We revisit "silent coercion" where an adversary gains access to a voter's credential without the voter's knowledge in an E2E verifiable, coercion-resistant Internet voting system. We argue that in this setting, casting an intended vote is impossible since the cryptographic backend can no longer distinguish the voter and adversary. However, we affirm that the voter can still act to nullify adversarial ballots, which is preferable to inaction. We provide a new instantiation of nullification using zero-knowledge proofs and multiparty computation, which improves on the efficiency of the current state-of-the-art. We also demonstrate an example voting system-VoteXX-that uses nullification. Our nullification protocol can complement new and existing techniques for coercion resistance (which all require voters to hide cryptographic keys from the coercer), providing a failsafe option for voters whose keys leak.

Any central bank digital currency (CBDC), regardless of the specific architecture and design, should fulfil the following three essential requirements: (a) the CBDC is protected against counterfeiting, and any counterfeits are irrefutably verifiable; (b) payments with CBDC maintain privacy without facilitating criminal activity; (c) CBDC withdrawals and payments can be made with a smartphone, and the smartphone application conforms to current smartphone and network capabilities as well as user interface paradigms. In this paper, we provide explanations, justifications and details of the three requirements.

The 𝒮_ leeve construction proposed by Chaum et al. (ACNS’21) introduces an extra security layer for digital wallets by allowing users to generate a “back up key” securely nested inside the secret key of a signature scheme, i.e., ECDSA. The “back up key”, which is secret, can be used to issue a “proof of ownership”, i.e., only the real owner of this secret key can generate a single proof, which is based on the WOTS+ signature scheme. The authors of 𝒮_ leeve proposed the formal technique for a single proof of ownership, and only informally outlined a construction to generalize it to multiple proofs. This work identifies that their proposed construction presents drawbacks, i.e., varying of signature size and signing/verifying computation complexity, limitation of linear construction, etc. Therefore we introduce WOTSwana, a generalization of 𝒮_ leeve , which is, more concretely, a more general scheme, i.e. an extra security layer that generates multiple proofs of ownership, and put forth a thorough formalization of two constructions: (1) one given by a linear concatenation of numerous WOTS+ private/public keys, and (2) a construction based on tree like structure, i.e., an underneath Merkle tree whose leaves are WOTS+ private/public key pairs. Furthermore, we present the security analysis for multiple proofs of ownership, showcasing that this work addresses the early mentioned drawbacks of the original construction. In particular, we extend the original security definition for 𝒮_ leeve . Finally, we illustrate an alternative application of our construction, by discussing the creation of an encrypted group chat messaging application.

Recently, Chaum et al. (ACNS'21) introduced $$\mathcal {S}_{\text{ leeve }}$$ , which describes an extra security layer for signature schemes, i.e., ECDSA. This distinctive feature is a new key generation mechanism, allowing users to generate a "back up key" securely nested inside the secret key of a signature scheme. Using this novel construction, the "back up key", which is secret, can be used to generate a "proof of ownership", i.e., only the rightful owner of this secret key can generate such a proof. This design offers a quantum secure fallback, i.e., a brand new quantum resistant signature, ready to be used, nested in the ECDSA secret key. In this work, we rely on the original $$\mathcal {S}_{\text{ leeve }}$$ definition to generalize the construction to a modular design based on Tweakable Hash Functions, thus yielding a cleaner design of the primitive. Furthermore, we provide a thorough security analysis taking into account the security of the ECDSA signature scheme, which is lacking in the original work. Finally, we provide an analysis based on formal methods using Verifpal assuring the security guarantees our construction provides.

Recently, Chaum et al. (ACNS’21) introduced 𝒮_ leeve , which describes an extra security layer for signature schemes, i.e., ECDSA. This distinctive feature is a new key generation mechanism, allowing users to generate a “back up key” securely nested inside the secret key of a signature scheme. Using this novel construction, the “back up key”, which is secret, can be used to generate a “proof of ownership”, i.e., only the rightful owner of this secret key can generate such a proof. This design offers a quantum secure fallback, i.e., a brand new quantum resistant signature, ready to be used, nested in the ECDSA secret key. In this work, we rely on the original 𝒮_ leeve definition to generalize the construction to a modular design based on Tweakable Hash Functions, thus yielding a cleaner design of the primitive. Furthermore, we provide a thorough security analysis taking into account the security of the ECDSA signature scheme, which is lacking in the original work. Finally, we provide an analysis based on formal methods using Verifpal assuring the security guarantees our construction provides.

We present and analyze User Discovery with Minimal information disclosure (UDM), a new protocol for user discovery in anonymous communication systems that minimizes the information disclosed to the system and users. UDM solves the following user-discovery problem. User Alice wishes to communicate with Bob over an anonymous communication system, such as cMix or Tor. Initially, each party knows each other's public contact identifier (e.g., email address or phone number), but neither knows the other's private platform identifier in the communication system. If both parties wish to communicate with each other, UDM enables them to establish a shared secret and learn each other's private platform identifier. Unlike existing systems, including those based on private set intersection, UDM learns nothing about the social contacts of the users, is not vulnerable to off-line dictionary attacks that expose contact lists, does not reveal platform identifiers to users without the owner's explicit permission, and enjoys low computation and communication complexity. Using the anonymous communication system, each pair of users who wish to communicate with each other uploads to the user-discovery system their private platform identifier, encrypted with a key derived from their shared secret. Indexing their request by a cryptographic tag derived from their shared secret, each user can then download each other's encrypted private platform identifier. In doing so, UDM uses an untrusted user-discovery system, which processes and stores only public information or values encrypted with keys it does not know. Therefore, from the data values it processes, UDM cannot learn any information about the social contacts of its users.

With the emergence of Bitcoin and recently proposed stablecoins from BigTechs, such as Diem (formerly Libra), central banks face growing competition from private actors offering their own digital alternative to physical cash. We do not address the normative question whether a central bank should issue a central bank digital currency (CBDC) or not. Instead, we contribute to the current research debate by showing how a central bank could do so, if desired. We propose a token-based system without distributed ledger technology and show how earlier-deployed, software-only electronic cash can be improved upon to preserve transaction privacy, meet regulatory requirements in a compelling way, and offer a level of quantum-resistant protection against systemic privacy risk. Neither monetary policy nor financial stability would be materially affected because a CBDC with this design would replicate physical cash rather than bank deposits.

We introduce a new key generation mechanism where users can generate a "back up key", securely nested inside the secret key of a signature scheme. Our main motivation is that in case of leakage of the secret key, established techniques based on zero-knowledge proofs of knowledge are void since the key becomes public. On the other hand, the "back up key", which is secret, can be used to generate a "proof of ownership" , i.e., only the real owner of this secret key can generate such a proof. To the best of our knowledge, this extra level of security is novel, and could have already been used in practice, if available, in digital wallets for cryptocurrencies that suffered massive leakage of account private keys. In this work, we formalize the notion of "Proof of Ownership" and "Fall-back" as new properties. Then, we introduce our construction, which is compatible with major designs for wallets based on ECDSA, and adds a W-OTS+ signing key as a "back up key". Thus offering a quantum secure fallback. This design allows the hiding of any quantum secure signature key pair, and is not exclusive to W-OTS+. Finally, we briefly discuss the construction of multiple generations of proofs of ownership.

Sherman was supported in part by the National Science Foundation under SFS grant DGE-1753681, and by the U.S. Department of Defense under CySP grant H98230-19-1-0308.

The Scantegrity project began with a simple question: is it possible to design a voting system offering the strong security properties of cryptographic end-to-end (E2E) election verification with the intuitive look and feel of a paper optical-scan ballot? This chapter recounts a decade-long research effort toward answering this question, from the design of Scantegrity’s precursor Punchscan, all the way to the first governmental election run by an E2E voting system.

We propose and implement a cryptographically end-to-end verifiable (E2E) remote voting system for absentee voters and report on its deployment in a binding municipal election in Takoma Park, Maryland. Remotegrity is a hybrid mail/internet extension to the Scantegrity in-person voting system, enabling secure, electronic return of vote-by-mail ballots. It provides voters with the ability to detect unauthorized modifications to their cast ballots made by either malicious client software, or a corrupt election authority--two threats not previously studied in combination. Not only can the voter detect such changes, they can prove it to a third party without giving up ballot secrecy.

We present a new model for polling-booth voting: the voter enters the polling booth with a computational assistant which helps her verify that her vote is correctly recorded. The assistant interacts with the voting system while the voter votes on the machine in the polling booth. We present an independently-verifiable, coercion-resistant protocol based on this model. Unlike all other independently-verifiable protocols, this one is completely paperless and does not require the voter to perform any tasks outside the polling booth. We provide property definitions, rigorous claims and a description of a prototype.

Session I: Algorithms and Theory.- Knapsack Public Key Cryptosystems and Diophantine Approximation (Extended Abstract).- Solving Low Density Knapsacks.- Evaluation of the Adleman Attack on Multiply Iterated Knapsack Cryptosystems (Abstract).- On the Power of Cascade Ciphers (Extended Abstract).- The Prisoners' Problem and the Subliminal Channel.- Session II: Modes of Operation.- An Overview of Factoring.- New Ideas for Factoring Large Integers.- Factoring Numbers on the Massively Parallel Computer.- Factorization Using the Quadratic Sieve Algorithm.- Session III: Protocols and Transaction Security.- Signatures through Approximate Representations by Quadratic Forms (Extended Abstract).- A Simple Protocol for Signing Contracts.- Reducibility among Protocols (Extended Abstract).- How to Exchange Half a Bit.- Blind Signature System (Abstract).- Session IV: Applications.- A Layered Broadcast Cryptographic System.- Analytical Characteristics of the DES.- Producing a One-Way Hash Function from DES.- On the Security of Compressed Encodings.- Field Encryption and Authentication.- Shift-Register Synthesis (Modulo m) (Abstract).- Session V: Special Session on Cryptanalysis.- Probabilistic Analysis and Performance Modelling of the 'Swedish' Algorithm and Modifications.- A Subexponential-Time Algorithm for Computing Discrete Logarithms over GF(p2).- Permutation Polynomials in RSA-Cryptosystems.- Some Results on the Information Theoretic Analysis of Cryptosystems.- Rump Session: Impromptu Talks.- Improving the Security of Exponential Key Exchange.- RSA Bits Are 732+? Secure (Preliminary Abstract).- Use of the 'Signature Token' to Create a Negotiable Document.- Electronic Wallet.- Design Concepts for Tamper Responding Systems.- Author Index.

Building on lessons learned from the November 2009 Scantegrity II election in Takoma Park, MD, we propose improvements to the Scantegrity II voting system that (1) automatically print trustworthy receipts for easier on-line verification, (2) highlight ballot features including over/under votes to comply with the Help America Vote Act, and (3) achieve full voter verifiability by eliminating print audits. We call the improved voting system Scantegrity III, which features a new ballot style and a special casting station that highlights ballots and prints receipts. Scantegrity III addresses the major limitations of Scantegrity II and delivers the feature most requested by voters and election officials at the Takoma Park election: printing receipts automatically. We present, analyze, and compare three designs for a Scantegrity receipt printer: a simple image duplicator available to voters in an optional separate station before casting; a mark sense translator, connected to the official ballot scanner, which reads encrypted codenumbers printed on the ballot; and the Scantegrity III casting station, which is an embellished mark sense translator. At the Scantegrity III station, voters cast ballots that include both Scantegrity II codes in invisible ink and Scantegrity I codes in conventional ink; this combination of codes enables print audits to be eliminated. We also design a Trusted Platform Module (TPM) enhancement to bolster privacy, to store keys and verification codes, and to ensure that the correct software is booted. Election integrity does not depend on the correct operation of the TPM. Receipt printers reduce the amount of special voter instruction required, improve accessibility, enable each voter to detect if any additional mark is added to her ballot after casting, and make vote verification easier.