Voting over the Internet on an Insecure Platform

Voting over the Internet on an Insecure Platform

Rolf Haenni (Bern University of Applied Sciences, Switzerland) and Reto E. Koenig (Bern University of Applied Sciences, Switzerland)
Copyright: © 2014 |Pages: 14
DOI: 10.4018/978-1-4666-5820-2.ch003

Abstract

Voters using their insecure personal devices for casting votes cause a critical but still largely unsolved problem in Internet voting. This chapter addresses this problem by introducing a trusted voting device, which can be used in combination with various cryptographic voting protocols. It's an answer to one of the main assumptions, on which these protocols are based, namely that voters can reliably perform various cryptographic computations. We suggest that all critical cryptographic computations are performed on the voting device, but we restrict its user interface to the simple task of allowing voters to confirm their votes before casting the ballot. The ballots themselves are prepared beforehand on the voter's insecure platform using its rich user interface. To provide privacy even in the presence of strong malware, the voting device receives its information from the voter's insecure platform in form of matrix barcodes. The unidirectionality of such an optical communication channel disallows the insecure platform to learn the voter's actual choice. To verify the correct functioning of the voting device, it can be challenged with test ballots that are indistinguishable from real ones.
Chapter Preview
Top

Introduction

In Internet voting, personal devices used by voters for casting their votes are not under the control of the election authority. The overall security of the voting system is therefore dependent on the correct functioning of these devices, even if the underlying cryptographic protocol and system implementation guarantee the highest possible security properties. In the vote casting phase, most existing cryptographic voting protocols include steps like “the voter encrypts the candidate choice with the authority’s public key,” “the voter provides a non-interactive zero-knowledge proof of knowledge of the encryption randomization,” or similar. This is easily said, but far more complicated to realize in practice. To perform the complex mathematical computations of such cryptographic operations, voters must have access to reliable computers. Given the manifold vulnerabilities of current computers and system software, particularly those caused by malicious software, this assumption should not be taken for granted in general. This is the so-called secure platform problem (Schläpfer & Volkamer, 2012), which is difficult to solve in general, but particularly challenging in the area of Internet voting.

In a recent report, the number of new Windows-based malware in 2010 is estimated as more than two million (Benzmüller & Berkenkopf, 2010). Increasing numbers of new malware are reported for other platforms, in particular in the emerging area of mobile devices. These reports show that malware is a major security issue and thus a real threat for Internet voting today. In the worst case, malware is capable of taking full control over the infected computer and its user interface and thus to manipulate the voting process and its results in a variety of ways. For example, voters could be fooled by simply changing the order of candidates as shown on the screen. In a Web application, such a simple content-manipulation attack can be realized with a single additional line of malicious JavaScript code. In general, well-conceived malware can be designed to attack a particular voting event of a particular voting application, while remaining completely silent and therefore hard to detect at other times. Moreover, attacks of such a type are easily scalable and can be launched with a few mouse clicks. Since the correct outcome of an election is of great significance for the whole electorate, a single infected computer becomes immediately a problem for everybody. From the perspective of a single voter, taking measures for keeping the personal device clean of malware is therefore not a satisfactory solution.

Complete Chapter List

Search this Book:
Reset