Logical Analysis and Verification of Cryptographic Protocols - Loria

192 CHAPTER 7. VOTER VERIFIABILITY FOR E-VOTING PROTOCOLS
Analysis Let tests R IV , R UV be given as in Figure 7.3. The tests make the following
assumptions. The variable x1 corresponds to the public/secret keys sent
to the voter by the key distribution process; x2 is the voter’s randomised ballot;
and x3 is the signed ballot produced by the randomisation service along with
a designated verifier proof demonstrating the correctness of the re-encryption.
The value x4 is the voter’s double signed ballot and finally x5 corresponds to the
public keys published by the keying process. Additionally R UV assumes that for
all i ∈ {1, . . . , n} we have y1,i corresponds to the ballot recovered from the double
signed ballot produced by the voter; y2,i is a signature proof of knowledge
revealing the ballot’s decryption key; and finally y3,i is the decryted ballot (i.e.
the ith voter’s vote).
Suppose � V P (1, . . . , n)(−→ ∗ α −→−→ ∗ ) ∗ ν ñ.(σ | Q) such that Q is irreducible and
dom(σ) = {x ′ 1, . . . , x ′ 6·n}. Without loss of generality we have σ as specified in
Figure 7.3. Let ˜ f be given by fi(j) = l(i−1)·n+j. It follows that:
1. Individual verifiability. The expansion of R IV Φ is provided in Figure 7.3.
The result follows immediately since R IV Φ has a single solution for
i1, . . . , i6, j namely i1 = i2 = . . . = i6 = j and v ′ = ¯vj.
2. Universal verifiability. We observe R UV {˜v ′ /ũ, ˜x ′ f1/˜x1, . . . , ˜x ′ f k/˜xk}σ evaluates
to the following for all i ∈ {1, . . . , n}:
y1,i = b ′ i ∧ Ver1,3(FL, y2,i)∧
y1,i = Public3(y2,i) ∧ P k(skT ) = Public1(y2,i)∧
y3,i = dec(y1,i, Public2(y2,i)) ∧ v ′ i = y3,i
where b ′ i = penc(¯vi, f(ri, r ′ i), P k(skT )). It follows that R UV Φ holds when
˜v ′ = (¯v1, . . . , ¯vn) and
τ =E {b ′ 1/y1,1, . . . , b ′ n/y1,n, s1/y2,1, . . . , sn/y2,ns¯v1/y3,1, . . . , ¯vn/y3,n}
with si = SPK1,3((skT ), (pkT , commit(b ′ i, skT ), b ′ i), FL), concluding our proof.
Moreover, we have � V P ({¯v1/u}, . . . , {¯vn/u})(−→ ∗ α −→−→ ∗ ) ∗ ϕ such that dom(ϕ) =
{x ′ 1, . . . , x ′ 6·n}.
7.6 Relates works
The literature is rich in works dealing with formal verification of security protocols.
However, there are only few formal works [30, 77, 97, 196, 136, 149] related
to electronic voting protocols. This is mainly due to their lack of maturity compared
to other ones such as key distribution or authentication protocols, and to