Logical Analysis and Verification of Cryptographic Protocols - Loria

186 CHAPTER 7. VOTER VERIFIABILITY FOR E-VOTING PROTOCOLS
board from the administrators). To model the possibility of dishonest administrators,
we allow the attacker to supply ˜y by means of the substitution
τ. The test is required to return true if and only if the declaration
corresponds to the votes actually cast.
Definition 60 (Voter verifiability) A voting process specification 〈V, P, ˜s, ˜t, ˜m〉 satisfies
voter verifiability if and only if for all n and votes ¯v1, . . . , ¯vn of type Candidate,
there exist tests R IV , R UV , such that (fv(R IV ) ∪ fv(R UV )) ∩ {x ′ 1, x ′ 2, . . .} = fn(R IV ) ∪
fn(R UV ) = ∅ and for all irreducible extended processes B where φ(B) = ν ñ.σ,
if
a) � V P ({¯v1/u}, . . . , {¯vn/u})(−→ ∗ α −→−→ ∗ ) ∗ B; and
b) dom(σ) = {x ′ 1, . . . , x ′ k·n };
where k is defined such that k · n is the number of occurrences of c〈M〉 in
�V P ({¯v1/u}, . . . , {¯vn/u}) for c �∈ ñ,
then there exists injective maps f1, . . . , fk : {1, . . . , n} → {1, . . . , k · n} where the
ranges of f1, . . . , fk are pairwise disjoint and the conditions below are satisfied.
Moreover, we require the existence of B satisfying Conditions a) & b).
1. Individual verifiability. For all i1, . . . , ik, j, v ′ we have:
R IV {v ′
/u, x ′
f1(i1)/x1, . . . , x ′
fk(ik)/xk, ˜s ′ j/˜z}σ
⇔ i1 = i2 = . . . = ik = j ∧ v ′ = ¯vj
where ˜s ′ j = (s1,j, . . . , s|˜s|,j, kpcj).
2. Universal verifiability. For all ˜v ′ we have:
∃τ.(dom(σ) ∩ dom(τ) = ∅ ∧
R UV {˜v ′
/ũ, ˜x ′ f1/˜x1, . . . , ˜x ′ f k/˜xk}τ ◦ σ)
⇔ ˜v ′ = (¯v1, . . . , ¯vn)
We recall that � V P is a modification of V P which stores all inputs the voter receives
on the frame. Public channel inputs a(x) are stored without modifications,
whereas private channel inputs a ′ (y) are stored in the form senc(y, k). The
RIV test for the original protocol V P can be extracted by replacing such inputs
x and y into the test.
For convenience we use the shorthand RIV Φ for
RIV {v ′ /u, x ′
f1(i1)/x1, . . . , x ′
fk(ik)/xk, ˜sj/˜z}σ.
Similarly we write RUV Φ for RUV {˜v ′ /ũ, ˜x ′ f1/˜x1, . . . , ˜x ′ fk/˜xk}τ ◦ σ.