Schneier on Security
Follow
Security Analysis of the MERGE Voting Protocol
The MERGE protocol is a recently published system designed for use in the CAC-vote system, which allows voters to cast ballots over the internet and receive a paper ballot by mail. The votes transmitted online are used to determine preliminary results, while audits and recounts rely on the paper ballots received on time. The main motivation behind the protocol is to include overseas military voters' electronic votes in preliminary results before their paper ballots arrive. Although the MERGE protocol contains some interesting ideas, it is not inherently trustworthy and would require significant changes to laws, practices, and technical abilities of US election jurisdictions. The gap between the theoretical concept and practical implementation is substantial and unlikely to be bridged in the near future. The system relies on internet voting, which poses significant security risks, and should not be considered trustworthy without major reforms. Promoters of the research project, sponsored by DARPA, should acknowledge the limitations of the MERGE protocol. They should refrain from claiming that it can be a component of trustworthy elections without sweeping changes to election law and administration. The MERGE protocol is not a viable solution for secure and trustworthy elections in its current form. Overall, the system's flaws and limitations make it unsuitable for use in US elections without significant modifications.