Electronic voting schemes are often criticized for being insecure, on the grounds that a successful attack would allow an adversary to manipulate all votes at once. It is argued that attacks therefore have a higher impact at lower adversary costs compared to paper-based schemes, where attacks are cumbersome. In this paper, we propose a framework to quantify how prone different protocols are to attacks that scale well. For this purpose, we introduce the notion of scalability of attacks. We give the adversary access to an oracle which can break common cryptographic building blocks and assumptions and analyze how many inputs of a (multiparty computation) protocol they can learn or manipulate for each oracle access. The more inputs are affected, the more susceptible the protocol is to attacks that scale well. We compare several pairs of protocols solving the same problem in different ways in three examples and analyze the scalability of attacks on each protocol. We find that some protocols have a fatal breakdown, i.e. all inputs are affected with only one access to the oracle, while other protocols scale linearly or have a threshold, where the number of affected inputs increases drastically from one access to the other. Our framework provides strong arguments in favoring one voting scheme over another. It enables voting authorities to compare schemes that appear equally secure at first glance, and to consider the scalability of attacks when deciding on a scheme.
In 2024, Harrison and Haines examined the applicability of STARKs in the context of homomorphically tallied elections. While their work ensures the Recorded-as-Cast and Tallied-as-Recorded properties of a voting system, it lacks Cast-as-Intended verification and does not provide a coercion mitigation mechanism. In this work, we address these challenges and propose an updated voting protocol that achieves all three verification properties, at the same time providing coercion resistance by allowing re-voting. Our approach leverages vector commitment schemes with update mechanisms. We implement our protocol and provide comparative benchmarks to the Harrison and Haines solution. Our approach significantly outperforms the latter, allowing processing a considerably larger number of votes within the same hardware limits.
Estonia's nationwide Internet-voting scheme relies on the state-mandated electronic identity (eID) infrastructure for strong voter authentication and qualified electronic signatures. A statutory safeguard against coercion is re-voting: a voter may cast multiple electronic ballots during the advance-voting period, with only the last one counted, and the number of ballots must remain secret. This expectation is violated by current eID audit practice: every signing transaction-including each vote-is irrevocably logged by the eID service provider and displayed to the credential holder. These logs reveal the exact count and timing of a voter's interactions with the voting system, compromising the intended secrecy of re-voting and enabling coercers to detect whether the voter has changed their choice. This paper presents a threat model and examines concrete design alternatives-such as persistent log filtering, dedicated voting credentials, and offline signing-analysing their respective trade-offs in security, usability, regulatory compliance, and system complexity. The findings demonstrate how well-intentioned components can interact to break coercion resistance through a metadata-based side-channel. The identified vulnerability has been responsibly disclosed to the relevant Estonian authorities. The case underlines the need for composition-aware risk assessment whenever election systems depend on external digital infrastructures.
High levels of abstention in elections are often caused by the distance to polling stations. This is particularly prominent for voters who are traveling or have recently relocated. A promising solution to this problem is "anywhere voting", which allows citizens to cast their votes at any polling station. However, existing implementations typically rely on Internet-connected authentication to avoid double voting. Albeit simple, this approach is often seen as impractical in many scenarios, especially in remote regions where Internet access is unreliable or when the risk of denial-of-service attacks is high. In this article, we study how anywhere voting could be adapted to such constrained environments. Using Brazil as a case study-given its vast territory, regional disparities, and infrastructural challenges-we evaluate four potential solutions. Our analysis suggests that the most viable approach involves preventing double voting through secure hardware, while eliminating residual duplicates via mixnets and threshold cryptography.
We propose two novel voter authentication attacks in the context of the 2022 Ontario Municipal Election, which offered online voting to almost four million voters in over 200 municipalities. One attack exploits a misconfiguration in one of the voting portals used by up to one million voters. It was mitigated through a successful coordinated vulnerability disclosure that we conducted with the affected vendor during the election period. The other attack exploits widespread and insecurely discarded login credentials. This attack affects the vast majority of the deployments examined, and we study and quantify the risk for each city individually. In both cases, the risks were aggravated by unique, context-dependent factors, which we detail. Finally, toward quantifying this risk, and absent the availability of this data elsewhere, we present a comprehensive census of online deployments used in the province.
While internet voting can enhance democratic participation, concerns about voter coercion have emerged due to the uncontrolled voting environment. To mitigate this, researchers have proposed different types of counter-strategies, allowing voters to cast their intended vote despite being coerced. We conduct semi-structured interviews (N=26) to investigate voters' perceptions of six types of counter-strategies concerning their effectiveness. Our findings show that the voter's perception of the effectiveness of counter-strategies depends on both the technical and personal skills of voters, concrete risks, and ease of use. Overall, our findings pave the way for future research aimed at developing user-friendly solutions that are effective against voter coercion.
We revisit "silent coercion" where an adversary gains access to a voter's credential without the voter's knowledge in an E2E verifiable, coercion-resistant Internet voting system. We argue that in this setting, casting an intended vote is impossible since the cryptographic backend can no longer distinguish the voter and adversary. However, we affirm that the voter can still act to nullify adversarial ballots, which is preferable to inaction. We provide a new instantiation of nullification using zero-knowledge proofs and multiparty computation, which improves on the efficiency of the current state-of-the-art. We also demonstrate an example voting system-VoteXX-that uses nullification. Our nullification protocol can complement new and existing techniques for coercion resistance (which all require voters to hide cryptographic keys from the coercer), providing a failsafe option for voters whose keys leak.
As digitalization advances, online elections are becoming increasingly prevalent. State-of-the-art internet voting systems implement verifiability, which allows to observe the election result to be correct, while safeguarding the secrecy of the election. However, the continued use of unverifiable 'black-box' systems suggests that election organizers may be unaware of the security challenges in internet voting and the mitigation strategies that have been developed. To address this gap, we developed an informative video on the topic for election organizers who are non-experts in internet voting. To ensure that the simplifications made for our target audience do not lead to misunderstandings, 19 German-speaking internet voting experts evaluated the video. Based on their feedback, we consider improvements to the video to enhance its correctness, clarity, and completeness. Further, developing the video and then performing the expert evaluation provided valuable experiences and lessons learned we want to share with similar endeavours trying to simplify complex topics for non-expert audiences.
Proving the validity of ballots is a central element of verifiable elections. Such proofs can however create challenges when one desires to make a protocol receipt-free. We explore the challenges raised by validity proofs in the context of protocols where threshold receipt-freeness is obtained by secret sharing an encryption of a vote between multiple authorities. In such contexts, previous solutions verified the validity of votes by decrypting them after passing them through a mix-net. This approach however creates subtle privacy risks, especially when invalid votes leak structural patterns that threaten receipt-freeness. We propose a different approach of threshold receipt-free voting in which authorities re-randomize ballot shares then jointly compute a ZK proof of ballot validity before letting the ballots enter a (possibly homomorphic) tallying phase. Our approach keeps the voter computational costs limited while offering verifiability and improving the ballot privacy of previous solutions. We present two protocols that enable a group of servers to verify and publicly prove that encrypted votes satisfy some validity properties: , which preserves prior voter-side behavior with minimal overhead, and , which requires voters to submit auxiliary data to facilitate validation over large vote domains. We show how to use our two protocols within a threshold receipt-free voting framework. We provide formal security proofs and efficiency analyses to illustrate trade-offs in our designs.
ONEAudit provides more efficient risk-limiting audits than other extant methods when the voting system cannot report a cast-vote record linked to each cast card. It obviates the need for re-scanning; it is simpler and more efficient than ‘hybrid’ audits; and it is far more efficient than batch-level comparison audits. There may be room to improve the efficiency of ONEAudit further by tuning the statistical tests it uses and by using stratified sampling. We show that tuning the tests by optimizing for the reported batch-level tallies or integrating over a distribution reduces expected workloads by 70–85
This paper takes a critical look at the recommendations OSCE/ODIHR has given for the Estonian Internet voting over the 20 years it has been running. We present examples of recommendations that can not be fulfilled at all, but also examples where fulfilling a recommendation requires a non-trivial trade-off, potentially weakening the system in some other respect. In such cases OSCE/ODIHR should take an explicit position which trade-off it recommends. We also look at the development of the recommendation to introduce end-to-end verifiability. In this case we expect OSCE/ODIHR to define what it exactly means by this property, as well as to give explicit criteria to determine whether and to which extent end-to-end verifiability has been achieved.
Overseas military personnel often face significant challenges in participating in elections due to the slow pace of traditional mail systems, which can result in ballots missing crucial deadlines. While internet-based voting offers a faster alternative, it introduces serious risks to the integrity and privacy of the voting process. We introduce the MERGE protocol to address these issues by combining the speed of electronic ballot delivery with the reliability of paper returns. This protocol allows voters to submit an electronic record of their vote quickly while simultaneously mailing a paper ballot for verification. The electronic record can be used for preliminary results, but the paper ballot is used in a Risk Limiting Audit (RLA) if received in time, ensuring the integrity of the election. This approach extends the time window for ballot arrival without undermining the security and accuracy of the vote count.
For more than forty years, two principal questions have been asked when designing verifiable election systems: how will the integrity of the results be demonstrated and how will the privacy of votes be preserved? Many approaches have been taken towards answering the first question such as use of mixnets and homomorphic tallying. But, in the case of large-scale elections, the second question has always been answered in the same way: decryption capabilities are divided amongst multiple independent "trustees" so that a collusion is required to compromise privacy. In practice, however, this approach can be fairly challenging to deploy. Even if multiple human trustees are chosen, they typically use software and often also hardware provided by a single voting system supplier, and they rarely have any real opportunity to confirm its correctness. As a result, we observe that trustees are generally not in a position to exercise the independent judgment necessary to ensure privacy. This Systematization of Knowledge (SoK) paper looks at several aspects of the trustee experience. It begins by surveying and discussing various cryptographic protocols that have been used for key generation in elections, explores their impact on the role of trustees, and notes that even the theory of proper use of trustees is more challenging than it might seem. This is illustrated by showing that one of the only references defining a full threshold distributed key generation (DKG) for elections defines an insecure protocol. Belenios, a broadly used open-source voting system, claims to rely on that reference for its DKG and security proof. Fortunately, it does not inherit the same vulnerability, and we offer a security proof for the Belenios DKG. The paper then discusses various practical contexts, in terms of humans, software, and hardware, and their impact on the practical deployment of a trustee-based privacy model.
