Internet Voting Protocols with Everlasting Privacy
|
|
|
- Jasper Strickland
- 8 years ago
- Views:
Transcription
1 Internet Voting Protocols with Everlasting Privacy Jeroen van de Graaf Joint work with Denise Demirel e Roberto Samarone jvdg@dccufmgbr Lleida, July 2013 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
2 Outline of this talk (1) A looong introduction to internet voting/helios Based on homomorphic encryption (2) Shortcomings of Helios Does not guarantee long-term privacy (3) Our improved protocol Based on homomorphic bit commitments Proofs of correctness ballot somewhat hairy Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
3 The Helios voting system wwwheliosvotingorg internet voting application not for official election good for department head; IACR board of directors; SBC directors developed by Ben Adida, PhD student of Ron Rivest you vote using your browser Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
4 Components of the system Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
5 User perspective (1) The voter receives user name and election-specific password by , and a URL (2) A JavaScript application is downloaded (3) (a) The voter makes a choice; (b) her vote is encrypted (4) The voter can decide to audit the encrypted vote In this case, the browser opens additional information allowing verification of correct encryption Then go back to step 1 (5) (a) The additional information is destroyed; (b) the user authenticates herself and casts the vote (6) The voter receives a confirmation message Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
6 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 u(0) u(1) u(0) Voter 2 u(1) u(0) u(0) Voter V u(0) u(1) u(0) Total u(t 1 ) u(t 2 ) u(t l ) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
7 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 u(0) u(1) u(0) Voter 2 u(1) u(0) u(0) Voter V u(0) u(1) u(0) Total u(t 1 ) u(t 2 ) u(t l ) Counting of the votes is based on homomorphic encryption: u(t 1)u(t 2) = u(t 1 + t 2) The Helios server, with help of the Key Trustees, decrypts the totals to find the results t 1, t 2,, t l where t i = t i (j) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
8 ElGamal encryption Helios implements Cramer-Gennaro-Schoenmakers: (1) Alice choose P, α, x and computes β = α x mod P She publishes P, α, β and keeps x private (2) Bob sends a message m with a random s as follows: E(m, s) = α s, β s m = c 1, c 2 (3) Alice decrypts: m = c 2(c x 1 ) 1 = (β s t)(α s ) x = m Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
9 ElGamal encryption Helios implements Cramer-Gennaro-Schoenmakers: (1) Alice choose P, α, x and computes β = α x mod P She publishes P, α, β and keeps x private (2) Bob sends a message m with a random s as follows: E(m, s) = α s, β s m = c 1, c 2 (3) Alice decrypts: m = c 2(c x 1 ) 1 = (β s t)(α s ) x = m (4) ElGamal preserves multiplication: E(m 1, s 1)E(m 2, s 2) = E(m 1m 2, s 1s 2) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
10 ElGamal encryption Helios implements Cramer-Gennaro-Schoenmakers: (1) Alice choose P, α, x and computes β = α x mod P She publishes P, α, β and keeps x private (2) Bob sends a message m with a random s as follows: E(m, s) = α s, β s m = c 1, c 2 (3) Alice decrypts: m = c 2(c x 1 ) 1 = (β s t)(α s ) x = m (4) ElGamal preserves multiplication: E(m 1, s 1)E(m 2, s 2) = E(m 1m 2, s 1s 2) (5) Exponential ElGamal preserves addition: choose m = δ t then E (t 1, s 1)E (t 2, s 2) = E (t 1 + t 2, s 1s 2) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
11 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 E(t 1(1)) E(t 2(1)) E(t l (1)) Voter 2 E(t 1(2)) E(t 2(2)) E(t l (2)) Voter V E(t 1(V )) E(t 2(V )) E(t l (V )) TOTAL E(t1(j)) E(t2(j)) E(tl (j)) equals E( t 1(j)) E( t 2(j)) E( (t l (j)) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
12 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 E(t 1(1)) E(t 2(1)) E(t l (1)) Voter 2 E(t 1(2)) E(t 2(2)) E(t l (2)) Voter V E(t 1(V )) E(t 2(V )) E(t l (V )) TOTAL E(t1(j)) E(t2(j)) E(tl (j)) equals E( t 1(j)) E( t 2(j)) E( (t l (j)) Pedersen has a protocol for distributed decryption using a distributed, private ElGamal key Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
13 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 E(t 1(1)) E(t 2(1)) E(t l (1)) Voter 2 E(t 1(2)) E(t 2(2)) E(t l (2)) Voter V E(t 1(V )) E(t 2(V )) E(t l (V )) TOTAL E(t1(j)) E(t2(j)) E(tl (j)) equals E( t 1(j)) E( t 2(j)) E( (t l (j)) Pedersen has a protocol for distributed decryption using a distributed, private ElGamal key ElGamal decryption results in m = δ t mod p Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
14 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 E(t 1(1)) E(t 2(1)) E(t l (1)) Voter 2 E(t 1(2)) E(t 2(2)) E(t l (2)) Voter V E(t 1(V )) E(t 2(V )) E(t l (V )) TOTAL E(t1(j)) E(t2(j)) E(tl (j)) equals E( t 1(j)) E( t 2(j)) E( (t l (j)) Pedersen has a protocol for distributed decryption using a distributed, private ElGamal key ElGamal decryption results in m = δ t mod p Finding t is called the Discrete Logarithm problem Discrete Log is difficult in general, but here the values are small Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
15 Security properties of Helios As a result Helios offers Individual verifiability Universal verifiability Unconditional integrity of the vote count Computational privacy of the ballots Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
16 Computational privacy is NOT enough Who did Winston Churchill (George Bush) vote for when he was 18? After decades of trying a dictator gets elected democratically He then goes after all people who voted against him (or their sons and daughters) Your boss at 47 might have been the president of your student association when you were 22 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
17 Reversing the properties is better A voting protocol with Computational integrity of the vote count Unconditional (or everlasting) privacy of the ballot The computational assumption only needs to hold for the duration of the election Once no more appeals are possible, the authorities could make all the secret keys public Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
18 The basic idea Use Pedersen commitments as an alternative encoding of the votes Expressions of the form u(t, s) = α s β t Z p Actually first presented in [CDG87] Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
![in [CDG87] Jeroen van de Graaf Joint work with Denise Demirel einternet](/docs-images/51/14084866/images/page_18.jpg "RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July")
19 Properties of this encoding Homomorphic: u(t 1, s 1)u(t 2, s 2) = α s 1 β t 1 α s 2 β t 2 = α s 1+s 2 β t 1+t 2 = u(t 1 + t 2, s 1 + s 2) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
20 Properties of this encoding Unconditional privacy: u(t, s) = α s β t Z p Proof: Given u, each possible t is equiprobable provided that both α and β are generators and s is chosen randomly in Z p Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
21 Properties of this encoding Decrypting (opening) to a different value is impossible provided Discrete Log is hard Proof: α s 1 β t 1 = α s 2 β t 2 α s 1 s 2 = β t 2 t 1 α = β t 2 t 1 s 1 s 2 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
22 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 u(t 1(1), s 1(1)) u(t 2(1), s 2(1)) u(t l (1), s l (1)) Voter 2 u(t 1(2), s 1(2)) u(t 2(2), s 2(2)) u(t l (2), s l (2)) Voter V u(t 1(V ), s 1(V )) u(t 2(V ), s 2(V )) u(t l (V ), s l (V )) TOTAL u(t1(j), s 1(j)) u(t2(j), s 2(j)) u(tl (j), s l (j)) u 1 u 2 u l Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
23 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 u(t 1(1), s 1(1)) u(t 2(1), s 2(1)) u(t l (1), s l (1)) Voter 2 u(t 1(2), s 1(2)) u(t 2(2), s 2(2)) u(t l (2), s l (2)) Voter V u(t 1(V ), s 1(V )) u(t 2(V ), s 2(V )) u(t l (V ), s l (V )) TOTAL u(t1(j), s 1(j)) u(t2(j), s 2(j)) u(tl (j), s l (j)) u 1 u 2 u l We have that u 1 = α s 1 (j) β t 1 (j) = α s 1 β t 1 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
24 The election web page Voters Cand 1 Cand 2 Cand l Voter 1 u(t 1(1), s 1(1)) u(t 2(1), s 2(1)) u(t l (1), s l (1)) Voter 2 u(t 1(2), s 1(2)) u(t 2(2), s 2(2)) u(t l (2), s l (2)) Voter V u(t 1(V ), s 1(V )) u(t 2(V ), s 2(V )) u(t l (V ), s l (V )) TOTAL u(t1(j), s 1(j)) u(t2(j), s 2(j)) u(tl (j), s l (j)) u 1 u 2 u l We have that u1 = α s 1 (j) β t 1 (j) = α s 1 β t 1 Problem: How to decrypt? We need to recover the si and ti Discrete Log is difficult in general, and here the values are not small Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
25 Enter Paillier encryption Solution: The values s i (j) and t i (j) are sent to the Election Authority over a private channel using suitable homomorphic encryption We choose to use Paillier encryption, which uses an additional random value: v(s, r) = γ s r N mod N 2 w(t, r ) = γ s (r ) N mod N 2 Here N = p 1p 2 is the public key The primes p 1 and p 2 are the private key We will need that (p 1 1)/2 and (q 1 1)/2 are prime too Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
26 Encoding of a vote So the encoding of t takes three random values and has three components, one that is public, and two sent privately to the server: Enc(t, s, r, r ) = u, v, w = α s β t, γ s r N, γ t (r ) N By carefully choosing the groups we get Enc(t 1, s 1, r 1, r 1) Enc(t 2, s 2, r 2, r 2) = Enc(t 1 + t 2, s 1 + s 2, r 1 r 2, r 1 r 2) is componentwise multiplication in Z 4N+1 Z N 2 Z N 2 + is addition in Z N is multiplication in Z N 2 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
27 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
28 Proofs that a vector encoding corresponds to a valid vote When submitting, it must be proven that the vote vector is correctly formatted: (1) all values t i are 0 or 1 (2) i t i = 1 (3) The values s i and t i must be used consistently, that is, the s i and t i used in the unconditional encryption equals the one used in the two homomorphic encryptions (1) and (2) needs to be proven publicly, whereas (3) needs to be proven towards the Helios server only We discuss (2) before (1), then (3) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
29 (2) i t i = 1 Recall that u(t, s) = α s β t = α s β 1, so if well-formatted, then θ(j) := l u i (j)β 1 = α s (j) i=1 where s (j) = l i=1 s i(j) So it is enough to show knowledge of a DL of θ(j) with respect to α Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
30 (2) Proof of knowledge of a Discrete Log Alice 0 θ = α s θ Election Authority 1 θ = α s θ 2 c c is a random challenge 3 θ = g cs+s θ θ =? θ c θ Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
31 (2) Proof of knowledge of a Discrete Log Alice 0 θ = α s θ Election Authority 1 θ = α s θ 2 c c is a random challenge 3 θ = g cs+s θ θ =? θ c θ For c {0, 1}: ZeroKnowledge Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
32 (2) Proof of knowledge of a Discrete Log Alice 0 θ = α s θ Election Authority 1 θ = α s θ 2 c c is a random challenge 3 θ = g cs+s θ θ =? θ c θ For c {0, 1}: ZeroKnowledge For c {1,, p 1}: Schnorr Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
33 (1) all values t i are 0 or 1 Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
34 Consistent use of s and t This can be proven using a standard cut-and-choose protocol: (i) Choose s uniformly random and compute µ = Enc(t, s, r, r ) (ii) Receive challenge bit (iii) Either send s or send s + s (iv) V verifies either whether µ was constructed correctly or whether the u and v components of Enc(t, s, r, r ) µ =? Enc(t, s + s, r, r ) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
35 Assumptions We make the following assumptions: The Discrete Log problem is hard The Paillier encryption is semantically secure The Key Trustees are not conspiring Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
36 Protocol properties Correctness vote count The election outcome is correct, provided the discrete log of β with respect to α cannot be computed before the election result is made public This statement remains true even if the Helios server and the Key Trustees conspire Unconditional privacy For each voter i, the mutual information between the voter s choice, and the public view (receipts, other data on bulletin board) is zero This statement is true as long as a sufficient number of Key Trustees is honest Individual Voter Verifiability Each voter can verify that his vote is included in the tally Universal Verifiability Any observer can verify that the tally was calculated correctly Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
37 The position of an adversary Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
38 Comparison to other work CGS Internet voting, computational assumptions CFSY Internet voting, voter needs secret sharing to many authorities MoranNaor Unconditional privacy but not for internet voting; some techniques used PAV, PS, Merging Unconditional privacy but not for internet voting NIDC Internet voting, inefficient BCs, for voting (at least for now) Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
39 Possible generalizations The construction is generic, meaning that any voting protocol using homomorphic encryption can be modified Similar ideas can be used implement mix networks with everlasting privacy to the public Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
40 Acknowledgement Thank you Dagstuhl / CASED / TU Darmstadt / JBuchmann!! Jeroen van de Graaf Joint work with Denise Demirel einternet RobertoVoting Samarone Protocols (UFMG) with Everlasting Privacy Lleida, July / 30
Verifiable Voting Systems
Chapter 69 Verifiable Voting Systems Thea Peacock 1, Peter Y. A. Ryan 1, Steve Schneider 2 and Zhe Xia 2 1 University of Luxembourg 2 University of Surrey 1 Introduction The introduction of technology
VoteID 2011 Internet Voting System with Cast as Intended Verification
VoteID 2011 Internet Voting System with Cast as Intended Verification September 2011 VP R&D Jordi Puiggali@scytl.com Index Introduction Proposal Security Conclusions 2. Introduction Client computers could
A New Receipt-Free E-Voting Scheme Based on Blind Signature (Abstract)
A New Receipt-Free E-Voting Scheme Based on Blind Signature (Abstract) Zhe Xia University of Surrey z.xia@surrey.ac.uk Steve Schneider University of Surrey s.schneider@surrey.ac.uk May 25, 2006 Abstract
Signature Schemes. CSG 252 Fall 2006. Riccardo Pucella
Signature Schemes CSG 252 Fall 2006 Riccardo Pucella Signatures Signatures in real life have a number of properties They specify the person responsible for a document E.g. that it has been produced by
Verifying a Secret-Ballot Election with Cryptography
Verifying a Secret-Ballot Election with Cryptography Ben Adida PhD Thesis Defense Thesis Committee Ronald L. Rivest, Srini Devadas, Shafi Goldwasser 22 June 2006 Ostraka (sea shells) http://darkwing.uoregon.edu/~klio/im/gr/ath/athen%20-%20ostraka.jpg
3-6 Toward Realizing Privacy-Preserving IP-Traceback
3-6 Toward Realizing Privacy-Preserving IP-Traceback The IP-traceback technology enables us to trace widely spread illegal users on Internet. However, to deploy this attractive technology, some problems
E-Democracy and e-voting
E-Democracy and e-voting How to make them secure and transparent August 2013 Jordi Puiggali CSO and SVP R&D Jordi.puiggali@scytl.com Index Introduction e-democracy Security and Transparency in e-voting
Discrete logarithms within computer and network security Prof Bill Buchanan, Edinburgh Napier
Discrete logarithms within computer and network security Prof Bill Buchanan, Edinburgh Napier http://asecuritysite.com @billatnapier Introduction. Encryption: Public/Private Key. Key Exchange. Authentication.
Cryptography: Authentication, Blind Signatures, and Digital Cash
Cryptography: Authentication, Blind Signatures, and Digital Cash Rebecca Bellovin 1 Introduction One of the most exciting ideas in cryptography in the past few decades, with the widest array of applications,
Two Factor Zero Knowledge Proof Authentication System
Two Factor Zero Knowledge Proof Authentication System Quan Nguyen Mikhail Rudoy Arjun Srinivasan 6.857 Spring 2014 Project Abstract It is often necessary to log onto a website or other system from an untrusted
Paillier Threshold Encryption Toolbox
Paillier Threshold Encryption Toolbox October 23, 2010 1 Introduction Following a desire for secure (encrypted) multiparty computation, the University of Texas at Dallas Data Security and Privacy Lab created
Elements of Applied Cryptography Public key encryption
Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let
Overview of Public-Key Cryptography
CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Public Key Cryptogrophy 1 Roadmap Introduction RSA Diffie-Hellman Key Exchange Public key and
CRYPTOGRAPHY IN NETWORK SECURITY
ELE548 Research Essays CRYPTOGRAPHY IN NETWORK SECURITY AUTHOR: SHENGLI LI INSTRUCTOR: DR. JIEN-CHUNG LO Date: March 5, 1999 Computer network brings lots of great benefits and convenience to us. We can
Capture Resilient ElGamal Signature Protocols
Capture Resilient ElGamal Signature Protocols Hüseyin Acan 1, Kamer Kaya 2,, and Ali Aydın Selçuk 2 1 Bilkent University, Department of Mathematics acan@fen.bilkent.edu.tr 2 Bilkent University, Department
Outline. CSc 466/566. Computer Security. 8 : Cryptography Digital Signatures. Digital Signatures. Digital Signatures... Christian Collberg
Outline CSc 466/566 Computer Security 8 : Cryptography Digital Signatures Version: 2012/02/27 16:07:05 Department of Computer Science University of Arizona collberg@gmail.com Copyright c 2012 Christian
Digital Signatures. Murat Kantarcioglu. Based on Prof. Li s Slides. Digital Signatures: The Problem
Digital Signatures Murat Kantarcioglu Based on Prof. Li s Slides Digital Signatures: The Problem Consider the real-life example where a person pays by credit card and signs a bill; the seller verifies
Cryptanalysis and security enhancement on the generation of Mu-Varadharajan electronic voting protocol. Vahid Jahandideh and Amir S.
72 Int. J. Electronic Governance, Vol. 3, No. 1, 2010 Cryptanalysis and security enhancement on the generation of Mu-Varadharajan electronic voting protocol Vahid Jahandideh and Amir S. Mortazavi Department
Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
Le vote électronique : un défi pour la vérification formelle
Le vote électronique : un défi pour la vérification formelle Steve Kremer Loria, Inria Nancy 1 / 17 Electronic voting Elections are a security-sensitive process which is the cornerstone of modern democracy
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.
Cryptosystems. Bob wants to send a message M to Alice. Symmetric ciphers: Bob and Alice both share a secret key, K.
Cryptosystems Bob wants to send a message M to Alice. Symmetric ciphers: Bob and Alice both share a secret key, K. C= E(M, K), Bob sends C Alice receives C, M=D(C,K) Use the same key to decrypt. Public
Digital Signature. Raj Jain. Washington University in St. Louis
Digital Signature Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Dealing Cards in Poker Games
1 Dealing Cards in Poker Games Philippe Golle Palo Alto Research Center pgolle@parc.com Abstract This paper proposes a new protocol for shuffling and dealing cards, that is designed specifically for games
Digital Identity Management
Digital Identity Management Techniques and Policies E. Bertino CS Department and ECE School CERIAS Purdue University bertino@cs.purdue.edu Digital Identity Management What is DI? Digital identity (DI)
How to prove security of communication protocols?
1/37 Introduction on security protocols Modeling Verification Towards cryptographic guarantees How to prove security of communication protocols? Véronique Cortier, LORIA - CNRS, Nancy Colloquium Morgenstern,
Elements of Applied Cryptography. Key Distribution. Trusted third party: KDC, KTC Diffie-Helmann protocol The man-in-the-middle attack
Elements of Applied Cryptography Key Distribution Trusted third party: KDC, KTC Diffie-Helmann protocol The man-in-the-middle attack Point-to-point key establishment Alice Bob Each pair of users must share
Efficient construction of vote-tags to allow open objection to the tally in electronic elections
Information Processing Letters 75 (2000) 211 215 Efficient construction of vote-tags to allow open objection to the tally in electronic elections Andreu Riera a,,joseprifà b, Joan Borrell b a isoco, Intelligent
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
Secure Electronic Voting
7 th Computer Security Incidents Response Teams Workshop Syros,, Greece, September 2002 Secure Electronic Voting New trends, new threats... Prof.. Dr. Dimitris Gritzalis Dept. of Informatics Athens University
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 9: Authentication protocols, digital signatures Ion Petre Department of IT, Åbo Akademi University 1 Overview of
Computer Science 308-547A Cryptography and Data Security. Claude Crépeau
Computer Science 308-547A Cryptography and Data Security Claude Crépeau These notes are, largely, transcriptions by Anton Stiglic of class notes from the former course Cryptography and Data Security (308-647A)
Digital signatures. Informal properties
Digital signatures Informal properties Definition. A digital signature is a number dependent on some secret known only to the signer and, additionally, on the content of the message being signed Property.
Cryptography Lecture 8. Digital signatures, hash functions
Cryptography Lecture 8 Digital signatures, hash functions A Message Authentication Code is what you get from symmetric cryptography A MAC is used to prevent Eve from creating a new message and inserting
Crittografia e sicurezza delle reti. Digital signatures- DSA
Crittografia e sicurezza delle reti Digital signatures- DSA Signatures vs. MACs Suppose parties A and B share the secret key K. Then M, MAC K (M) convinces A that indeed M originated with B. But in case
Helios: Web-based Open-Audit Voting
Helios: Web-based Open-Audit Voting Ben Adida ben adida@harvard.edu Harvard University Abstract Voting with cryptographic auditing, sometimes called open-audit voting, has remained, for the most part,
Digital Signatures. (Note that authentication of sender is also achieved by MACs.) Scan your handwritten signature and append it to the document?
Cryptography Digital Signatures Professor: Marius Zimand Digital signatures are meant to realize authentication of the sender nonrepudiation (Note that authentication of sender is also achieved by MACs.)
Webmail Using the Hush Encryption Engine
Webmail Using the Hush Encryption Engine Introduction...2 Terms in this Document...2 Requirements...3 Architecture...3 Authentication...4 The Role of the Session...4 Steps...5 Private Key Retrieval...5
MTAT.07.003 Cryptology II. Digital Signatures. Sven Laur University of Tartu
MTAT.07.003 Cryptology II Digital Signatures Sven Laur University of Tartu Formal Syntax Digital signature scheme pk (sk, pk) Gen (m, s) (m,s) m M 0 s Sign sk (m) Ver pk (m, s)? = 1 To establish electronic
Computer Security. Draft Exam with Answers. 2009.
Computer Security Draft Exam with Answers. 2009. Please note that the questions written here are a draft of the final exam. There may be typos in the questions that were corrected in the final version
Ballot Casting Assurance
Ballot Casting Assurance Ben Adida MIT C. Andrew Neff VoteHere Abstract We propose that voting protocols be judged in part on ballot casting assurance, a property which complements universal verifiability.
CIS 6930 Emerging Topics in Network Security. Topic 2. Network Security Primitives
CIS 6930 Emerging Topics in Network Security Topic 2. Network Security Primitives 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange; Hash functions; Application of hash
α α λ α = = λ λ α ψ = = α α α λ λ ψ α = + β = > θ θ β > β β θ θ θ β θ β γ θ β = γ θ > β > γ θ β γ = θ β = θ β = θ β = β θ = β β θ = = = β β θ = + α α α α α = = λ λ λ λ λ λ λ = λ λ α α α α λ ψ + α =
E-Voting Using Helios and election Technologies
From Helios to Zeus GEORGIOS TSOUKALAS, Greek Research and Education Network (GRNET) KOSTAS PAPADIMITRIOU, Greek Research and Education Network (GRNET) PANOS LOURIDAS, Greek Research and Education Network
Secure Network Communication Part II II Public Key Cryptography. Public Key Cryptography
Kommunikationssysteme (KSy) - Block 8 Secure Network Communication Part II II Public Key Cryptography Dr. Andreas Steffen 2000-2001 A. Steffen, 28.03.2001, KSy_RSA.ppt 1 Secure Key Distribution Problem
Crypho Security Whitepaper
Crypho Security Whitepaper Crypho AS Crypho is an end-to-end encrypted enterprise messenger and file-sharing application. It achieves strong privacy and security using well-known, battle-tested encryption
Lecture 6 - Cryptography
Lecture 6 - Cryptography CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07 Question 2 Setup: Assume you and I don t know anything about
Privacy-preserving Data Mining: current research and trends
Privacy-preserving Data Mining: current research and trends Stan Matwin School of Information Technology and Engineering University of Ottawa, Canada stan@site.uottawa.ca Few words about our research Universit[é
Reusable Anonymous Return Channels
Reusable Anonymous Return Channels Philippe Golle Stanford University Stanford, CA 94305, USA pgolle@cs.stanford.edu Markus Jakobsson RSA Laboratories Bedford, MA 01730, USA mjakobsson@rsasecurity.com
Multi-Authority Secret-Ballot Elections with Linear Work
In Advances in Cryptology EUROCRYPT 96, Vol. 1070 of Lecture Notes in Computer Science, Springer-Verlag, 1996. pp. 72-83. Multi-Authority Secret-Ballot Elections with Linear Work Ronald Cramer Matthew
ZQL. a cryptographic compiler for processing private data. George Danezis. Joint work with Cédric Fournet, Markulf Kohlweiss, Zhengqin Luo
ZQL Work in progress a cryptographic compiler for processing private data George Danezis Joint work with Cédric Fournet, Markulf Kohlweiss, Zhengqin Luo Microsoft Research and Joint INRIA-MSR Centre Data
Public Key Cryptography. c Eli Biham - March 30, 2011 258 Public Key Cryptography
Public Key Cryptography c Eli Biham - March 30, 2011 258 Public Key Cryptography Key Exchange All the ciphers mentioned previously require keys known a-priori to all the users, before they can encrypt
Module 7 Security CS655! 7-1!
Module 7 Security CS655! 7-1! Issues Separation of! Security policies! Precise definition of which entities in the system can take what actions! Security mechanism! Means of enforcing that policy! Distributed
Cryptography and Network Security Chapter 10
Cryptography and Network Security Chapter 10 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 10 Other Public Key Cryptosystems Amongst the tribes of Central
A SOFTWARE COMPARISON OF RSA AND ECC
International Journal Of Computer Science And Applications Vol. 2, No. 1, April / May 29 ISSN: 974-13 A SOFTWARE COMPARISON OF RSA AND ECC Vivek B. Kute Lecturer. CSE Department, SVPCET, Nagpur 9975549138
EasyCrypt - Lecture 6 Overview and perspectives. Tuesday November 25th
EasyCrypt - Lecture 6 Overview and perspectives Tuesday November 25th EasyCrypt - Lecture 6 Case studies Verified implementations Automated proofs and synthesis Perspectives 2 Inventaire à la Prevert Examples
Ch.9 Cryptography. The Graduate Center, CUNY.! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis
Ch.9 Cryptography The Graduate Center, CUNY! CSc 75010 Theoretical Computer Science Konstantinos Vamvourellis Why is Modern Cryptography part of a Complexity course? Short answer:! Because Modern Cryptography
CS 758: Cryptography / Network Security
CS 758: Cryptography / Network Security offered in the Fall Semester, 2003, by Doug Stinson my office: DC 3122 my email address: dstinson@uwaterloo.ca my web page: http://cacr.math.uwaterloo.ca/~dstinson/index.html
Network Security Protocols
Network Security Protocols EE657 Parallel Processing Fall 2000 Peachawat Peachavanish Level of Implementation Internet Layer Security Ex. IP Security Protocol (IPSEC) Host-to-Host Basis, No Packets Discrimination
Analysis of an internet voting protocol
Analysis of an internet voting protocol Kristian Gjøsteen March 9, 2010 Abstract The Norwegian government will trial internet voting in the 2011 local government elections. We describe and analyse a simplified
Online Voting Project. New Developments in the Voting System an Consequently Implemented Improvements in the Representation of Legal Principles.
New Developments in the Voting System an Consequently Implemented Improvements in the Representation of Legal Principles. Introduction. Since 2001 T-Systems made research on secure online voting systems
Schnorr Signcryption. Combining public key encryption with Schnorr digital signature. Laura Savu, University of Bucharest, Romania
Schnorr Signcryption Combining public key encryption with Schnorr digital signature Laura Savu, University of Bucharest, Romania IT Security for the Next Generation European Cup, Prague 17-19 February,
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 1 January 9, 2012 CPSC 467b, Lecture 1 1/22 Course Overview Symmetric Cryptography CPSC 467b, Lecture 1 2/22 Course Overview CPSC
Usability Study of the Open Audit Voting System Helios
Usability Study of the Open Audit Voting System Helios Janna-Lynn Weber University of Waterloo Waterloo, Ontario, Canada j6weber@uwaterloo.ca Urs Hengartner University of Waterloo Waterloo, Ontario, Canada
Network Security. Abusayeed Saifullah. CS 5600 Computer Networks. These slides are adapted from Kurose and Ross 8-1
Network Security Abusayeed Saifullah CS 5600 Computer Networks These slides are adapted from Kurose and Ross 8-1 Public Key Cryptography symmetric key crypto v requires sender, receiver know shared secret
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 20 Public-Key Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Public-Key Cryptography
Introduction to Cryptography CS 355
Introduction to Cryptography CS 355 Lecture 30 Digital Signatures CS 355 Fall 2005 / Lecture 30 1 Announcements Wednesday s lecture cancelled Friday will be guest lecture by Prof. Cristina Nita- Rotaru
CUNSHENG DING HKUST, Hong Kong. Computer Security. Computer Security. Cunsheng DING, HKUST COMP4631
Cunsheng DING, HKUST Lecture 08: Key Management for One-key Ciphers Topics of this Lecture 1. The generation and distribution of secret keys. 2. A key distribution protocol with a key distribution center.
Electronic Voting Protocol Analysis with the Inductive Method
Electronic Voting Protocol Analysis with the Inductive Method Introduction E-voting use is spreading quickly in the EU and elsewhere Sensitive, need for formal guarantees Inductive Method: protocol verification
Privacy Preserving Similarity Evaluation of Time Series Data
Privacy Preserving Similarity Evaluation of Time Series Data Haohan Zhu Department of Computer Science Boston University zhu@cs.bu.edu Xianrui Meng Department of Computer Science Boston University xmeng@cs.bu.edu
Web Security: Encryption & Authentication
Web Security: Encryption & Authentication Arnon Rungsawang fenganr@ku.ac.th Massive Information & Knowledge Engineering Department of Computer Engineering Faculty of Engineering Kasetsart University, Bangkok,
Authentication requirement Authentication function MAC Hash function Security of
UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy
On Coercion-Resistant Electronic Elections
On Coercion-Resistant Electronic Elections with Linear Work Stefan G. Weber, Roberto Araújo, Johannes Buchmann Darmstadt University of Technology Department of Computer Science Hochschulstrasse 10, 64289
CS3235 - Computer Security Third topic: Crypto Support Sys
Systems used with cryptography CS3235 - Computer Security Third topic: Crypto Support Systems National University of Singapore School of Computing (Some slides drawn from Lawrie Brown s, with permission)
Module 8. Network Security. Version 2 CSE IIT, Kharagpur
Module 8 Network Security Lesson 2 Secured Communication Specific Instructional Objectives On completion of this lesson, the student will be able to: State various services needed for secured communication
Shor s algorithm and secret sharing
Shor s algorithm and secret sharing Libor Nentvich: QC 23 April 2007: Shor s algorithm and secret sharing 1/41 Goals: 1 To explain why the factoring is important. 2 To describe the oldest and most successful
Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide
![Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide](/thumbs/24/4351346.jpg "Network Security [2] Plain text Encryption algorithm Public and private key pair Cipher text Decryption algorithm. See next slide")
Network Security [2] Public Key Encryption Also used in message authentication & key distribution Based on mathematical algorithms, not only on operations over bit patterns (as conventional) => much overhead
A Secure Decentralized Access Control Scheme for Data stored in Clouds
A Secure Decentralized Access Control Scheme for Data stored in Clouds Priyanka Palekar 1, Abhijeet Bharate 2, Nisar Anjum 3 1 SKNSITS, University of Pune 2 SKNSITS, University of Pune 3 SKNSITS, University
Computing on Encrypted Data
Computing on Encrypted Data Secure Internet of Things Seminar David Wu January, 2015 Smart Homes New Applications in the Internet of Things aggregation + analytics usage statistics and reports report energy
An electronic scheme for the Farnel paper-based voting protocol
An electronic scheme for the Farnel paper-based voting protocol R. Araújo 1, R. Custódio 2, A. Wiesmaier 1, and. akagi 3 1 echnische Universität Darmstadt, Germany 2 George Washington University, USA 3
Public Key (asymmetric) Cryptography
Public-Key Cryptography UNIVERSITA DEGLI STUDI DI PARMA Dipartimento di Ingegneria dell Informazione Public Key (asymmetric) Cryptography Luca Veltri (mail.to: luca.veltri@unipr.it) Course of Network Security,
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
Internet voting feasibility study
Internet voting feasibility study A summary Table of contents Introduction... 2 System functionality... 3 System requirements... 5 Information security... 6 Additional requirements concerning information
Network Security. HIT Shimrit Tzur-David
Network Security HIT Shimrit Tzur-David 1 Goals: 2 Network Security Understand principles of network security: cryptography and its many uses beyond confidentiality authentication message integrity key
3.2: Transport Layer: SSL/TLS Secure Socket Layer (SSL) Transport Layer Security (TLS) Protocol
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Network Layer: IPSec Transport Layer: SSL/TLS Chapter 4: Security on the Application Layer Chapter 5: Security
Storage Systems Autumn 2009
Storage Systems Autumn 2009 Chapter 5: Securely Auditing André Brinkmann Sources Different Publications Slides from Randal Burns, Johns Hopkins University, USA Awkward for large data What s wrong with
Mathematics of Internet Security. Keeping Eve The Eavesdropper Away From Your Credit Card Information
The : Keeping Eve The Eavesdropper Away From Your Credit Card Information Department of Mathematics North Dakota State University 16 September 2010 Science Cafe Introduction Disclaimer: is not an internet
Server-Assisted Generation of a Strong Secret from a Password
Server-Assisted Generation of a Strong Secret from a Password Warwick Ford, VeriSign, Inc. (Joint research with Burt Kaliski, RSA Laboratories) Requirement! User who roams between client terminals needs
Secure Deduplication of Encrypted Data without Additional Independent Servers
Secure Deduplication of Encrypted Data without Additional Independent Servers Jian Liu Aalto University jian.liu@aalto.fi N. Asokan Aalto University and University of Helsinki asokan@acm.org Benny Pinkas
Software Implementation of Gong-Harn Public-key Cryptosystem and Analysis
Software Implementation of Gong-Harn Public-key Cryptosystem and Analysis by Susana Sin A thesis presented to the University of Waterloo in fulfilment of the thesis requirement for the degree of Master
The application of prime numbers to RSA encryption
The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
Practice Questions. CS161 Computer Security, Fall 2008
Practice Questions CS161 Computer Security, Fall 2008 Name Email address Score % / 100 % Please do not forget to fill up your name, email in the box in the midterm exam you can skip this here. These practice
QUANTUM COMPUTERS AND CRYPTOGRAPHY. Mark Zhandry Stanford University
QUANTUM COMPUTERS AND CRYPTOGRAPHY Mark Zhandry Stanford University Classical Encryption pk m c = E(pk,m) sk m = D(sk,c) m??? Quantum Computing Attack pk m aka Post-quantum Crypto c = E(pk,m) sk m = D(sk,c)
SECURITY ANALYSIS OF A SINGLE SIGN-ON MECHANISM FOR DISTRIBUTED COMPUTER NETWORKS
SECURITY ANALYSIS OF A SINGLE SIGN-ON MECHANISM FOR DISTRIBUTED COMPUTER NETWORKS Abstract: The Single sign-on (SSO) is a new authentication mechanism that enables a legal user with a single credential
Efficient Similarity Search over Encrypted Data
UT DALLAS Erik Jonsson School of Engineering & Computer Science Efficient Similarity Search over Encrypted Data Mehmet Kuzu, Saiful Islam, Murat Kantarcioglu Introduction Client Untrusted Server Similarity
Q: Why security protocols?
Security Protocols Q: Why security protocols? Alice Bob A: To allow reliable communication over an untrusted channel (eg. Internet) 2 Security Protocols are out there Confidentiality Authentication Example:
One-Way Encryption and Message Authentication
One-Way Encryption and Message Authentication Cryptographic Hash Functions Johannes Mittmann mittmann@in.tum.de Zentrum Mathematik Technische Universität München (TUM) 3 rd Joint Advanced Student School
Computer Networks. Network Security and Ethics. Week 14. College of Information Science and Engineering Ritsumeikan University
Computer Networks Network Security and Ethics Week 14 College of Information Science and Engineering Ritsumeikan University Security Intro for Admins l Network administrators can break security into two