker trust assumptions than other remote voting systems, such as JCJ/Civitas and Helios, and has better usability properties.
---
paper_title: Helios: Web-based Open-Audit Voting

paper_content:

Voting with cryptographic auditing, sometimes called open-audit voting, has remained, for the most part, a theoretical endeavor. In spite of dozens of fascinating protocols and recent ground-breaking advances in the field, there exist only a handful of specialized implementations that few people have experienced directly. As a result, the benefits of cryptographically audited elections have remained elusive. ::: ::: We present Helios, the first web-based, open-audit voting system. Helios is publicly accessible today: anyone can create and run an election, and any willing observer can audit the entire process. Helios is ideal for on-line software communities, local clubs, student government, and other environments where trustworthy, secret-ballot elections are required but coercion is not a serious concern. With Helios, we hope to expose many to the power of open-audit elections.
---
paper_title: Virtually Perfect Democracy

paper_content:

In the 2009 Security Protocols Workshop, the Pretty Good Democracy scheme was presented. This scheme has the appeal of allowing voters to cast votes remotely, e.g. via the Internet, and confirm correct receipt in a single session. The scheme provides a degree of end-to-end verifiability: receipt of the correct acknowledgement code provides assurance that the vote will be accurately included in the final tally. The scheme does not require any trust in a voter client device. It does however have a number of vulnerabilities: privacy and accuracy depend on vote codes being kept secret. It also suffers the usual coercion style threats common to most remote voting schemes.
---
paper_title: Zeus: Bringing Internet Voting to Greece

paper_content:

Zeus is an internet voting platform, in which all the steps of the voting process can be verified using well-established mathematical tools. It has been developed with the goal that the voters can be confident that their votes are counted correctly and their anonymity is guaranteed, without needing to trust the operators of Zeus that they do not behave improperly: the assurances provided by Zeus are at least as strong as those in traditional elections. Zeus has been used in more than 120 elections, involving more than 22000 voters, and is continuously in use. It has shown that it can be used when traditional elections cannot take place, due to hostile conditions, and is actively being developed and evolved.
---
paper_title: Selections: Internet voting with over-the-shoulder coercion-resistance

paper_content:

We present Selections, a new cryptographic voting protocol that is end-to-end verifiable and suitable for Internet voting. After a one-time in-person registration, voters can cast ballots in an arbitrary number of elections. We say a system provides over-the-shoulder coercion-resistance if a voter can undetectably avoid complying with an adversary that is present during the vote casting process. Our system is the first in the literature to offer this property without the voter having to anticipate coercion and precompute values. Instead, a voter can employ a panic password. We prove that Selections is coercion-resistant against a non-adaptive adversary.
---
paper_title: Civitas: Toward a Secure Voting System

paper_content:

Civitas is the first electronic voting system that is coercion-resistant, universally and voter verifiable, and suitable for remote voting. This paper describes the design and implementation of Civitas. Assurance is established in the design through security proofs, and in the implementation through information-flow security analysis. Experimental results give a quantitative evaluation of the tradeoffs between time, cost, and security.
---
paper_title: A new approach towards coercion-resistant remote e-voting in linear time

paper_content:

Remote electronic voting has attracted increasing attention in cryptographic research. A promising protocol presented by Juels et al. is currently widely discussed. Although it offers a remarkably high degree of coercion-resistance under reasonable assumptions, it can not be employed in practice due to its poor efficiency. The improvements that have been proposed either require stronger trust assumptions or turned out to be insecure. In this paper, we present an enhancement of the protocol, which runs in linear time without changing the underlying trust assumptions.
---
paper_title: Preventing Board Flooding Attacks in Coercion-Resistant Electronic Voting Schemes

paper_content:

This paper addresses the board flooding problem of Juels et al.’s coercion-resistant electronic voting scheme. A key property of this scheme is the possibility of casting invalid votes to the public board, which are indistinguishable from proper votes. Exactly this possibility is crucial for making the scheme coercion-resistant, but it also opens doors for flooding the board with an enormous amount of invalid votes, therefore spoiling the efficiency of the tallying process. To prevent such attacks, we present an adaption of the scheme in which each voter receives —in addition to the proper credential—some dummy credentials from the election registrars. Dummy credentials may be used to deceive possible coercers. The list of all dummy credentials is published along with the electoral register. Based on the electoral register and the list of dummy credentials, the system is now capable of making a distinction between invalid votes generated from dummy credentials and invalid votes generated from fake credentials. While the former are kept until the tallying phase, the latter are immediately rejected by the public board. If the public board additionally rejects all incoming duplicate votes, then its maximum size is bounded by the total number of issued credentials. This guarantees an efficient linear-time tallying phase even in case of a massive board flooding attack with a very large number of invalid votes. Although the solution presented in this paper does not yet entirely rule out vote selling or coercion, it makes it at least unbearable for the vast majority of voters.
---
paper_title: Coercion-resistant electronic elections

paper_content:

We introduce a model for electronic election schemes that involves a more powerful adversary than previous work. In particular, we allow the adversary to demand of coerced voters that they vote in a particular manner, abstain from voting, or even disclose their secret keys. We define a scheme to be coercion-resistant if it is infeasible for the adversary to determine if a coerced voter complies with the demands.A first contribution of this paper is to describe and characterize a new and strengthened adversary for coercion in elections. (In doing so, we additionally present what we believe to be the first formal security definitions for electronic elections of any type.) A second contribution is to demonstrate a protocol that is secure against this adversary. While it is clear that a strengthening of attack models is of theoretical relevance, it is important to note that our results lie close to practicality. This is true both in that we model real-life threats (such as vote-buying and vote-canceling), and in that our proposed protocol combines a fair degree of efficiency with an unusual lack of structural complexity. Furthermore, previous schemes have required use of an untappable channel throughout. Ours only carries the much more practical requirement of an anonymous channel during the casting of ballots, and an untappable channel during registration (potentially using postal mail).This extended abstract is a heavily truncated version of the full paper available at http://eprint.iacr.org/2002/165.
---
paper_title: Attacking and fixing Helios: An analysis of ballot secrecy

paper_content:

Helios 2.0 is an open-source web-based end-to-end verifiable electronic voting system, suitable for use in low-coercion environments. In this article, we analyse ballot secrecy in Helios and discover a vulnerability which allows an adversary to compromise the privacy of voters. The vulnerability exploits the absence of ballot independence in Helios and works by replaying a voter's ballot or a variant of it, the replayed ballot magnifies the voter's contribution to the election outcome and this magnification can be used to violated privacy. We demonstrate the practicality of the attack by violating a voter's privacy in a mock election using the software implementation of Helios. Moreover, the feasibility of an attack is considered in the context of French legislative elections and, based upon our findings, we believe it constitutes a real threat to ballot secrecy. We present a fix and show that our solution satisfies a formal definition of ballot secrecy using the applied pi calculus. Furthermore, we present similar vulnerabilities in other electronic voting protocols --namely, the schemes by Lee et al., Sako and Kilian and Schoenmakers --which do not assure ballot independence. Finally, we argue that independence and privacy properties are unrelated, and non-malleability is stronger than independence.
---
paper_title: Remotegrity: Design and Use of an End-to-End Verifiable Remote Voting System

paper_content:

We propose and implement a cryptographically end-to-end verifiable (E2E) remote voting system for absentee voters and report on its deployment in a binding municipal election in Takoma Park, Maryland. Remotegrity is a hybrid mail/internet extension to the Scantegrity in-person voting system, enabling secure, electronic return of vote-by-mail ballots. It provides voters with the ability to detect unauthorized modifications to their cast ballots made by either malicious client software, or a corrupt election authority--two threats not previously studied in combination. Not only can the voter detect such changes, they can prove it to a third party without giving up ballot secrecy.
---
paper_title: How not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios.

paper_content:

The Fiat-Shamir transformation is the most efficient construction of non-interactive zero-knowledge proofs. ::: ::: This paper is concerned with two variants of the transformation that appear but have not been clearly delineated in existing literature. Both variants start with the prover making a commitment. The strong variant then hashes both the commitment and the statement to be proved, whereas the weak variant hashes only the commitment. This minor change yields dramatically different security guarantees: in situations where malicious provers can select their statements adaptively, the weak Fiat-Shamir transformation yields unsound/unextractable proofs. Yet such settings naturally occur in systems when zero-knowledge proofs are used to enforce honest behavior. illustrate this point by showing that the use of the weak Fiat-Shamir transformation in the Helios cryptographic voting system leads to several possible security breaches: for some standard types of elections, under plausible circumstances, malicious parties can cause the tallying procedure to run indefinitely and even tamper with the result of the election. ::: ::: On the positive side, we define a form of adaptive security for zero-knowledge proofs in the random oracle model (essentially simulation-sound extractability), and show that a variant which we call strong Fiat-Shamir yields secure non-interactive proofs. This level of security was assumed in previous works on Helios and our results are then necessary for these analyses to be valid. Additionally, we show that strong proofs in Helios achieve non-malleable encryption and satisfy ballot privacy, improving on previous results that required CCA security.
---
paper_title: Usability of Voter Verifiable, End-to-end Voting Systems: Baseline Data for Helios, Prêt à Voter, and Scantegrity II

paper_content:

In response to voting security concerns, security researchers have developed tamper-resistant, voter verifiable voting methods. These end-to-end voting systems are unique because they give voters the option to both verify the system is working properly and to check that their votes have been recorded after leaving the polling place. While these methods solve many of the security problems surrounding voting with traditional methods, the systems' added complexity might adversely impact their usability. This paper presents an experiment assessing the usability of Helios, Pret a Voter, and Scantegrity II. Overall, the tested systems were exceptionally difficult to use. Data revealed that success rates of voters casting ballots on these systems were extraordinarily low. Specifically, only 58% of ballots were successfully cast across all three systems. There were reliable differences in voting completion times across the three methods, and these times were much slower than previously tested voting technologies. Subjective usability ratings differed across the systems, with satisfaction being generally low, but highest for Helios. Vote verification completion rates were even lower than those for vote casting. There were no reliable differences in ballot verification times across the three methods, but there were differences in satisfaction levels, with satisfaction being lowest for Helios. These usability findings— especially the extremely low vote casting completion rates—highlight that it is not enough for a system to be secure; every system must also be usable.
---
paper_title: Blinded additively homomorphic encryption schemes for self-tallying voting

paper_content:

In this paper, we propose a self-tallying election protocol based public key homomorphic encryption. The additive homomorphism allows a set of participants (voters) to publish an encrypted value (ballot) and to compute the encrypted sum of all these values based on their ciphertexts. Our scheme has the particularity that anyone can decrypt the sum, but only once all participants have contributed to its computation. More precisely, the sum can be decrypted at all times, but remains blinded until all participants have contributed their vote, which contains a share of the unblinding key. Additionally, we propose an adaptation of Helios in order to provide self-tallying.
---
paper_title: Trivitas: Voters directly verifying votes

paper_content:

Individual verifiability is the ability of an electronic voting system to convince a voter that his vote has been correctly counted in the tally. Unfortunately, in most electronic voting systems the proofs for individual verifiability are non-intuitive and, moreover, need trusted devices to be checked. Based on the remote voting system JCJ/Civitas, we propose Trivitas, a protocol that achieves direct and end-to-end individual verifiability, while at the same time preserving coercion-resistance. ::: ::: Our technical contributions rely on two main ideas, both related to the notion of credentials already present in JCJ/Civitas. Firstly, we propose the use of trial credentials, as a way to track and audit the handling of a ballot from one end of the election system to the other end, without increased complexity on the voter end. Secondly, due to indistinguishability of credentials from random values, we observe that the association between any credential and its corresponding vote can be made public at the end of the election process, without compromising coercion-resistance. The voter has more intuitive and direct evidence that her intended vote has not been changed and will be counted in the final tally.
---
paper_title: Improving helios with everlasting privacy towards the public

paper_content:

In this paper we propose improvements on the Helios voting protocol such that the audit data published by the authority provides everlasting privacy, as opposed to the computational privacy provided currently. We achieve this with minor adjustments to the current implementation. For the homomorphic Helios variant we use Pedersen commitments to encode the vote, together with homomorphic encryption over a separate, private channel between the user and Helios server to send the decommitment values. For the mix-net variant we apply a recent result which shows that mixing with everlasting privacy is possible. ::: ::: Observe that we do not claim everlasting privacy towards the server, which, if dishonest, could try to break the homomorphic encryption scheme used in the private channel. Thus towards the authority the voter's level of privacy is identical to what Helios currently offers. However, our protocol is much harder to attack by an outsider: apart from having to break the computational assumption, an adversary must intercept the communication between the voter and the server to violate ballot privacy of that voter. The feasibility of such an attack depends on the way both parties choose to implement this channel. Both contributions are generic in the sense that they can be applied to other voting protocols that use homomorphic tallying or mixnets.
---
paper_title: Pretty good democracy

paper_content:

Code voting seeks to address the issues of privacy and integrity for Remote Internet Voting. It sidesteps many of the inherent vulnerabilities of the Internet and client platforms but it does not provide end-to-end verification that votes are counted as cast. In this paper, we propose a simple technique to enhance the verifiability of code voting by ensuring that the Vote Server can only access the acknowledgement codes if the vote code is correctly registered by a threshold set of Trustees. The mechanism proposed here therefore adds an extra level of verifiability in registering and counting the vote. Voter-verification is simple and direct: the voters need only check that the acknowledgement code returned to them agrees with the value on their code sheet. To ensure receipt-freeness we propose the use of a single acknowledgement code per code sheet, rather than individual acknowledgement codes for each candidate with usual code voting.
---
paper_title: Pretty Understandable Democracy - A Secure and Understandable Internet Voting Scheme

paper_content:

Internet voting continues to raise interest. A large number of Internet voting schemes are available, both in use, as well as in research literature. While these schemes are all based on different security models, most of these models are not adequate for high-stake elections. Furthermore, it is not known how to evaluate the understandability of these schemes (although this is important to enable voters' trust in the election result). Therefore, we propose and justify an adequate security model and criteria to evaluate understandability. We also describe an Internet voting scheme, Pretty Understandable Democracy, show that it satisfies the adequate security model and that it is more understandable than Pretty Good Democracy, currently the only scheme that also satisfies the proposed security model.
---
paper_title: Civitas and the Real World: Problems and Solutions from a Practical Point of View

paper_content:

In the past, researchers have proposed manyvoting schemes that satisfy a wide range of security properties. These schemes often rely on strong trust assumptionsand do not consider the voter sufficiently, which currentlyrenders them inappropriate for usage in real-world elections. In this paper we focus on the voting scheme Civitas, whichfeatures provably strong security properties, such as end-toend verifiability and coercion-resistance. We identify the strongtrust assumptions and usability weaknesses of the scheme, which currently prevent its usage in real-world elections. Basedon these results, we show how most of these strong trustassumptions can be implemented, e.g., by using eID cards inorder to overcome Civitas' most critical usability problem, namely credential handling. Together with a voter-processdescription and a user-interface, we pave the way for the useof Civitas in real-world elections.
---
paper_title: Electing a university president using open-audit voting: Analysis of real-world use of Helios

paper_content:

In March 2009, the Universite catholique de Louvain elected its President using a custom deployment of the Helios web-based open-audit voting system. Out of 25,000 potential voters, 5000 registered, and almost 4000 voted in each round of the election. The precision of the voting system turned out to be crucial: in the first round, the leader came short of winning the election by only 2 votes. ::: ::: In this work, we document the new version of Helios used in this election, the specifics of the UCL deployment, and the lessons learned in this deployment. We offer suggestions on running future open-audit elections. We note at least one interesting conclusion: while it is often assumed that open-audit voting will lead to more complaints and potentially a denial-of-service attack on the auditing process, we found that, instead, complaints are likely to be more easily handled in open-audit elections because evidence and counter-evidence can be presented.
---
paper_title: VeryVote: A Voter Verifiable Code Voting System

paper_content:

Code voting is a technique used to address the secure platform problem of remote voting. A code voting system consists in secretly sending, e.g. by mail, code sheets to voters that map their choices to entry codes in their ballot. While voting, the voter uses the code sheet to know what code to enter in order to vote for a particular candidate. In effect, the voter does the vote encryption and, since no malicious software on the PC has access to the code sheet it is not able to change the voter's intention. However, without compromising the voter's privacy, the vote codes are not enough to prove that the vote is recorded and counted as cast by the election server. ::: ::: We present a voter verifiable code voting solution which, without revealing the voter's vote, allows the voter to verify, at the end of the election, that her vote was cast and counted as intended by just performing the match of a few small strings. Moreover, w.r.t. a general code voting system, our solution comes with only a minor change in the voting interaction.
---
paper_title: A Practical and Secure Coercion-Resistant Scheme for Internet Voting

paper_content:

Juels, Catalano, and Jakobsson (JCJ) proposed at WPES 2005 the first voting scheme that considers real-world threats and that is more realistic for Internet elections. Their scheme, though, has a quadratic work factor and thereby is not efficient for large scale elections. Based on the work of JCJ, Smith proposed an efficient scheme that has a linear work factor. In this paper we first show that Smith's scheme is insecure. Then we present a new coercion-resistant election scheme with a linear work factor that overcomes the flaw of Smith's proposal. Our solution is based on the group signature scheme of Camenisch and Lysyanskaya (Crypto 2004).
---
paper_title: Exploiting the Client Vulnerabilities in Internet E-voting Systems: Hacking Helios 2.0 as an Example

paper_content:

Helios is a web-based open-audit voting system designed using state of the art web technologies and advanced cryptographic techniques to provide integrity of ballots and voter secrecy in an insecure Internet environment. In this paper, we demonstrate a simple attack against Helios 2.0 that takes advantage of the fact that every candidate in Helios can provide a URL referring to his/her candidacy statement. A malicious candidate, who wishes to win a Helios-managed election, uploads a specially crafted PDF file containing a candidacy statement to his/her website. The attack is then triggered against each voter who is using a vulnerable machine. The security of the machine is undermined, e.g., when the voter visits the attacker's webpage. In essence, we exploit Adobe Acrobat/Reader's vulnerabilities to install a malicious browser extension on the voters' machines. Such an extension provides an opportunity for an attacker which may fool the voter (using Social Engineering) into accepting a hacked ballot. Due to our attack Helios 2.0 was upgraded to Helios 3.0. We discuss generalizations and the impact of the latest upgrade of Helios on security. We also discuss defences against this attack, generalizations and the impact of the latest upgrade of Helios on security.
---
paper_title: Adapting Helios for provable ballot privacy

paper_content:

Recent results show that the current implementation of Helios, a practical e-voting protocol, does not ensure independence of the cast votes, and demonstrate the impact of this lack of independence on vote privacy. Some simple fixes seem to be available and security of the revised scheme has been studied with respect to symbolic models. ::: ::: In this paper we study the security of Helios using computational models. Our first contribution is a model for the property known as ballot privacy that generalizes and extends several existing ones. ::: ::: Using this model, we investigate an abstract voting scheme (of which the revised Helios is an instantiation) built from an arbitrary encryption scheme with certain functional properties. We prove, generically, that whenever this encryption scheme falls in the class of voting-friendly schemes that we define, the resulting voting scheme provably satisfies ballot privacy. ::: ::: We explain how our general result yields cryptographic security guarantees for the revised version of Helios (albeit from non-standard assumptions). ::: ::: Furthermore, we show (by giving two distinct constructions) that it is possible to construct voting-friendly encryption, and therefore voting schemes, using only standard cryptographic tools. We detail an instantiation based on ElGamal encryption and Fiat-Shamir noninteractive zero-knowledge proofs that closely resembles Helios and which provably satisfies ballot privacy.
---
paper_title: Clash Attacks on the Verifiability of E-Voting Systems

paper_content:

Verifiability is a central property of modern e-voting systems. Intuitively, verifiability means that voters can check that their votes were actually counted and that the published result of the election is correct, even if the voting machines/authorities are (partially) untrusted. In this paper, we raise awareness of a simple attack, which we call a clash attack, on the verifiability of e-voting systems. The main idea behind this attack is that voting machines manage to provide different voters with the same receipt. As a result, the voting authorities can safely replace ballots by new ballots, and by this, manipulate the election without being detected. This attack does not seem to have attracted much attention in the literature. Even though the attack is quite simple, we show that, under reasonable trust assumptions, it applies to several e-voting systems that have been designed to provide verifiability. In particular, we show that it applies to the prominent Three Ballot and VAV voting systems as well as to two e-voting systems that have been deployed in real elections: the Wombat Voting system and a variant of the Helios voting system. We discuss countermeasures for each of these systems and for (various variants of) Helios provide a formal analysis based on a rigorous definition of verifiability. More precisely, our analysis of Helios is with respect to the more general and in the area of e-voting often overlooked notion of accountability.
---
paper_title: Towards A Practical JCJ / Civitas Implementation ∗

paper_content:

Internet voting continues to enjoy wide interest from both research and practice. Among the Internet voting schemes developed over the last decades, JCJ / Civitas stands out from the masses due to its innovative approach to resist voter coercion. To achieve its ambitious goal, the scheme builds upon particularly restrictive assumptions and an abstract credential handling rendering the scheme impractical for real-world use. At ARES 2012, Neumann and Volkamer presented a proposal which implements several of these assumptions (voter-side assumptions) and the credential handling by the use of smart cards. While addressing these practical shortcomings of JCJ / Civitas, their proposal did not take performance into account, and accordingly its performance has not been evaluated. In the present work, we revise the ARES proposal from a performance perspective in a security-invariant manner. Based on the herein proposed revisions, we are able to conclude that the revised ARES proposal is feasible to be used in real-world elections.
---
paper_title: Hover: Trustworthy Elections with Hash-Only Verification

paper_content:

Hover (Hash-Only Verification), an end-to-end (E2E) verifiable voting system with distributed trust, uses only a collision-resistant hash function for verification. Such verification could make E2E elections more accessible to people without a strong cryptography background.
---
paper_title: Voting technologies and trust

paper_content:

The authors' propose manual voting systems that have significant security advantages over existing systems, yet retain the simplicity and familiarity that has led to widespread acceptance. The authors also discuss ways to improve efficiency without endangering this public trust
---
paper_title: Eperio: Mitigating Technical Complexity in Cryptographic Election Verification ∗

paper_content:

Cryptographic (or end-to-end) election verification is a promising approach to providing transparent elections in an age of electronic voting technology. In terms of execution time and software complexity however, the technical requirements for conducting a cryptographic election audit can be prohibitive. In an effort to reduce these requirements we present Eperio: a new, provably secure construction for providing a tally that can be efficiently verified using only a small set of primitives. We show how common-place utilities, like the use of file encryption, can further simplify the verification process for election auditors. Using Python, verification code can be expressed in 50 lines of code. Compared to other proposed proof-verification methods for end-to-end election audits, Eperio lowers the technical requirements in terms of execution time, data download times, and code size. As an interesting alternative, we explain how verification can be implemented using True-Crypt and the built-in functions of a spreadsheet, making Eperio the first end-to-end system to not require special-purpose verification software.
---
paper_title: Three Voting Protocols: ThreeBallot, VAV, and Twin

paper_content:

We present three new paper-based voting methods with interesting security properties. Our goal is to achieve the same security properties as recently proposed cryptographic voting protocols, but using only paper ballots and no cryptography. From a security viewpoint we get reasonably close, particularly for short ballots. However, our proposals should probably be considered as more "academic" than "practical." ::: ::: In these proposals, not only can each voter verify that her vote is recorded as intended, but she gets a "receipt" she can take home that can be used later to verify that her vote is actually included in the final tally. But her receipt does not allow her to prove to anyone else how she voted. All ballots cast are scanned and published in plaintext on a "public bulletin board" (web site), so anyone may correctly compute the election result. ::: ::: In ThreeBallot, each voter casts three paper ballots, with certain restrictions on how they may be filled out. These paper ballots are of course "voter-verifiable." ::: ::: A voter receives a copy of one of her ballots as her "receipt", which she may take home. Only the voter knows which ballot she copied for her receipt. The voter is unable to use her receipt to prove how she voted or to sell her vote, as the receipt doesn't reveal how she voted. ::: ::: A voter can check that the web site contains a ballot matching her receipt. Deletion or modification of ballots is thus detectable; so the integrity of the election is verifiable. ::: ::: VAV is like ThreeBallot, except that the ballot-marking rules are different: one ballot may "cancel" another (VAV = Vote/Anti-Vote/Vote). VAV is better suited to - i.e. yields better security properties for - Plurality and preference (Borda, Condorcet, IRV) voting, while ThreeBallot is better suited for Approval and Range voting. ::: ::: Finally, we introduce "Floating Receipts," wherein voters may take home a copy of another voter's ballot. (She doesn't know whose ballot, though.) Floating Receipts are well-tuned to the security requirements of ThreeBallot-like schemes, and we examine protocols for achieving them. ::: ::: Our final voting system, Twin, is based almost entirely on Floating Receipts. Each voter casts a single ballot and takes home a single receipt. Twin is quite simple and close to being practical.
---
paper_title: Attacking Paper-Based E2E Voting Systems

paper_content:

In this paper, we develop methods for constructing vote-buying/coercion attacks on end-to-end voting systems, and describe vote-buying/coercion attacks on three proposed end-to-end voting systems: Punchscan, Pret-a-voter, and ThreeBallot. We also demonstrate a different attack on Punchscan, which could permit corrupt election officials to change votes without detection in some cases. Additionally, we consider some generic attacks on end-to-end voting systems.
---
paper_title: Aperio: High Integrity Elections for Developing Countries

paper_content:

This article presents an ‘end-to-end' integrity verification mechanism for use in minimally equipped secret paper-ballot election environments. The scheme presented in this paper achieves high integrity properties without interfering with the traditional marking and tabulation procedures of paper-ballot elections. Officials and auditors can respectively generate and independently verify ‘end-to-end' audit trails, with office stationery and entirely without cryptographic or mathematic computations.
---
paper_title: Tamper-evident, history-independent, subliminal-free data structures on PROM storage -or- how to store ballots on a voting machine

paper_content:

We enumerate requirements and give constructions for the vote storage unit of an electronic voting machine. In this application, the record of votes must survive even an unexpected failure of the machine; hence the data structure should be durable. At the same time, the order in which votes are cast must be hidden to protect the privacy of voters, so the data structure should be history-independent. Adversaries may try to surreptitiously add or delete votes from the storage unit after the election has concluded, so the storage should be tamper-evident. Finally, we must guard against an adversarial voting machine's attempts to mark ballots through the representation of the data structure, so we desire a subliminal-free representation. We leverage the properties of Programmable Read Only Memory (PROM), a special kind of write-once storage medium, to meet these requirements. We give constructions for data structures on PROM storage that simultaneously satisfy all our desired properties. Our techniques can significantly reduce the need to verify code running on a voting machine.
---
paper_title: Preventing Board Flooding Attacks in Coercion-Resistant Electronic Voting Schemes

paper_content:

This paper addresses the board flooding problem of Juels et al.’s coercion-resistant electronic voting scheme. A key property of this scheme is the possibility of casting invalid votes to the public board, which are indistinguishable from proper votes. Exactly this possibility is crucial for making the scheme coercion-resistant, but it also opens doors for flooding the board with an enormous amount of invalid votes, therefore spoiling the efficiency of the tallying process. To prevent such attacks, we present an adaption of the scheme in which each voter receives —in addition to the proper credential—some dummy credentials from the election registrars. Dummy credentials may be used to deceive possible coercers. The list of all dummy credentials is published along with the electoral register. Based on the electoral register and the list of dummy credentials, the system is now capable of making a distinction between invalid votes generated from dummy credentials and invalid votes generated from fake credentials. While the former are kept until the tallying phase, the latter are immediately rejected by the public board. If the public board additionally rejects all incoming duplicate votes, then its maximum size is bounded by the total number of issued credentials. This guarantees an efficient linear-time tallying phase even in case of a massive board flooding attack with a very large number of invalid votes. Although the solution presented in this paper does not yet entirely rule out vote selling or coercion, it makes it at least unbearable for the vast majority of voters.
---
paper_title: The Append-Only Web Bulletin Board

paper_content:

A large number of papers on verifiable electronic voting that have appeared in the literature in recent years have relied heavily on the availability of an append-only web bulletin board . Despite this widespread requirement, however, the notion of an append-only web bulletin board remains somewhat vague, and no method of constructing such a bulletin board has been proposed. ::: ::: This paper fills the gap. We identify the required properties of an append-only web bulletin board, and introduce the concept of certified publishing of messages to the board. We show how such a board can be constructed in order to satisfy the properties we have identified. ::: ::: Finally, we consider how to extend the scheme to make the web bulletin board robust and able to offer assurance to writers of the inclusion of their messages. ::: ::: Although the work presented here has been inspired and motivated by the requirements of electronic voting systems, the web bulletin board is sufficiently general to allow use in other contexts.
---
paper_title: Cryptographic Methods for Storing Ballots on a Voting Machine

paper_content:

A direct recording electronic (DRE) voting machine must satisfy several requirements to ensure voter privacy and the integrity of the election. A recent proposal for a vote storage system due to Molnar et al. provides tamper-evidence properties while maintaining voter privacy by storing ballots on a programmable, read-only memory (PROM). We achieve the same properties and protect against additional threats of memory replacement through cryptographic techniques, without the use of special hardware. Our approach is based on a new cryptographic primitive called HistoryHiding Append-Only Signatures.
---
paper_title: A modular voting architecture (“frog voting”)

paper_content:

This paper presents a new framework–a reference architecture–for voting that we feel has many attractive features. It is not a machine design, but rather a framework that will stimulate innovation and design. It is potentially the standard architecture for all future voting equipment. The ideas expressed here are subject to improvement and further research. ::: ::: An early version of this paper appeared in [2]. This version of the paper is very similar, but contains a postscript (Section 8) providing commentary and discussion of perspectives on this proposal generated during the intervening years between 2001 and 2008.
---
paper_title: On the notion of ‘software independence’ in voting systems

paper_content:

This paper defines and explores the notion of software independence in voting systems: A voting system is software independent if an (undetected) change or error in its software cannot cause an und...
---
paper_title: True Trustworthy Elections: Remote Electronic Voting Using Trusted Computing

paper_content:

We present a new remote, coercion-resistant electronic voting protocol which satisfies a number of properties previously considered contradictory. We introduce trusted computing as a method of ensuring the trustworthiness of remote voters, and provide an extension to our protocol allowing revocable anonymity, on the grounds of it being a legal requirement in the United Kingdom.
---
paper_title: Trustworthy Voting: From Machine to System

paper_content:

The authors describe an electronic voting approach that takes a system view, incorporating a trustworthy process based on open source software, simplified procedures, and built-in redundant safeguards that prevent tampering.
---
paper_title: Cryptographic voting protocols: A systems perspective

paper_content:

Cryptographic voting protocols offer the promise of verifiable voting without needing to trust the integrity of any software in the system. However, these cryptographic protocols are only one part of a larger system composed of voting machines, software implementations, and election procedures, and we must analyze their security by considering the system in its entirety. In this paper, we analyze the security properties of two different cryptographic protocols, one proposed by Andrew Neff and another by David Chaum. We discovered several potential weaknesses in these voting protocols which only became apparent when considered in the context of an entire voting system. These weaknesses include: subliminal channels in the encrypted ballots, problems resulting from human unreliability in cryptographic protocols, and denial of service. These attacks could compromise election integrity, erode voter privacy, and enable vote coercion. Whether our attacks succeed or not will depend on how these ambiguities are resolved in a full implementation of a voting system, but we expect that a well designed implementation and deployment may be able to mitigate or even eliminate the impact of these weaknesses. However, these protocols must be analyzed in the context of a complete specification of the system and surrounding procedures before they are deployed in any large-scale public election.
---
paper_title: Performance Requirements for End-to-End Verifiable Elections

paper_content:

The term "end-to-end verifiability" has been used over the past several years to describe multiple voting system proposals. The term has, however, never been formally defined. As a result, its meaning tends to change from voting system to voting system. We propose a definition for end-to-end verifiability of public elections based on performance requirements, as opposed to design requirements. We suggest a set of properties that collectively define the term. The properties help detect some of the possible problems that may influence the integrity of the election outcome.
---
paper_title: Independent Computations for Safe Remote Electronic Voting

paper_content:

In a world where a high percentage of citizens carry a smart phone or iPod and most households have one or more computers, it is difficult to understand why we have not been able to leverage powerful personal computing devices to allow citizens to cast their ballots electronically. The argument turns on security weakness in all kinds of network computing and on theoretical limits on the ability to protect critical applications.
---
paper_title: Mental Models of Verifiability in Voting

paper_content:

In order for voters to verify their votes, they have to carry out additional steps besides selecting a candidate and submitting their vote. In previous work, voters have been found to be confused about the concept of and motivation for verifiability in electronic voting when confronted with it. In order to better communicate verifiability to voters, we identify mental models of verifiability in voting using a questionnaire distributed online in Germany. The identified mental models are, Trusting, No Knowledge, Observer, Personal Involvement and Matching models. Within the same survey, we identify terms that can be used in place of 'verify' as well as security-relevant metaphors known to the voters that can be used to communicate verifiability.
---
paper_title: Improving the Usability and Accessibility of Voting Systems and Products | NIST

paper_content:

Despite the fact that the U.S. Election Assistance Commission (EAC) was established in mid-December 2003, and therefore missed the October 2003 statutory deadline for this report, we were able to focus early on this task and the research that NIST had completed. The resulting report describes the findings of that study. It also presents a set of recommended actions that, if implemented, should improve the usability and accessibility of voting products and systems.
---
paper_title: DIFFUSION OF VOTER RESPONSIBILITY: POTENTIAL FAILINGS IN E2E VOTER RECEIPT CHECKING

paper_content:

End-to-end verifiable (E2E) voting systems provide voters with (privacy preserving) receipts of their ballots allowing them to check that their votes were correctly included in the final tally. A number of recent studies and field tests have examined the usability of ballot casting and receipt checking. Simply checking receipts, however, is not enough to provide strong assurance that the election outcome is correct; voters must also be counted on to report any discrepancies between their receipts and the official record when they occur. In this paper we designed and ran a study examining the frequency and conditions under which voters (a) check their receipts, and (b) report discrepancies when they occur. Participants were recruited online and were asked to vote in a survey on charitable giving. Similar to previous work, we found that the proportion of voters performing a receipt check was low. More importantly, within this group, we found that the proportion of voters reporting discrepancies was also low. We did however observe that the incidence of receipt checking was significantly higher when the election outcome was unanticipated or unexpected by voters. In the condition with an adverse election result we observed that, while 7.5% of voters checked receipts, only 0.5% filed a dispute when shown an incorrect receipt. With such low reporting rates, E2E voting systems will struggle to detect fraud with high confidence, especially in elections with narrow margins of victory. We posit, therefore, that improving the usability of the receipt check component in E2E systems is an important open problem.
---
paper_title: Pressing the button for European elections: verifiable e-voting and public attitudes toward internet voting in Greece

paper_content:

We present the initial set of findings from a pilot experiment that used an Internet-based end-to-end verifiable evoting system and was held during the European Elections 2014 in Athens, Greece. During the experiment, which took place on May 25th 2014, 747 people voted with our system in special voting stations that were placed outside two main polling places in Athens, Greece. The election mimicked the actual election that was taking place which included a great number of parties. After casting their ballot, voters were invited to complete online a postelection questionnaire that probed their attitudes towards evoting. In total, 648 questionnaires were collected. We present a description of the experiment and a regression analysis of our results. Our results suggest that acceptance of the e-voting system was particularly high especially among the most educated, the technologically adept but also –somewhat surprisingly– older generations.
---
paper_title: Enhancing Electronic Voting Machines on the Example of Bingo Voting

paper_content:

The main purpose of cryptographic voting schemes is to provide transparency while protecting ballot secrecy and to enable a fast tally. In this paper, we address three major issues of cryptographic voting schemes. First we discuss the problem of secrecy and coercion resistance in the situation of a corrupted voting machine. While hard to obtain in general, we propose and analyze a novel approach that uses encapsulated design and minimizes the information that can compromise ballot secrecy. The second issue we address is the assumption that an adversary does not know which receipts are checked and the problem of receipt stealing. Many voting schemes with receipts share this vulnerability. We provide a solution that increases protection of each vote and which can be generalized for voting schemes that use computers to form the receipt. The last issue discussed in this paper is the question of how an election can be contested. For this, an error or a manipulation must not only be detected but also proven. While the problems and solutions are described for Bingo Voting, we argue that the problems are shared by many cryptographic voting schemes and that the solutions presented in this work give insight in the prerequisites needed for a secure election.
---
paper_title: Stamp-It: A Method for Enhancing the Universal Verifiability of E2E Voting Systems

paper_content:

Existing proposals for end-to-end independently-verifiable (E2E) voting systems require that voters check the presence of a "receipt" on a secure bulletin board. The tally is then computed from all the receipts. Anyone can determine that the computation is correct-- that is, the computation of the tally from the receipts is universally-verifiable. The fraud detection probability depends on the number of voters checking their receipts and the number of votes modified. This paper proposes an enhancement, Stamp-It, that does not require voters to check published receipts. It allows anyone to determine whether the tally is correctly computed, with probability independent of the number of voters who checked their receipt, extending the universal verifiability of the process. It does not require any additional computations to be performed during the election, and is hence very well-suited for use with the paper-ballot-based E2E systems. Finally, as an add-on, the enhancement does not degrade the original scheme.
---
paper_title: Usability of Voter Verifiable, End-to-end Voting Systems: Baseline Data for Helios, Prêt à Voter, and Scantegrity II

paper_content:

In response to voting security concerns, security researchers have developed tamper-resistant, voter verifiable voting methods. These end-to-end voting systems are unique because they give voters the option to both verify the system is working properly and to check that their votes have been recorded after leaving the polling place. While these methods solve many of the security problems surrounding voting with traditional methods, the systems' added complexity might adversely impact their usability. This paper presents an experiment assessing the usability of Helios, Pret a Voter, and Scantegrity II. Overall, the tested systems were exceptionally difficult to use. Data revealed that success rates of voters casting ballots on these systems were extraordinarily low. Specifically, only 58% of ballots were successfully cast across all three systems. There were reliable differences in voting completion times across the three methods, and these times were much slower than previously tested voting technologies. Subjective usability ratings differed across the systems, with satisfaction being generally low, but highest for Helios. Vote verification completion rates were even lower than those for vote casting. There were no reliable differences in ballot verification times across the three methods, but there were differences in satisfaction levels, with satisfaction being lowest for Helios. These usability findings— especially the extremely low vote casting completion rates—highlight that it is not enough for a system to be secure; every system must also be usable.
---
paper_title: Voter, What Message Will Motivate You To Verify Your Vote?

paper_content:

There is increasing interest in verifiable Internet voting systems that enable voters to verify the integrity of their vote on the voting platform prior to casting it, and any interested party to verify the integrity of the election results. The ease with which a vote can be verified plays a key role. Empowering individual voters to act as interested yet objective verifiers increases the probability of fraud detection. Verifying constitutes additional effort, something humans resist unless the benefits are compelling enough. Thus, what is the best way to provide such motivation? We report on a survey, distributed to 123 respondents, in which we explore the effects of three types of motivating messages on voters’ intention to verify a vote, using a smartphone app. The motivating messages were intended to increase the intention to verify a vote. Our findings have persuaded us that further research on the use of motivating messages in the context of verifiable voting is warranted.
---
paper_title: Usability analysis of helios - an open source verifiable remote electronic voting system

paper_content:

Currently, rather secure cryptographic voting protocols providing verifiability exist. However, without adequate usability and abstraction concepts to explain the voting process and, in particular, the verifiability steps, they are not ready for legally binding elections. This holds in particular for remote electronic voting systems because of the absence of poll workers who can support voters by explaining single steps. In this paper, the usability of the ballot casting and verifiability procedures of the Helios open source end to end verifiable remote electronic voting system is analyzed using the cognitive walkthrough approach by security, electronic voting and usability experts. We demonstrate the need for improvements to the usability and verifiability of Helios, before it is used in large scale elections outside of an academic context. Based on our results, we propose new interfaces for improved usability of Helios and future end to end verifiable electronic voting systems.
---
paper_title: Scratch & vote: self-contained paper-based cryptographic voting

paper_content:

We present Scratch & Vote (S&V), a cryptographic voting system designed to minimize cost and complexity: (1) ballots are paper-based and can be printed using today’s technology, (2) ballots are universally verifiable without electionofficial intervention, and (3) tallying requires only one trustee decryption per race, thanks to homomorphic aggregation. Scratch & Vote combines the multi-candidate election techniques of Baudron et al. with the ballot-casting simplicity of Chaum and Ryan’s paper-based techniques. In addition, S&V allows each voter to participate directly in the audit process on election day, prior to casting their own ballot.
---
paper_title: Electronic Elections: The Perils and Promises of Digital Democracy

paper_content:

LIST OF ILLUSTRATIONS vii PREFACE ix CHAPTER 1: What This Book Is About 1 CHAPTER 2: Paper Problems, Electronic Promises 12 CHAPTER 3: Criticisms of Electronic Voting 30 CHAPTER 4: The Frame Game 50 CHAPTER 5: One Step Forward, Two Steps Back 71 CHAPTER 6: The Performance of the Machines 100 CHAPTER 7: Public Acceptance of Electronic Voting 133 CHAPTER 8: A New Paradigm for Assessing Voting Technologies 156 CHAPTER 9: Conclusion 178 NOTES 191 BIBLIOGRAPHY 207 INDEX 217
---
paper_title: Online voting: a legal perspective

paper_content:

Casting a vote for the European Parliament from a cybercafe in India, a cruise ship in the Atlantic Ocan, a weekend cottage in the Alps or plainly at home from your laptop computer? This article tackles this question from a legal point of view. It examines the basic principles surrounding online voting. Are the conditions for democratic elections – such as the freedom to vote without undue influence or coercion of any kind, the secrecy of the vote, the integrity, reliability and security of the ballot box, the verifiability and audit ability of the voting process and the principle of one person, one vote – sufficiently met or do we run into legal obstacles? Does the introduction of an electronic or even online voting process jeopardize the principles of non‐discriminatory access to the election process? And what about the anonymity? How can one guarantee that a vote over the Internet is cast by the legitimate voter, all the while guaranteeing his privacy? The last chapter of the article analyses the curre...
---
paper_title: Toward Risk Assessment of Large-Impact and Rare Events

paper_content:

Traditional risk assessment methods underestimate the risks of large-impact, hard-to-predict, and rare events in information systems. An alternative approach extends these methods to better evaluate risks associated with black and gray swans.
---

```
<format>
Title: An Overview of End-to-End Verifiable Voting Systems

Section 1: Introduction
Description 1: Provide an introduction to the history and evolution of cryptographic voting systems, highlighting key factors that spurred academic and practical interest in securing electronic elections.

Section 2: Security Properties of Voting Systems
Description 2: Describe key security properties characterizing E2E voting systems and discuss how these properties contribute to the integrity and privacy of elections.

Section 3: Vote Privacy
Description 3: Explain the importance of vote privacy and discuss various properties such as Ballot Secrecy, Receipt-freeness, and Coercion-Resistance.

Section 4: Vote Verifiability
Description 4: Discuss different forms of verifiability, including individual and universal verifiability, and explain how E2E voting systems ensure cast-as-intended, recorded-as-cast, and tallied-as-recorded verifiability.

Section 5: Other Properties
Description 5: List and describe additional important properties in voting systems, including Eligibility verifiability, Accountability, Robustness, Usability, and Accessibility.

Section 6: Conflicts and Challenges
Description 6: Discuss conflicts between key properties and the resulting technical and legal challenges that affect the deployment of E2E voting systems.

Section 7: Cryptographic E2E Voting Systems
Description 7: Describe notable E2E voting systems that rely on cryptography to guarantee verifiability, categorizing them based on their ballot formats and modes of deployment.

Section 8: Precinct-based Voting with Physical Ballots
Description 8: Provide an overview of precinct-based voting systems with physical ballots, detailing specific systems such as Votegrity, Prêtà Voter, Punchscan, Scantegrity, and Scratch & Vote.

Section 9: Precinct-based Voting with Electronic Ballots
Description 9: Discuss systems where electronic votes are cast and tallied in a precinct-based setting, including MarkPledge, Bingo Voting, Voter Initiated Auditing, and VoteBox.

Section 10: Remote Voting with Electronic Ballots
Description 10: Detail systems that enable voters to cast electronic votes over the Internet, covering systems like Adder, JCJ/Civitas, Helios, Pretty Good Democracy, and Remotegrity.

Section 11: Non-cryptographic E2E Voting Systems
Description 11: Explore E2E systems that do not rely on cryptography, including systems such as ThreeBallot, VAV, Twin, and Aperio.

Section 12: The Way Forward for E2E Voting Systems
Description 12: Discuss the path forward for E2E voting systems, addressing pressing technical issues, usability concerns, and legal dilemmas that need to be resolved.

Section 13: Technical Issues
Description 13: Describe implementation security flaws and guidance on how to address these in the development of secure E2E voting systems.

Section 14: Usability
Description 14: Discuss the usability of E2E voting systems, emphasizing the importance of voters being able to successfully cast and verify their votes.

Section 15: Legal Framework
Description 15: Identify the legal and regulatory frameworks necessary to support the introduction and operation of E2E voting systems.

Section 16: Uptake of E2E Voting Systems
Description 16: Analyze factors influencing the uptake of E2E voting systems and discuss strategies to foster their adoption.

Section 17: Conclusion
Description 17: Provide a comprehensive conclusion summarizing the state of E2E voting systems, their potential to restore trust in elections, and the importance of continued development and research in the field.
</format>
```