3 ms·

> There are crypto voting systems that do not allow anyone (including the government) to know if you voted or what your vote is (identifying you), but still all

> There are crypto voting systems that do not allow anyone (including the government) to know if you voted or what your vote is (identifying you), but still allows tallying and validation. Are they safe against "rubber hose cryptanalysis"? Such as forcing you to verify your vote while I can see you?

mindslight 6y ago
No cryptographic system can be resistant to this by itself, but the attack can be trivially defeated by keeping the existing concept of polling stations and having people cast their cryptographically-verifiable votes there.
deleted 6y ago
[deleted]
runarberg 6y ago
I’m not an expert, but couldn’t you keep a link between your public key and your vote while the election is open. Allow subsequent votes that will nullify votes associated with your public key. And when the polls close, this link gets deleted. This way you can be intimidated to vote and verify a certain way, then after your intimidator leaves you alone, you simply cast another vote. And after the deadline passes any record that you personally casted a ballot have been erased. Maybe as a further safeguard keep traditional in-person polling open, wherein showing up to you automatically nullify you previous crypto vote, and only your paper ballot counts.
- rtkwe 6y ago
  There's still the problem that you can still coerce and verify then use surveillance and the fear of surveillance to keep people from changing their vote. Random rechecks the day the polls close would keep a lot of people from risking changing their vote after the initial check-in. Even beyond any theoretical security measures one huge benefit of in person voting is it limits the available attack. With IPV to steal an election you have to find a way to either physically bring enough people to enough polling places to swing the election or corrupt the poll watcher system and steal it in the counting phase. With electronic voting anyone in the world has a chance to attack you. Anything that requires Joe/Jane Citizen to reliably or securely operate their computer is kind of doomed for a long time IMO.
  - runarberg 6y ago
    I do think that voting should be as streamlined and easy as possible. If electronic voting becomes a thing, you should still be able to do an in-person voting at a poll both on election day, an in-person absentee voting at a designated place, a mail-in absentee voting, etc. in addition to the e-voting. All of these (except for in-person voting on election day) should have a sealed timestamp and a public key/barcode attached so previous ballots can be nullified with a more recent vote by an other—or the same—means.
    - rtkwe 6y ago
      The problem with being able to go back and revote/nullify is it makes counting very complicated to do with non-attrubution.
      - runarberg 6y ago
        idk. It is already done quite successfully in many democracies, including Iceland and Estonia. I’m guessing the vote is sealed with a key or a barcode, if a later vote arrives, a system will order a previous vote with a matching key/barcode to be destroyed. Finally on voting day, the link between any personally identifiable information is destroyed. EDIT: Just to clarify, there should never be a time when a ballot is unsealed and a link between a barcode and a person exists in the system. A counter scans an absentee ballot before unsealing it, if the person voted in-person the scanner should reject the vote and order it to be destroyed the link could have been destroyed at any point between then and when the person showed up to the polling station. If they didn’t show up, the scanner will order the link to be destroyed, the counter will then pass this ballot on to be counted. Importantly the counter (nor any human for that matter) never has access to a link to a personally identifiable information, all the counter sees is the barcode. EDIT 2: I don’t know if this is how counting is done in democracies that allow you to nullify a previous vote by voting again, but it is a system that could work, conjured up by a mere spectator.
        rtkwe 6y ago
        That probably works better for smaller countries. Here in the US mail in voting kind of works that way in that the ballots are sealed until they're 'accepted' and then the ballots are removed and the identifying shell envelope is discarded. The big slow down is actually going through all the submitted votes and validating then counting, most in person votes here in the US are counted via machine immediately at the polling place. Somewhere between 25-50% of votes depending on state are cast through some early mechanism and under this none of those could be counted until election day which is a large increase in the number of votes that need to be counted and makes them more difficult to count. One other benefit of being able to count everything in person on the day it's cast is the votes don't have to move outside the polling place for initial counting which makes monitoring easier. It's a nice and convenient idea but I don't see the small benefit of being able to change votes (how many people honestly want to change their vote?) vs the large increase in complexity.

mindslight 6y ago

No cryptographic system can be resistant to this by itself, but the attack can be trivially defeated by keeping the existing concept of polling stations and having people cast their cryptographically-verifiable votes there.

deleted 6y ago

[deleted]

runarberg 6y ago

I’m not an expert, but couldn’t you keep a link between your public key and your vote while the election is open. Allow subsequent votes that will nullify votes associated with your public key. And when the polls close, this link gets deleted. This way you can be intimidated to vote and verify a certain way, then after your intimidator leaves you alone, you simply cast another vote. And after the deadline passes any record that you personally casted a ballot have been erased. Maybe as a further safeguard keep traditional in-person polling open, wherein showing up to you automatically nullify you previous crypto vote, and only your paper ballot counts.

rtkwe 6y ago
There's still the problem that you can still coerce and verify then use surveillance and the fear of surveillance to keep people from changing their vote. Random rechecks the day the polls close would keep a lot of people from risking changing their vote after the initial check-in. Even beyond any theoretical security measures one huge benefit of in person voting is it limits the available attack. With IPV to steal an election you have to find a way to either physically bring enough people to enough polling places to swing the election or corrupt the poll watcher system and steal it in the counting phase. With electronic voting anyone in the world has a chance to attack you. Anything that requires Joe/Jane Citizen to reliably or securely operate their computer is kind of doomed for a long time IMO.
- runarberg 6y ago
  I do think that voting should be as streamlined and easy as possible. If electronic voting becomes a thing, you should still be able to do an in-person voting at a poll both on election day, an in-person absentee voting at a designated place, a mail-in absentee voting, etc. in addition to the e-voting. All of these (except for in-person voting on election day) should have a sealed timestamp and a public key/barcode attached so previous ballots can be nullified with a more recent vote by an other—or the same—means.
  - rtkwe 6y ago
    The problem with being able to go back and revote/nullify is it makes counting very complicated to do with non-attrubution.
    - runarberg 6y ago
      idk. It is already done quite successfully in many democracies, including Iceland and Estonia. I’m guessing the vote is sealed with a key or a barcode, if a later vote arrives, a system will order a previous vote with a matching key/barcode to be destroyed. Finally on voting day, the link between any personally identifiable information is destroyed. EDIT: Just to clarify, there should never be a time when a ballot is unsealed and a link between a barcode and a person exists in the system. A counter scans an absentee ballot before unsealing it, if the person voted in-person the scanner should reject the vote and order it to be destroyed the link could have been destroyed at any point between then and when the person showed up to the polling station. If they didn’t show up, the scanner will order the link to be destroyed, the counter will then pass this ballot on to be counted. Importantly the counter (nor any human for that matter) never has access to a link to a personally identifiable information, all the counter sees is the barcode. EDIT 2: I don’t know if this is how counting is done in democracies that allow you to nullify a previous vote by voting again, but it is a system that could work, conjured up by a mere spectator.
      - rtkwe 6y ago
        That probably works better for smaller countries. Here in the US mail in voting kind of works that way in that the ballots are sealed until they're 'accepted' and then the ballots are removed and the identifying shell envelope is discarded. The big slow down is actually going through all the submitted votes and validating then counting, most in person votes here in the US are counted via machine immediately at the polling place. Somewhere between 25-50% of votes depending on state are cast through some early mechanism and under this none of those could be counted until election day which is a large increase in the number of votes that need to be counted and makes them more difficult to count. One other benefit of being able to count everything in person on the day it's cast is the votes don't have to move outside the polling place for initial counting which makes monitoring easier. It's a nice and convenient idea but I don't see the small benefit of being able to change votes (how many people honestly want to change their vote?) vs the large increase in complexity.