1. Applying Cryptography --lottery, anonymous authentication, and voting-- Kazue Sako 2007.9.20

2. 2 My belief People in the world should benefit more from cryptography –May be not best crypto but something better than what they have now Reality People may not know its benefits The cost does not match the benefits Those who benefits are not the decision makers in introducing new technology

3. 3 Examples Fair Digital Lottery System (digilot) –Output the result of pseudorandom function using a random input jointly generated by the participants –decision maker - We want our valued client to win the lottery Anonymous Authentication –Group signatures, anonymous credentials, k-times anonymous authentication,… –provides more privacy for users –decision maker – We want to identify users so that we can make personal recommendations and make them pay more

4. 4 Examples Fair Digital Lottery System (digilot) –Output the result of pseudorandom generator using a random seed chosen from participants –decision maker - We want our valued client to win the lottery Anonymous Authentication –Group signatures, anonymous credentials, k-times anonymous authentication,… –provides more privacy for users –decision maker – We want to identify users so that we can make personal recommendations and make them pay more ? anonymous attestation ( Trusted Computing Group TCG) Car-to-car communication e-PASSPORT..someday

5. 5 Third example:Network Voting Current Status –NEC Labor’s Union (20,000voters) has been employing mixnet based system since 2004, stably. My Challenge –SVIS project—Secure Voting in Symposiums First target SCIS2008 Symposium on Cryptography and Information Security –SCIS award among 200 young researchers based on 600 audience voting (and paper referee) –Audience voting was performed using paper ballots –Project members are volunteers from the community, 4 universities and 9 companies Secure Voting in Symposiums

6. 6 New Privacy Requirement SCIS award was primarily for encouraging young researchers Therefore the result of the voting is not disclosed... researchers collecting few votes may be discouraged Verifiable property of mixnets reveals exact number of votes each paper received. How can we ensure the correctness of tally without revealing how many votes each paper received? –Hiding tally in homomorphic type voting or yes/no voting had been considered.(ex. Electronic Jury voting HK2002) –multiple candidates using mixnet is not considered before

7. 7 we want How we want to show tally results Instead of paper13 paper213 paper37 paper425 paper516 paper68 paper70 paper821 sjt80u925 fv0u2821 u27dsfy16 rkoju8s13 3roijds8 sdfl2rwe7 gow3r03 we7liuo0 paper4 paper8 paper5 #votes collected

8. 8 Ideas The last mixer reveals not decrypted results but deterministically transformed results(one-way). sjt80u9 fv0u28 u27dsfy Proves in ZK that decryption and transformation are correctly performed

9. 9 Wrapping up I’m trying hard to employ something useful using cryptographic protocols –fair lottery –anonymous authentication –network voting Would like to know of other successful systems/services Facing a real world sometimes provide you with a new requirement