4 ms·

In reality private keys will be mailed in insecure envelopes, issued multiple times (just to be sure) or issued to people, who are not citizens, moved away or

In reality private keys will be mailed in insecure envelopes, issued multiple times (just to be sure) or issued to people, who are not citizens, moved away or died.

inhumantsar 2y ago
I don't disagree, the identity matching and uniqueness problem is a tough nut to crack. it's worth keeping in mind though that this is an issue the current system faces. voters end up duplicated in the rolls under different addresses or old names, or they don't get removed from the rolls after losing eligibility or dying. once upon a time I got two voter cards in the mail, one forwarded from an old address. I was eligible in two districts after nothing more extraordinary than moving across town. had to call in to get removed from the extra district.
mariusor 2y ago
I think this will be prevented when these private keys will be part of the national IDs, similar to how Estonia and other European countries do it. If there's a "national registry of citizens" comprised of public keys, I think it will be easy to organize ballots on top of that.
- codedokode 2y ago
  The government can issue fake IDs and vote in their name. Especially in countries where there are many migrants who receive citizenship, you can easily issue some extra IDs and nobody notices.
  - JanisErdmanis 2y ago
    This attack vector is no different with paper ballots.
    - codedokode 2y ago
      With paper voting you need both fake IDs and people. You need to recruit people ready to commit a crime, and transport them between polling stations. If you want to add million fake votes, you need somewhere about 100 000 accomplices, each voting 10 times. For comparison, with electronic voting to commit fraud, you need just one patriotic or corrupt system administrator willing to protect the country from an undesirable candidate. It is not difficult to find such type of person. Electronic voting significantly lowers the barrier for commiting fraud by election administrators.
      - JanisErdmanis 2y ago
        > For comparison, with electronic voting to commit fraud, you need just one patriotic or corrupt system administrator willing to protect the country from an undesirable candidate. It is not difficult to find such type of person. The difference between having a passport or a national-issued digital identity card that has a private key inside is not much different. In passports, there are different security mechanisms in place that make it hard for an adversary to fake them. For digital identity cards, similar mechanisms exist so that their issuance does not depend on a single entity. The full list for which the identity cards are issued can be audited by sampling and finding follow-ups to see if the issued identity is owned by the claimed legitimate person and is independent, whether the thing is a passport or an identity card. Although, I don't know whether such checks are actually being done in practice. The security of digital identity is being assured with an increasing variety of documents that can be signed digitally using such government-issued cards. Afterwards, when we have a list of public keys that are eligible to participate in the vote, E2E verifiable evidence prevents any involved party or coalition from deceiving the public with a manipulated election tally, as that would not produce valid cryptographic proof.
        codedokode 2y ago
        The list of eligible voters might be not published to protect personal identifiable information and to prevent misuse of such information (in my country it is not published). Therefore you cannot sample anything. And even if you could, you see a name you never heard of, so how do you check whether it is a real person or not? Without having access to government databases.
    - codedokode 2y ago
      To clear possible misunderstanding, I meant remote electronic voting over Internet, not voting in a polling station in-person using voting machines. Those are more transparent and verifiable.

In reality private keys will be mailed in insecure envelopes, issued multiple times (just to be sure) or issued to people, who are not citizens, moved away or died.

inhumantsar 2y ago

I don't disagree, the identity matching and uniqueness problem is a tough nut to crack. it's worth keeping in mind though that this is an issue the current system faces. voters end up duplicated in the rolls under different addresses or old names, or they don't get removed from the rolls after losing eligibility or dying. once upon a time I got two voter cards in the mail, one forwarded from an old address. I was eligible in two districts after nothing more extraordinary than moving across town. had to call in to get removed from the extra district.

mariusor 2y ago

I think this will be prevented when these private keys will be part of the national IDs, similar to how Estonia and other European countries do it. If there's a "national registry of citizens" comprised of public keys, I think it will be easy to organize ballots on top of that.

codedokode 2y ago
The government can issue fake IDs and vote in their name. Especially in countries where there are many migrants who receive citizenship, you can easily issue some extra IDs and nobody notices.
- JanisErdmanis 2y ago
  This attack vector is no different with paper ballots.
  - codedokode 2y ago
    With paper voting you need both fake IDs and people. You need to recruit people ready to commit a crime, and transport them between polling stations. If you want to add million fake votes, you need somewhere about 100 000 accomplices, each voting 10 times. For comparison, with electronic voting to commit fraud, you need just one patriotic or corrupt system administrator willing to protect the country from an undesirable candidate. It is not difficult to find such type of person. Electronic voting significantly lowers the barrier for commiting fraud by election administrators.
    - JanisErdmanis 2y ago
      > For comparison, with electronic voting to commit fraud, you need just one patriotic or corrupt system administrator willing to protect the country from an undesirable candidate. It is not difficult to find such type of person. The difference between having a passport or a national-issued digital identity card that has a private key inside is not much different. In passports, there are different security mechanisms in place that make it hard for an adversary to fake them. For digital identity cards, similar mechanisms exist so that their issuance does not depend on a single entity. The full list for which the identity cards are issued can be audited by sampling and finding follow-ups to see if the issued identity is owned by the claimed legitimate person and is independent, whether the thing is a passport or an identity card. Although, I don't know whether such checks are actually being done in practice. The security of digital identity is being assured with an increasing variety of documents that can be signed digitally using such government-issued cards. Afterwards, when we have a list of public keys that are eligible to participate in the vote, E2E verifiable evidence prevents any involved party or coalition from deceiving the public with a manipulated election tally, as that would not produce valid cryptographic proof.
      - codedokode 2y ago
        The list of eligible voters might be not published to protect personal identifiable information and to prevent misuse of such information (in my country it is not published). Therefore you cannot sample anything. And even if you could, you see a name you never heard of, so how do you check whether it is a real person or not? Without having access to government databases.
  - codedokode 2y ago
    To clear possible misunderstanding, I meant remote electronic voting over Internet, not voting in a polling station in-person using voting machines. Those are more transparent and verifiable.