1. Practical Aspects of Modern Cryptography
Josh Benaloh
Brian LaMacchia
John Manferdelli

2. Fun with Public-Key Tonight we’ll …
Introduce some basic tools of public-key crypto
Combine the tools to create more powerful tools
Apply these tools to a grand application: doing elections “right”
Practical Aspects of Modern Cryptography
September 18, 2018

3. Interactive Proofs and Zero Knowledge
There are non-traditional methods of convincing others that something is true without writing down a proof.
These methods can be used to convince others of the veracity of partial information about a secret.
Practical Aspects of Modern Cryptography
September 18, 2018

4. Traditional Proofs I want to convince you that something is true.
I write down a proof and give it to you.
Practical Aspects of Modern Cryptography
September 18, 2018

5. Interactive Proofs
We engage in a dialogue at the conclusion of which you are convinced that my claim is true.
Practical Aspects of Modern Cryptography
September 18, 2018

6. Graph Isomorphism Practical Aspects of Modern Cryptography
September 18, 2018

7. Graph Isomorphism B C A E D Practical Aspects of Modern Cryptography
September 18, 2018

8. Graph Isomorphism B C A A E D C D B E
Practical Aspects of Modern Cryptography
September 18, 2018

9. Zero-Knowledge Interactive Proof
Practical Aspects of Modern Cryptography
September 18, 2018

10. ZKIP of Graph Isomorphism
Generate, say, 100 additional graphs isomorphic to G1 (and therefore also isomorphic to G2).
Practical Aspects of Modern Cryptography
September 18, 2018

11. ZKIP of Graph Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

12. ZKIP of Graph Isomorphism
Accept a single bit challenge “L/R” for each of the 100 additional graphs.
Display the indicated isomorphism for each of the additional graphs
Practical Aspects of Modern Cryptography
September 18, 2018

13. ZKIP of Graph Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

14. ZKIP of Graph IsomorphismL H2 R H3 G1 R G2
H100 L
Practical Aspects of Modern Cryptography
September 18, 2018

15. ZKIP of Graph Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

16. ZKIP of Graph Isomorphism
If graphs G1 and G2 were not isomorphic, then the “prover” would not be able to show any additional graph to be isomorphic to both G1 and G2.
A successful false proof would require the prover to guess all 100 challenges in advance: probability 1 in 2100.
Practical Aspects of Modern Cryptography
September 18, 2018

17. Fiat-Shamir Heuristic
Instead of challenge bits being externally generated, they can be produced by applying a one-way hash function to the full set of additional graphs.
This allows a ZKIP to be “published” without need for interaction.
Practical Aspects of Modern Cryptography
September 18, 2018

18. ZKIP of Graph Non-Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

19. ZKIP of Graph Non-Isomorphism
A verifier can generate 100 additional graphs, each isomorphic to one of G1 and G2 , and present them to the prover.
The prover can then demonstrate that the graphs are not isomorphic by identifying which of G1 and G2 each additional graph is isomorphic to.
Practical Aspects of Modern Cryptography
September 18, 2018

20. ZKIP of Graph Non-Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

21. ZKIP of Graph Non-Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

22. ZKIP of Graph Non-Isomorphism
Practical Aspects of Modern Cryptography
September 18, 2018

23. Proving Something is a Square
Suppose I want to convince you that Y is a square modulo N.
[There exists an X such that Y = X2 mod N.]
Practical Aspects of Modern Cryptography
September 18, 2018

24. Proving Something is a Square
Suppose I want to convince you that Y is a square modulo N.
[There exists an X such that Y = X2 mod N.]
First approach: I give you X.
Practical Aspects of Modern Cryptography
September 18, 2018

25. An Interactive Proof Y Y1 Y2 Y3 Y4 Y5 Y100
Practical Aspects of Modern Cryptography
September 18, 2018

26. An Interactive Proof Y Y1 Y2 Y3 Y4 Y5 Y100 1 1 11 1 1
Practical Aspects of Modern Cryptography
September 18, 2018

27. An Interactive Proof Y Y1 Y2 Y3 Y4 Y5 Y100 1 1 1 √Y1 √Y3 √Y41 1 1
√Y1
√Y3
√Y4
Practical Aspects of Modern Cryptography
September 18, 2018

28. An Interactive Proof Y Y1 Y2 Y3 Y4 Y5 Y100 1 1 1 √Y1 √Y3 √Y4 √(Y2•Y)1 1 1
√Y1
√Y3
√Y4
√(Y2•Y)
√(Y3•Y)
√(Y100•Y)
Practical Aspects of Modern Cryptography
September 18, 2018

29. An Interactive Proof
In order for me to “fool” you, I would have to guess your exact challenge sequence.
The probability of my successfully convincing you that Y is a square when it is not is
This interactive proof is said to be “zero-knowledge” because the challenger received no information (beyond the proof of the claim) that it couldn’t compute itself.
Practical Aspects of Modern Cryptography
September 18, 2018

30. Proving Knowledge
Suppose that we share a public key consisting of a modulus N and an encryption exponent E and that I want to convince you that I have the corresponding decryption exponent D.
How can I do this?
Practical Aspects of Modern Cryptography
September 18, 2018

31. Proving Knowledge Practical Aspects of Modern Cryptography
September 18, 2018

32. Proving Knowledge I can give you my private key D.
Practical Aspects of Modern Cryptography
September 18, 2018

33. Proving Knowledge I can give you my private key D.
You can encrypt something for me and I decrypt it for you.
Practical Aspects of Modern Cryptography
September 18, 2018

34. Proving Knowledge I can give you my private key D.
You can encrypt something for me and I decrypt it for you.
You can encrypt something for me and I can engage in an interactive proof with you to show that I can decrypt it.
Practical Aspects of Modern Cryptography
September 18, 2018

35. A Proof of Knowledge Y Y1 Y2 Y3 Y4 Y5 Y100
Practical Aspects of Modern Cryptography
September 18, 2018

36. A Proof of Knowledge Y Y1 Y2 Y3 Y4 Y5 Y100 1 1 11 1 1
Practical Aspects of Modern Cryptography
September 18, 2018

37. A Proof of Knowledge Y Y1 Y2 Y3 Y4 Y5 Y100 1 1 1 Y1D Y3D Y4D1 1 1
Y1D
Y3D
Y4D
Practical Aspects of Modern Cryptography
September 18, 2018

38. A Proof of Knowledge Y Y1 Y2 Y3 Y4 Y5 Y100 1 1 1 Y1D Y3D Y4D (Y2•Y) D1 1 1
Y1D
Y3D
Y4D
(Y2•Y) D
(Y5•Y) D
(Y100•Y) D
Practical Aspects of Modern Cryptography
September 18, 2018

39. A Proof of Knowledge
By engaging in this proof, the prover has demonstrated its knowledge of YD – without revealing this value.
If Y is generated by a challenger, this is compelling evidence that the prover possesses D.
Practical Aspects of Modern Cryptography
September 18, 2018

40. Facts About Interactive Proofs
Anything in PSPACE can be proven with an interactive proof.
Anything in NP can be proven with a zero-knowledge interactive proof.
Practical Aspects of Modern Cryptography
September 18, 2018

41. Applying Fiat-Shamir
Once again, the verifier challenges can be simulated by the use of a one-way function to generate the challenge bits.
Practical Aspects of Modern Cryptography
September 18, 2018

42. An Non-Interactive ZK ProofY Y1 Y2 Y3 Y4 Y5
Y100
Practical Aspects of Modern Cryptography
September 18, 2018

43. An Non-Interactive ZK ProofY Y1 Y2 Y3 Y4 Y5
Y100 1 1 1
where the bit string is computed as
xxx = SHA-1(Y1, Y2,…, Y100)
Practical Aspects of Modern Cryptography
September 18, 2018

44. An Non-Interactive ZK ProofY Y1 Y2 Y3 Y4 Y5
Y100 1 1 1
√Y1
√Y3
√Y4
Practical Aspects of Modern Cryptography
September 18, 2018

45. An Non-Interactive ZK ProofY Y1 Y2 Y3 Y4 Y5
Y100 1 1 1
√Y1
√Y3
√Y4
√(Y2•Y)
√(Y3•Y)
√(Y100•Y)
Practical Aspects of Modern Cryptography
September 18, 2018

46. Secret Sharing
Suppose that I have some data that I want to share amongst three people such that
any two can uniquely determine the data
but any one alone has no information whatsoever about the data.
Practical Aspects of Modern Cryptography
September 18, 2018

47. Secret Sharing Some simple cases: “AND”
I have a secret value z that I would like to share with Alice and Bob such that both Alice and Bob can together determine the secret at any time, but such that neither has any information individually.
Practical Aspects of Modern Cryptography
September 18, 2018

48. Secret Sharing – AND
Let z  Zn = {0,1,…,m-1} be a secret value to be shared with Alice and Bob.
Randomly and uniformly select values x and y from Zm subject to the constraint that
(x + y) mod m = z.
Practical Aspects of Modern Cryptography
September 18, 2018

49. Secret Sharing – AND The secret value is z = (x + y) mod m.
Practical Aspects of Modern Cryptography
September 18, 2018

50. Secret Sharing – AND The secret value is z = (x + y) mod m. x y
Practical Aspects of Modern Cryptography
September 18, 2018

51. Secret Sharing – AND The secret value is z = (x + y) mod m. x y
Practical Aspects of Modern Cryptography
September 18, 2018

52. Secret Sharing – AND The secret value is z = (x + y) mod m. y
Practical Aspects of Modern Cryptography
September 18, 2018

53. Secret Sharing – AND The secret value is z = (x + y) mod m. y
Practical Aspects of Modern Cryptography
September 18, 2018

54. Secret Sharing – AND The secret value is z = (x + y) mod m.
Practical Aspects of Modern Cryptography
September 18, 2018

55. Secret Sharing – AND The secret value is z = (x + y) mod m.
Practical Aspects of Modern Cryptography
September 18, 2018

56. Secret Sharing – AND The secret value is z = (x + y) mod m. x
Practical Aspects of Modern Cryptography
September 18, 2018

57. Secret Sharing – AND The secret value is z = (x + y) mod m. x y
Practical Aspects of Modern Cryptography
September 18, 2018

58. Secret Sharing – AND The secret value is z = (x + y) mod m. x y
Practical Aspects of Modern Cryptography
September 18, 2018

59. Secret Sharing – AND
This trick easily generalizes to more than two shareholders.
A secret S can be written as
S = (s1 + s2 + … + sn) mod m
for any randomly chosen integer values s1, s2, …, sn in the range 0 ≤ si < m.
Practical Aspects of Modern Cryptography
September 18, 2018

60. Secret Sharing Some simple cases: “OR”
I have a secret value z that I would like to share with Alice and Bob such that either Alice or Bob can determine the secret at any time.
Practical Aspects of Modern Cryptography
September 18, 2018

61. Secret Sharing – OR The secret value is z.
Practical Aspects of Modern Cryptography
September 18, 2018

62. Secret Sharing – OR The secret value is z. z z
Practical Aspects of Modern Cryptography
September 18, 2018

63. Secret Sharing – OR The secret value is z. z z
Practical Aspects of Modern Cryptography
September 18, 2018

64. Secret Sharing – OR The secret value is z. z
Practical Aspects of Modern Cryptography
September 18, 2018

65. Secret Sharing – OR The secret value is z. z
Practical Aspects of Modern Cryptography
September 18, 2018

66. Secret Sharing – OR The secret value is z.
Practical Aspects of Modern Cryptography
September 18, 2018

67. Secret Sharing – OR The secret value is z. z
Practical Aspects of Modern Cryptography
September 18, 2018

68. Secret Sharing – OR The secret value is z. z
Practical Aspects of Modern Cryptography
September 18, 2018

69. Secret Sharing – OR
This case also generalizes easily to more than two shareholders.
Practical Aspects of Modern Cryptography
September 18, 2018

70. Secret Sharing More complex access structures …
I want to share secret value z amongst Alice, Bob, and Carol such that any two of the three can reconstruct z.
S = (A  B)  (A  C)  (B  C)
Practical Aspects of Modern Cryptography
September 18, 2018

71. Secret Sharing A B A C B C OR AND AND AND
Practical Aspects of Modern Cryptography
September 18, 2018

72. Secret Sharing z  Zm A B A C B C OR AND AND AND
Practical Aspects of Modern Cryptography
September 18, 2018

73. Secret Sharing z  Zm z z z A B A C B C OR AND AND AND
Practical Aspects of Modern Cryptography
September 18, 2018

74. Secret Sharing z  Zm z z z z1 z2 z3 z4 z5 z6 A B A C B C OR AND AND
Practical Aspects of Modern Cryptography
September 18, 2018

75. Threshold Schemes
I want to distribute a secret datum amongst n trustees such that
any k of the n trustees can uniquely determine the secret datum,
but any set of fewer than k trustees has no information whatsoever about the secret datum.
Practical Aspects of Modern Cryptography
September 18, 2018

76. Threshold Schemes OR 1 out of n AND n out of n
Practical Aspects of Modern Cryptography
September 18, 2018

77. Shamir’s Threshold Scheme
Any k points in a field uniquely determine a polynomial of degree at most k-1.
This not only works of the reals, rationals, and other infinite fields, but also over the finite field Zp = {0,1,…,p-1} where p is a prime.
Practical Aspects of Modern Cryptography
September 18, 2018

78. Shamir’s Threshold Scheme
To distribute a secret value s  Zp amongst a set of n Trustees {T1,T2,…,Tn} such that any k can determine the secret
pick random coefficients a1,a2,…,ak-1  Zp
let P(x) = ak-1xk-1 + … + a2x2 + a1x + s
give P(i) to trustee Ti.
The secret value is s = P(0).
Practical Aspects of Modern Cryptography
September 18, 2018

79. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
Practical Aspects of Modern Cryptography
September 18, 2018

80. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
Practical Aspects of Modern Cryptography
September 18, 2018

81. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(0,9)
Secret
Practical Aspects of Modern Cryptography
September 18, 2018

82. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(0,9)
Secret
Practical Aspects of Modern Cryptography
September 18, 2018

83. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(0,9)
(1,7)
Secret
(2,5)
Share 1
(3,3)
Share 2
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

84. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
Practical Aspects of Modern Cryptography
September 18, 2018

85. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(1,7)
Share 1
Practical Aspects of Modern Cryptography
September 18, 2018

86. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(1,7)
Share 1
(3,3)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

87. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(1,7)
Share 1
(3,3)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

88. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}, Secret = 9
(0,9)
(1,7)
Secret
Share 1
(3,3)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

89. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}
Practical Aspects of Modern Cryptography
September 18, 2018

90. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}
(1,7)
Share 1
Practical Aspects of Modern Cryptography
September 18, 2018

91. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}
(1,7)
Share 1
(3,4)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

92. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}
(1,7)
Share 1
(3,4)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

93. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}
(0,8.5)
(1,7)
Secret
Share 1
(3,4)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

94. Shamir’s Threshold Scheme
The threshold 2 case:
Example: Range = Z11 = {0,1,…,10}
In Z11, 8.5
≡ 17÷2
≡ 6×6
≡ 36
≡ 3
(0,8.5)
(1,7)
Secret
Share 1
(3,4)
Share 3
Practical Aspects of Modern Cryptography
September 18, 2018

95. Shamir’s Threshold Scheme
Two methods are commonly used to interpolate a polynomial given a set of points.
Lagrange interpolation
Solving a system of linear equations
Practical Aspects of Modern Cryptography
September 18, 2018

96. Lagrange Interpolation
For each point (i,P(i)), construct a polynomial Pi with the correct value at i and a value of zero at the other given points.
Pi(x) = P(i) × ∏(j≠i)(x-j) ÷ ∏(j≠i)(i-j)
P(x) = ∑i Pi(x)
Practical Aspects of Modern Cryptography
September 18, 2018

97. Solving a Linear System
Regard the polynomial coefficients as unknowns.
Plug in each known point to get a linear equation in terms of the unknown coefficients.
Once there are as many equations as unknowns, use linear algebra to solve the system of equations.
Practical Aspects of Modern Cryptography
September 18, 2018

98. Verifiable Secret Sharing
Secret sharing is very useful when the “dealer” of a secret is honest, but what bad things can happen if the dealer is potentially dishonest?
Can measures be taken to eliminate or mitigate the damages?
Practical Aspects of Modern Cryptography
September 18, 2018

99. Homomorphic Encryption
Recall that with RSA, there is a multiplicative homomorphism.
E(x)E(y)  E(xy)
Can we find an encryption function with an additive homomorphism?
Practical Aspects of Modern Cryptography
September 18, 2018

100. An Additive Homomorphism
Can we find an encryption function for which the sum (or product) of two encrypted messages is the (an) encryption of the sum of the two original messages?
E(x)◦E(y)  E(x+y)
Practical Aspects of Modern Cryptography
September 18, 2018

101. An Additive Homomorphism
Recall the one-way function given by
f(x) = gx mod m.
For this function,
f(x)f(y) mod m = gxgy mod m =
gx+y mod m = f(x+y) mod m.
Practical Aspects of Modern Cryptography
September 18, 2018

102. Verifiable Secret Sharing
Select a polynomial with secret a0 as
P(x) = ak-1xk-1 + … + a2x2 + a1x + a0.
Commit to the coefficients by publishing
ga0, ga1, ga2, …, gak-1.
Compute a commitment to P(i) from public values as
gP(i) = ga0i0 ga1i1 ga2i2 … gak-1ik-1.
Practical Aspects of Modern Cryptography
September 18, 2018

103. Verifiable Secret Sharing
An important detail
Randomness must be included to prevent small spaces of possible secrets and shares from being exhaustively searched.
Practical Aspects of Modern Cryptography
September 18, 2018

104. Secret Sharing Homomorphisms
All of these secret sharing methods have an additional useful feature:
If two secrets are separately shared amongst the same set of people in the same way, then the sum of the individual shares constitute shares of the sum of the secrets.
Practical Aspects of Modern Cryptography
September 18, 2018

105. Secret Sharing Homomorphisms
Secret: a – Shares: a, a, …, a
Secret: b – Shares: b, b, …, b
Secret sum: a+b
Share sums: a+b, a+b, …, a+b
Practical Aspects of Modern Cryptography
September 18, 2018

106. Secret Sharing Homomorphisms
AND
Secret: a – Shares: a1, a2, …, an
Secret: b – Shares: b1, b2, …, bn
Secret sum: a+b
Share sums: a1+b1, a2+b2, …, an+bn
Practical Aspects of Modern Cryptography
September 18, 2018

107. Secret Sharing Homomorphisms
THRESHOLD
Secret: P1(0) – Shares: P1(1), P1(2), …, P1(n)
Secret: P2(0) – Shares: P2(1), P2(2), …, P2(n)
Secret sum: P1(0) + P2 (0)
Share sums: P1(1) + P2 (1), P1(2) + P2 (2), …, P1(n) + P2 (n)
Practical Aspects of Modern Cryptography
September 18, 2018

108. Threshold Encryption
I want to encrypt a secret message M for a set of n recipients such that
any k of the n recipients can uniquely decrypt the secret message M,
but any set of fewer than k recipients has no information whatsoever about the secret message M.
Practical Aspects of Modern Cryptography
September 18, 2018

109. Recall Diffie-Hellman
Alice
Randomly select a large integer a and send A = ga mod p.
Compute the key K = Ba mod p.
Bob
Randomly select a large integer b and send B = gb mod p.
Compute the key K = Ab mod p.
Ba = gba = gab = Ab
Practical Aspects of Modern Cryptography
September 18, 2018

110. ElGamal Encryption
Alice select a large random private key a and computes an associated public key A = ga mod p.
To send a message M to Alice, Bob selects a random value r and computes the pair (X,Y) = (ArM mod p, gr mod p).
To decrypt, Alice computes X/Ya mod p = ArM/gra mod p = M.
Practical Aspects of Modern Cryptography
September 18, 2018

111. ElGamal Re-Encryption
If A = ga mod p is a public key and the pair
(X,Y) = (ArM mod p, gr mod p)
is an encryption of message M, then for any value c, the pair
(AcX,gcY) = (Ac+rM mod p, gc+r mod p)
is an encryption of the same message M, for any value c.
Practical Aspects of Modern Cryptography
September 18, 2018

112. Group ElGamal Encryption
Each recipient selects a large random private key ai and computes an associated public key Ai = gai mod p.
The group key is A = ∏Ai mod p = g∑ai mod p.
To send a message M to the group, Bob selects a random value r and computes the pair (X,Y) = (ArM mod p, gr mod p).
To decrypt, each group member computes Yi = Yai mod p. The message M = X/∏Yi mod p.
Practical Aspects of Modern Cryptography
September 18, 2018

113. Threshold Encryption (ElGamal)
Each recipient selects k large random secret coefficients ai,0, ai,1, … ai,k-1 and forms the polynomial
Pi(x) = ai,k-1xk-1 + ai,k-2xk-2 + ai,1x + ai,0
Each polynomial Pi(x) is then verifiably shared with the other recipients by distributing each gai,j.
The joint (threshold) public key is ∏gai,0.
Practical Aspects of Modern Cryptography
September 18, 2018

114. Threshold Encryption (ElGamal)
The joint (threshold) public key is ∏gai,0.
Practical Aspects of Modern Cryptography
September 18, 2018

115. Can Secure Election Systems be Built on Software?
Practical Aspects of Modern Cryptography
September 18, 2018

116. Disclaimer:
Any opinions expressed here regarding elections are my own and do not necessary represent those of the Microsoft Corporation or any subsidiary or partner thereof.
Practical Aspects of Modern Cryptography
September 18, 2018

117. A Claim:
Practical Aspects of Modern Cryptography
September 18, 2018

118. I know software … A Claim: Practical Aspects of Modern Cryptography
September 18, 2018

119. I’ve worked with software …
A Claim:
I know software …
I’ve worked with software …
Practical Aspects of Modern Cryptography
September 18, 2018

120. I’ve worked with software … You cannot trust software.
A Claim:
I know software …
I’ve worked with software …
You cannot trust software.
Practical Aspects of Modern Cryptography
September 18, 2018

121. More specifically … There are a million ways to tamper with software:
Insider attacks
Exploitation of bugs and vulnerabilities
Configuration errors
etc.
How can one trust an election to software?
Practical Aspects of Modern Cryptography
September 18, 2018

122. A Web-Based Election Practical Aspects of Modern Cryptography
September 18, 2018

123. A Web-Based Election
Voters post their names and votes to a public web site.
Practical Aspects of Modern Cryptography
September 18, 2018

124. A Web-Based Election
Voters post their names and votes to a public web site.
Anyone who cares to do so can
Check that their own votes are correctly posted
Check that other voters are legitimate
Check that the totals are correct
Practical Aspects of Modern Cryptography
September 18, 2018

125. But wait …
Practical Aspects of Modern Cryptography
September 18, 2018

126. But wait … This isn’t a secret-ballot election.
Practical Aspects of Modern Cryptography
September 18, 2018

127. But wait … This isn’t a secret-ballot election.
Quite true, but it’s enough to falsify the previous arguments.
Practical Aspects of Modern Cryptography
September 18, 2018

128. Privacy
Practical Aspects of Modern Cryptography
September 18, 2018

129. Privacy
The only ingredient missing from this “toy” web-based election is privacy – and the things which flow from privacy (e.g. protection from coercion).
Practical Aspects of Modern Cryptography
September 18, 2018

130. Privacy
The only ingredient missing from this “toy” web-based election is privacy – and the things which flow from privacy (e.g. protection from coercion).
Performing tasks while preserving privacy is the bailiwick of cryptography.
Practical Aspects of Modern Cryptography
September 18, 2018

131. Understanding Elections
So, you want to hold an election …
Practical Aspects of Modern Cryptography
September 18, 2018

132. Some Principles of Election Protocols
Privacy
Verifiability
Robustness
Coercibility
Practical Aspects of Modern Cryptography
September 18, 2018

133. Privacy Only one voter? A unanimous tally? Unanimous less one?
Practical Aspects of Modern Cryptography
September 18, 2018

134. Verifiability By single trusted party? By trusted committee?
By each voter?
By observers?
Practical Aspects of Modern Cryptography
September 18, 2018

135. Robustness Against faulty/malicious voters?
Against faulty/malicious officials?
At what cost to privacy?
Practical Aspects of Modern Cryptography
September 18, 2018

136. Coercibility When? By whom? (voter, official, or observer) Where?
Free-form ballots?
Practical Aspects of Modern Cryptography
September 18, 2018

137. Current Election Methods
Practical Aspects of Modern Cryptography
September 18, 2018

138. Current Election Methods
Currently deployed touch-screen systems have good usability properties but no substantive verifiability.
Practical Aspects of Modern Cryptography
September 18, 2018

139. Current Election Methods
Currently deployed touch-screen systems have good usability properties but no substantive verifiability.
Paper-based systems offer some verifiability, but voters can only track their votes to a limited extent.
Practical Aspects of Modern Cryptography
September 18, 2018

140. Current Election Methods
Currently deployed touch-screen systems have good usability properties but no substantive verifiability.
Paper-based systems offer some verifiability, but voters can only track their votes to a limited extent.
Perhaps we can do even better.
Practical Aspects of Modern Cryptography
September 18, 2018

141. Cryptographic Verifiability
With well-built paper-based systems, voters can ensure that their intended votes went into a locked ballot box but must depend upon officials and procedures to ensure that their votes are included in the tally.
Practical Aspects of Modern Cryptography
September 18, 2018

142. Cryptographic Verifiability
With well-built paper-based systems, voters can ensure that their intended votes went into a locked ballot box but must depend upon officials and procedures to ensure that their votes are included in the tally.
Practical Aspects of Modern Cryptography
September 18, 2018

143. Cryptographic Verifiability
With well-built paper-based systems, voters can ensure that their intended votes went into a locked ballot box but must depend upon officials and procedures to ensure that their votes are included in the tally.
Cryptographic methods can give voters complete confidence that their intended votes were properly included in the tally.
Practical Aspects of Modern Cryptography
September 18, 2018

144. Cryptographic Voting Systems
There are many approaches to cryptographic voting, but the primary options can be divided into two phases.
Voters transform their intentions into encrypted ballots and post their (named) ballots on a public list.
The list of encrypted votes is publicly processed to produce a tally and a proof that the tally is correct.
Practical Aspects of Modern Cryptography
September 18, 2018

145. The Encryption Phase
Turning your intentions into an encrypted ballot should be easy – no?
You can use your own machine.
You can use any machine you trust.
You can use a dedicated device.
Researchers regarded this phase as uninteresting.
Practical Aspects of Modern Cryptography
September 18, 2018

146. The Tallying Phase
Taking a set of encrypted ballots and transforming it, in a universally verifiable manner, into a tally (together with a proof of correctness) is a nice cryptographic mathematical problem.
Researchers really liked this problem and spent decades developing and improving solutions.
Practical Aspects of Modern Cryptography
September 18, 2018

147. Fundamental Tallying Decision
You have essentially two paradigms to choose from …
Anonymized Ballots
Ballotless Tallying
Practical Aspects of Modern Cryptography
September 18, 2018

148. Anonymized Ballots Practical Aspects of Modern Cryptography
September 18, 2018

149. Ballotless Tallying Practical Aspects of Modern Cryptography
September 18, 2018

150. A Fundamental Trade-Off
Ballots simplify write-ins and other “non-standard” options.
Non-standard options can compromise privacy.
Practical Aspects of Modern Cryptography
September 18, 2018

151. Anonymized Ballots Practical Aspects of Modern Cryptography
September 18, 2018

152. The Mix-Net Paradigm Chaum (1981) …
Practical Aspects of Modern Cryptography
September 18, 2018

153. The Mix-Net Paradigm Practical Aspects of Modern Cryptography
September 18, 2018

154. The Mix-Net Paradigm MIX Vote Vote Vote Vote
Practical Aspects of Modern Cryptography
September 18, 2018

155. The Mix-Net Paradigm MIX Alice Bob Carol David Vote Vote Vote Vote
Practical Aspects of Modern Cryptography
September 18, 2018

156. The Mix-Net Paradigm MIX Vote Vote Vote Vote
Practical Aspects of Modern Cryptography
September 18, 2018

157. Multiple Mixes Practical Aspects of Modern Cryptography
September 18, 2018

158. Multiple Mixes MIX Practical Aspects of Modern Cryptography
September 18, 2018

159. Multiple Mixes MIX MIX Vote Vote Vote Vote
Practical Aspects of Modern Cryptography
September 18, 2018

160. A Re-encryption Mix MIX Practical Aspects of Modern Cryptography
September 18, 2018

161. A Re-encryption Mix MIX Practical Aspects of Modern Cryptography
September 18, 2018

162. Multiple Re-encryption Mixes
Practical Aspects of Modern Cryptography
September 18, 2018

163. Multiple Re-encryption Mixes
Practical Aspects of Modern Cryptography
September 18, 2018

164. Multiple Re-encryption Mixes
Practical Aspects of Modern Cryptography
September 18, 2018

165. Multiple Re-encryption Mixes
Vote
Vote
Vote
Vote
Practical Aspects of Modern Cryptography
September 18, 2018

166. Verifiability
Each re-encryption mix provides a mathematical proof that it’s output is a permutation of re-encryptions of its input.
Any observer can verify this proof.
If a mix’s proof is invalid, its mixing will be bypassed.
Practical Aspects of Modern Cryptography
September 18, 2018

167. Constructing a Verifiable Mix
Practical Aspects of Modern Cryptography
September 18, 2018

168. Constructing a Verifiable Mix
Initial Ballot Set
Practical Aspects of Modern Cryptography
September 18, 2018

169. Constructing a Verifiable Mix
Initial Ballot Set
Final Ballot Set
Practical Aspects of Modern Cryptography
September 18, 2018

170. Constructing a Verifiable Mix
Intermediate
Ballot Set #1
Initial Ballot Set
Final Ballot Set
Intermediate
Ballot Set #2
Intermediate
Ballot Set #3
Practical Aspects of Modern Cryptography
September 18, 2018

171. Constructing a Verifiable Mix
Accept a one-bit challenge (L/R) for each intermediate ballot set.
“Open” the indicated side of each intermediate ballot set to show that it is a valid (permuted) re-encryption of either the initial ballots or the final ballots.
Generate these challenges non-interactively.
Practical Aspects of Modern Cryptography
September 18, 2018

172. Constructing a Verifiable Mix
Intermediate
Ballot Set #1
Initial Ballot Set
Final Ballot Set
Intermediate
Ballot Set #2
Intermediate
Ballot Set #3 R L R
Practical Aspects of Modern Cryptography
September 18, 2018

173. Unconditional Verifiability
If the final ballot set does not match the initial ballot set, the chance of matching an intermediate ballot set to the indicated initial/final set is no more than 0.5.
100 intermediate ballot sets yields an error probability of no more than
Challenge values may be collected non-interactively.
Practical Aspects of Modern Cryptography
September 18, 2018

174. Mix-Net Properties
The integrity of a mix-net is not dependent on any unproven assumptions – only the inability of a mix to predict the challenges it receives.
Privacy in a mix-net is dependent upon the mixers and is no better than that provided by the encryption – a cryptographic break-through could compromise privacy.
Practical Aspects of Modern Cryptography
September 18, 2018

175. Ballotless Tallying Practical Aspects of Modern Cryptography
September 18, 2018

176. The Homomorphic Paradigm
Benaloh (Cohen), Fischer (1985) …
Practical Aspects of Modern Cryptography
September 18, 2018

177. The Homomorphic Paradigm
Tally
Practical Aspects of Modern Cryptography
September 18, 2018

178. The Homomorphic Paradigm
Tally
Practical Aspects of Modern Cryptography
September 18, 2018

179. Homomorphic Techniques
Alice
Bob
Carol 1
David
Eve
Practical Aspects of Modern Cryptography
September 18, 2018

180. Homomorphic Techniques
Alice
Bob
Carol 1
David
Eve
 =
Practical Aspects of Modern Cryptography
September 18, 2018

181. Homomorphic Techniques
Alice
Bob
Carol 1
David
Eve
 = 2
Practical Aspects of Modern Cryptography
September 18, 2018

182. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
Practical Aspects of Modern Cryptography
September 18, 2018

183. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

184. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

185. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

186. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

187. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

188. Homomorphic Techniques
The sum of the shares of the votes constitute shares of the sum of the votes.
Practical Aspects of Modern Cryptography
September 18, 2018

189. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

190. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
Practical Aspects of Modern Cryptography
September 18, 2018

191. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

192. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

193. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

194. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
= 
Practical Aspects of Modern Cryptography
September 18, 2018

195. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
= 
Practical Aspects of Modern Cryptography
September 18, 2018

196. Homomorphic TechniquesX1 X2 X3
Alice 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
 =
= 
Practical Aspects of Modern Cryptography
September 18, 2018

197. Homomorphic Techniques
The sum of the shares of the votes constitute shares of the sum of the votes.
The product of the encryptions of the votes constitutes an encryption of the sum of the votes.
Practical Aspects of Modern Cryptography
September 18, 2018

198. Homomorphic Techniques
Product of Encryptions  Encryption of Sum
Sum of Shares  Shares of Sum
The product of the encryptions of the shares of the votes constitute encryptions of the shares of the sum of the votes.
Practical Aspects of Modern Cryptography
September 18, 2018

199. Homomorphic Techniques
Robustness can be added by using a threshold scheme instead of a simple sum to share each vote.
Practical Aspects of Modern Cryptography
September 18, 2018

200. Homomorphic TechniquesX1 X2 X3
Alice
=  3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

201. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 3 -5 2
Bob -4 5 -1
Carol 1 -3
David -2
Eve 4
 =
Practical Aspects of Modern Cryptography
September 18, 2018

202. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 2 4 6
Bob 1 3
Carol
David -2 -4 -6
Eve
 = 8
Practical Aspects of Modern Cryptography
September 18, 2018

203. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 2 4 6
Bob 1 3
Carol
David -2 -4 -6
Eve
Practical Aspects of Modern Cryptography
September 18, 2018

204. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 2 4 6
Bob 1 3
Carol
David -2 -4 -6
Eve
 = 8
Practical Aspects of Modern Cryptography
September 18, 2018

205. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 2 4 6
Bob 1 3
Carol
David -2 -4 -6
Eve
 = 8
Practical Aspects of Modern Cryptography
September 18, 2018

206. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 2 4 6
Bob 1 3
Carol
David -2 -4 -6
Eve
 = 8
Practical Aspects of Modern Cryptography
September 18, 2018

207. Homomorphic TechniquesX1 X2 X3
Alice
= P(0) 2 4 6
Bob 1 3
Carol
David -2 -4 -6
Eve
 =
 = 8
Practical Aspects of Modern Cryptography
September 18, 2018

208. The Encryption Phase
How can voters turn their intentions into encrypted ballots?
Any device that can perform this task could have vulnerabilities, intentional back doors, be subject to viruses, etc.
Practical Aspects of Modern Cryptography
September 18, 2018

209. The Encryption Phase Requirements of ballot encryption devices
Must accurately encrypt voter intentions
Need not know voter identities
Need not authenticate voters right to vote
Need not limit people to a single use
Need not cast votes
Practical Aspects of Modern Cryptography
September 18, 2018

210. Unstructured Auditing
Anyone … voter/inspector/observer is free to create votes at any time during an election.
Any “uncast” votes can be opened at any time – either by the device itself or by adding the vote to a separate “test vote” queue.
Practical Aspects of Modern Cryptography
September 18, 2018

211. Auditing
Note that it’s not necessary for all voters to audit vote encryption devices – a tiny fraction of voters and/or election inspectors would suffice, and there are more user-friendly ways to effect auditing.
E.g. 100 auditing events would probably detect a 1% fraud rate.
Practical Aspects of Modern Cryptography
September 18, 2018

212. A Fundamental Limitation
Whenever a ballot is created for the voter, there seems to be no way to distinguish between a vote-creation device attempting to cheat and a voter claiming that a properly functioning device attempted to cheat the voter.
Practical Aspects of Modern Cryptography
September 18, 2018

213. In Practice?
Voter
Go to your polling station and (possibly without even signing in) go to a voting station.
Enter your preferences and at the end press (perhaps) one of two buttons.
Receive a machine and human readable card.
Go to a poll worker, sign-in, and run your card through a reader.
Take the card home and (if you wish) use it to verify your vote on-line.
Practical Aspects of Modern Cryptography
September 18, 2018

214. In Practice?
Back End
Receive all votes and post them on-line (perhaps even together with voter names).
Allow anyone to (sequentially) scramble (mix) the votes and provide a proof of correct mixing. Post all such mixings and proofs on-line.
Have the final mixed ballots decrypted together with proof of correct decryption. Post the decryptions together with their proofs.
Practical Aspects of Modern Cryptography
September 18, 2018

215. In Practice?
Observers
Use voting stations to create ballots anytime desired. Test ballots for validity.
Verify posted ballot mixing and decryptions using posted proofs.
Practical Aspects of Modern Cryptography
September 18, 2018

216. Properties
Cryptographically verified election technologies can achieve universal end-to-end verifiabilty, while paper can only provide limited voter verifiability.
This is a substantially different paradigm that emphasizes validations of elections rather than election equipment.
A cryptographic election can be verified externally without ever having to inspect the system hardware or software.
Practical Aspects of Modern Cryptography
September 18, 2018

217. Scorecard Crypto Based Paper Practical Aspects of Modern Cryptography
September 18, 2018

218. Scorecard Crypto Based Paper Accuracy/ Verifiability
Practical Aspects of Modern Cryptography
September 18, 2018

219. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Practical Aspects of Modern Cryptography
September 18, 2018

220. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Practical Aspects of Modern Cryptography
September 18, 2018

221. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Practical Aspects of Modern Cryptography
September 18, 2018

222. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Cannot be proven absolutely
Practical Aspects of Modern Cryptography
September 18, 2018

223. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Cannot be proven absolutely
Robustness
Practical Aspects of Modern Cryptography
September 18, 2018

224. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Cannot be proven absolutely
Robustness
Wholesale failure is possible
Practical Aspects of Modern Cryptography
September 18, 2018

225. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Cannot be proven absolutely
Robustness
Wholesale failure is possible
Only retail failure is possible
Practical Aspects of Modern Cryptography
September 18, 2018

226. Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Cannot be proven absolutely
Robustness
Wholesale failure is possible
Only retail failure is possible
Overall
Practical Aspects of Modern Cryptography
September 18, 2018

227. ? Scorecard Crypto Based Paper Accuracy/ Verifiability
Full end-to-end by anyone
Voter only as far as ballot box
Privacy/ Coercibility
Cannot be proven absolutely
Robustness
Wholesale failure is possible
Only retail failure is possible
Overall ?
Practical Aspects of Modern Cryptography
September 18, 2018

228. Conclusions Practical Aspects of Modern Cryptography
September 18, 2018

229. Keep an open mind. Conclusions
Practical Aspects of Modern Cryptography
September 18, 2018

230. Keep an open mind. Think critically. Conclusions
Practical Aspects of Modern Cryptography
September 18, 2018

231. Keep an open mind. Think critically. Vote! Conclusions
Practical Aspects of Modern Cryptography
September 18, 2018