Logical Analysis and Verification of Cryptographic Protocols - Loria

188 CHAPTER 7. VOTER VERIFIABILITY FOR E-VOTING PROTOCOLS
7.5.2 Traditional ballot box voting example
Our second protocol is similar to the traditional ballot box voting system. A
voter selects her vote and completes the ballot paper accordingly; she then
places the ballot paper anonymously in the ballot box, without recording her
name or any other identification information. This system can be transformed
into an electronic system by publishing a vote ¯vi on the bulletin board. The specification
of this protocol is defined by 〈V, 0, (), (), ()〉 where V � bb〈u〉. Hence we
have that
�V P ({¯v1/u}, . . . , {¯vn/u}) = bb〈¯v1〉 | . . . | bb〈¯vn〉
Such a protocol should obviously not be individually verifiable. We will show
that our definition is indeed violated. The set of irreducible processes {B |
V P (−→ ∗ α −→−→ ∗ ) ∗ B} consists of the set of frames
{σp = {¯vp(1)/x ′ 1 , . . . , ¯vp(n)/x ′ } | n
p is a permutation on {1, . . . , n}}
We suppose that there exist a, b such that a �= b and ¯va = ¯vb, i.e. two voters
cast the same vote. Let k · n be the number of c〈M〉 in � V P ({¯v1/u}, . . . , {¯vn/u}).
It follows that k = 1 and we simply write f instead of f1. By contradiction,
suppose for all σp that there exists f and R IV such that for all i, j and v ′ we have
RIV {v ′ /u, x ′
f(i)/x}σp iff i = j ∧ v ′ = ¯vj. However as ¯va = ¯vb there exist i, j such
that x ′ f(i) σp = x ′ f(j) σp. Hence, we obtain RIV {v ′ /u, x ′
f(i)/x}σp and i �= j ∧ v ′ = ¯vj
which contradicts the hypothesis.
7.5.3 Protocol due to Fujioka, Okamoto & Ohta
Description The protocol [115] involves voters, an administrator and a collector.
The voter computes her ballot b = commit(¯v, r) and sends the signature
sign(blind(b, r ′ ), skV ) with her blind ballot blind(b, r ′ ) to the administrator. The
administrator verifies the signature, signs this blind ballot sign(blind(b, r ′ ), skA)
and returns it. The voter verifies the administrator’s signature and unblinds
the received message to recover the signature of her ballot by the administrator
sign(b, skA). The voter then posts her ballot b and the administrator’s signature
of her ballot sign(b, skA) to the bulletin board. The collector receives
(b, sign(b, skA)) from the bulletin board, verifies the signature and if the verification
succeeds, places (l, b, sign(b, skA)) on the bulletin board. The voter checks
the bulletin board for her entry, discovers l and posts on the bulletin board l
and r. Finally, the collector opens all of ballots on the bulletin board using the
corresponding r’s. To capture the protocol we consider the equational theory E
defined by: