Voting over the Internet on an Insecure Platform

Introduction

In Internet voting, personal devices used by voters for casting their votes are not under the control of the election authority. The overall security of the voting system is therefore dependent on the correct functioning of these devices, even if the underlying cryptographic protocol and system implementation guarantee the highest possible security properties. In the vote casting phase, most existing cryptographic voting protocols include steps like “the voter encrypts the candidate choice with the authority’s public key,” “the voter provides a non-interactive zero-knowledge proof of knowledge of the encryption randomization,” or similar. This is easily said, but far more complicated to realize in practice. To perform the complex mathematical computations of such cryptographic operations, voters must have access to reliable computers. Given the manifold vulnerabilities of current computers and system software, particularly those caused by malicious software, this assumption should not be taken for granted in general. This is the so-called secure platform problem (Schläpfer & Volkamer, 2012), which is difficult to solve in general, but particularly challenging in the area of Internet voting.

In a recent report, the number of new Windows-based malware in 2010 is estimated as more than two million (Benzmüller & Berkenkopf, 2010). Increasing numbers of new malware are reported for other platforms, in particular in the emerging area of mobile devices. These reports show that malware is a major security issue and thus a real threat for Internet voting today. In the worst case, malware is capable of taking full control over the infected computer and its user interface and thus to manipulate the voting process and its results in a variety of ways. For example, voters could be fooled by simply changing the order of candidates as shown on the screen. In a Web application, such a simple content-manipulation attack can be realized with a single additional line of malicious JavaScript code. In general, well-conceived malware can be designed to attack a particular voting event of a particular voting application, while remaining completely silent and therefore hard to detect at other times. Moreover, attacks of such a type are easily scalable and can be launched with a few mouse clicks. Since the correct outcome of an election is of great significance for the whole electorate, a single infected computer becomes immediately a problem for everybody. From the perspective of a single voter, taking measures for keeping the personal device clean of malware is therefore not a satisfactory solution.