Logical Analysis and Verification of Cryptographic Protocols - Loria

7.5. CASES STUDIES 189
sdec(senc(x, y), y) = x
open(commit(x, y), y) = x
checksign(sign(x, y), x, P k(y)) = true
unblind(blind(x, y), y) = x
unblind(sign(blind(x, y), z), y) = sign(x, z)
nth j
i ((x1, . . . , xj)) = xi if i ≤ j.
Applied pi formalism The voting specification of this protocol is represented
by 〈voter, keying, ˜s, ˜t, ˜m〉 where ˜s = (r, r ′ ), ˜t = (skV ), ˜m = (a). The voter and
keying processes are defined below.
voter � a(skV , pkA)
let b = commit(u, r) in
c〈P k(skV ), blind(b, r ′ ), sign(blind(b, r ′ ), skV )〉
c(x)
if checksign(x, blind(b, r ′ ), pkA) = true then
let sb = unblind(x, r ′ ) in
bb〈b, sb〉
bb(l, y, z)
if y = b ∧ z = sb then
bb〈l, r〉
keying � a〈skV , P k(skA)〉 | bb〈P k(skV ), P k(skA)〉
Analysis Let tests R IV and R UV be given in Figure 7.2. R IV expects that x1 corresponds
to the public keys published by the keying authority; x2 corresponds
to the private/public keys sent to the voter by the keying authority using a private
channel; and x3 is the voter’s signed blinded ballot. The variable x4 should
correspond to the voter’s blinded ballot signed by the administrator; and x5 is
the unblinded signed ballot. Finally, x7 is expected to refer to the commitment
factor used during the protocol. The test R IV ensures that all values are provided
as expected and R UV checks that opening the ballots reveals the votes
corresponding to the published outcome.
Suppose � V P (1, . . . , n)(−→ ∗ α −→−→ ∗ ) ∗ B such that B is irreducible, φ(B) = ν ñ.σ,
dom(σ) = {x ′ 1, . . . , x ′ 7·n} and σ is as defined in Figure 7.2. Let f1, . . . , f7 be given
by fi(j) = l(i−1)·n+j. It follows that:
1. Individual verifiability. The result follows immediately since R IV Φ has a
single solution for i1, . . . , i7, j, v ′ namely i1 = . . . = i7 = j and v ′ = ¯vj. The
result of R IV Φ is provided in Figure 7.2.