Trail of Bits Blog
Follow
The cryptography behind electronic voting (and why paper ballots are still essential)
Paper ballots remain the preferred method for U.S. midterms due to security concerns, despite advancements in electronic systems for banking and other tasks. While cryptography can secure electronic voting by keeping votes secret and making tallies verifiable, systems like Helios and ElectionGuard have limitations. Helios targets lower-risk settings, and ElectionGuard supplements, rather than replaces, paper systems.The National Academy of Sciences advises against online voting for general elections due to unproven security, secrecy, and verifiability. Election systems must ensure voter privacy, ballot integrity, prevent multiple votes, and provide verifiable results. Paper-based systems address these through physical security measures such as voter identification, private ballot filling, and direct submission, making large-scale fraud difficult and detectable.Electronic systems introduce a significant risk: a single vulnerability could compromise an entire election without detection. Software independence, achieved through independently verifiable evidence like paper audit trails, is crucial to detect software errors affecting election outcomes. Helios and ElectionGuard demonstrate how cryptography can protect privacy and integrity.They use threshold-shared homomorphic encryption, splitting decryption keys among multiple officials and allowing encrypted tallying to prevent single points of failure. Exponential ElGamal encryption, with zero-knowledge proofs, ensures ballot values are legitimate. To counter client compromise, Benaloh’s challenge method allows voters to verify their choices were recorded correctly by challenging and spoiling ballots.This method, however, requires active participation from a significant portion of voters to be effective and doesn’t prevent covert data exfiltration. Further challenges include voter authentication in countries without national IDs and preventing coercion, especially with geographically dispersed voting stations. These complexities underscore why a full transition to electronic voting remains challenging.