🚀 go-pugleaf

Marc.Ringuette@daisy.learning.cs.cmu.edu wrote:
: A recent newswire article about suggestions to allow telephone voting
: got me thinking about the possibility of running a cryptographically
: secure presidential election via email.  I claim that the problem is
: very similar to the problem of untraceable electronic cash, and that
: with a little work, we could concoct a secure protocol for running
: national elections by email, using known technology.
: 
: I made this claim on a local newsgroup, and a colleague, Doug Tygar, 
: disagreed strongly.  I thought I'd run this by you and see if I can
: get a reaction.  Do you think that secure elections are within the
: grasp of modern cryptography?  If so, how would you do it?  If not, 
: what do you see as the major obstacles?

A former student of mine, Josh Cohen Benaloh, did a Ph.D. dissertation
on this problem at Yale back in 1987.  The title is "Verifiable
Secret-Ballot Elections".  A preliminary version of this work appeared
in J. D.  Cohen and M. J.  Fischer, ``A Robust and Verifiable
Cryptographically Secure Election Scheme,'' {\it Proc. 26th IEEE
Symposium on Foundations of Computer Science} (October 1985), 372-382.

The problem is much trickier than might appear at first sight.  In
addition to privacy, two important requirements in a practical voting
scheme are verifiability and robustness.  Verifiability means that all
voters can verify that the votes were counted correctly.  Robustness
means that no small group of participants can invalidate the election,
disenfranchise valid voters, or otherwise have greater influence over
the outcome than their alloted votes would allow.  

While the proposed scheme does allow every voter to verify that his or
her vote is among those posted by the government, it appears to be
subject to various abuses by the government.  For example, the
government can fabricate votes and count them in the final tally.  No
individual or small group of voters can detect that they are
fabricated since they could be legitimate votes of all other voters.
For another, the government might change the value of legitimate
votes, or fail to return a signed vote to the voter.  While the voter
could detect such abuses, there would be no way to prove it to others,
at least without compromising the privacy of the vote.

==================================================
| Michael Fischer <fischer-michael@cs.yale.edu>  |
==================================================