A quantum secret ballot. Abstract

Transcription

1 A quantu secret ballot Shahar Dolev and Itaar Pitowsky The Edelstein Center, Levi Building, The Hebrerw University, Givat Ra, Jerusale, Israel Boaz Tair arxiv:quant-ph/060087v 8 Mar 006 Departent of Philosophy of Science, Bar-Ilan University, Raat-Gan, Israel. Abstract The paper concerns the protection of the secrecy of ballots, so that the identity of the voters cannot be atched with their vote. To achieve this we use an entangled quantu state to represent the ballots. Each ballot includes the identity of the voter, explicitly arked on the envelope containing it. Measuring the content of the envelope yields a rando nuber which reveals no inforation about the vote. However, the outcoe of the elections can be unabiguously decided after adding the rando nubers fro all envelopes. We consider a few versions of the protocol and their coplexity of ipleentation. Electronic address: shahar@dolevi.org Electronic address: itaarp@vs.huji.ac.il Electronic address: canjl@actco.co.il

2 I. INTRODUCTION Assue n parties participate in a vote to decide between a few alternatives. Each participant chooses his or her preference, designates it on the ballot, and puts in in the box. There are various ways in which the secrecy of the vote can be coproised, and we shall be particularly interested in the case of arked ballots. In this conspiracy the ballot is ade to include the voter s identity, by secretly arking it prior to the vote or during it. To choose a rather paranoid scenario: Big Brother finds traces of the voter s DNA on the paper ballot. Or, in the case of an electronic ballot, a string containing the voter s identity, which has just been varified prior to voting, is stored together with the vote. In this paper we use entangled qbits to prevent such schees. Each ballot ay very well include the identity of the voter, explicitly arked on the envelope containing it. However, this is inconsequential because reading the contents of the envelope rveals a rando nuber, and no inforation about the vote. On the other hand, the outcoe of the elections can be unabiguously decided after adding the rando nubers fro all envelopes. A few quantu voting protocols have been proposed recently: Singh and Srikanth [] suggested to use a quantu version of sealed envelopes; any attept to read their content by unauthorised persons can be detected. Vaccaro et.al. [] proposed a voting schee in which the nuber of votes is coded into the phases of an entangled state and reading the result involves a coplicated easureent. A protocol ore siilar to the present one has been proposed by Hillery et.al. [3]. In their protocol the election result is also encoded into the phases of a quantu state, and its reading involves a coplicated easureent. Our echanis is different fro [3] in various respects which will be noted below. In particular, the voting result is coded and read directly fro the coputation basis states. The protocol can be ipleented as soon as the ipleentation of the discrete Fourier transfor becoes possible. We begin with a protocol for a vote to decide between two alternatives. Although the protocol is valid for any nuber of voters n, its ipleentation ay be coplicated when thousands of citizens participate in the elections. To aend this situation we also propose an alternative version, whose coplexity depends on the nuber of ballot boxes. The security of the protocol reains intact provided this nuber is. Subsequently, the schee is generalized to include a choice between ore than two alternatives. Finally, the

3 coplexity of ipleentation is calculated. II. THE PROTOCOL Let be a natural nuber. Consider an diensional space with basis vectors: 0,,...,. The -th order discrete Fourier transfor is defined to be F j = l=0 exp( πijl ) l, j = 0,,..., () Subsequently we shall suppress the subscript, and denote the Fourier transfor by F. Let Π be the unitary operator which defines the following cyclic perutation on the basis eleents: Π 0 =, Π =,..., Π = 0 () or, in short Π j = j where represents addition od. Suppose that we distribute aong n voters the entangled state W = j j... j (3) where each j is an -diensional basis state, and each product in the su (3) contains n copies. The relation between n and will be fixed later. Each voter has to vote either NO, in which case he applies F to his bit; or YES, in which case she applies ΠF (that is, F followed by Π). Suppose the votes were a, a,..., a n, with a k = 0 in case of a NO vote by person k, and a k = in case of a YES vote. Put Π 0 = I (identity) and Π = Π, then after the vote the state is: V = (Π a F) (Π a F)... (Π an F) W = (4) = (Π a F) j (Π a F) j... (Π an F) j = ( = Π a l =0 exp( πijl ) l ) (... Π an l n=0 exp( πijl n ) l n ) Hillery et. al. [3] use the sae initial state W, apply F for the YES vote and I (identity) in the NO vote. The election outcoe is then recorded in the phases of a coplicated state. 3

4 Perforing the tensor product we get: V = V = n+ n l,...,l n l,...,l n exp exchanging the order of suation ( ( ) πij (l l n ) l a... l n a n (5) ( ) ) πij exp (l l n ) l a... l n a n (6) Unless l l n 0(od) we have exp ( πij (l l n ) ) = 0. Hence the result of the vote is V = n l +...+l n 0(od ) l a... l n a n (7) Now, we easure the basis vectors and add the results od. Since l +...+l n 0(od) for every coponent in the superposition in Eq.(7), we are left with the outcoe a a n (od). III. APPLICATIONS. In the siplest case we choose > n, preferably we let be the sallest power of two greater than n, so we can use qbits. Then, after adding the easureent results od, we siply get a a n, which is the nuber of YES votes. The secrecy of the vote is aintained because every individual ballot l r a r contains the actual vote a r added od to a rando nuber l r between 0 and. Note that the ballots are not ixed, and it ay be public knowledge that the ballot l r a r coes fro voter r (we ay even attach an extra probe carrying his or her nae). However, this inforation is inconsequential, it only reveals the fact that person r participated in the poll. Actually, we do not have to know in advance how any people will vote, just choose n to be sufficiently large. Since at the end of election day we know the exact nuber of people who participated, we push the NO button as any ties as required to reach n. After the easureent we subtract the nuber of fictional votes and announce the election results. There is a classical protocol which is siilar to the quantu ballot, but is nevertheless less secure: A sequence of n rando nubers (l,..., l n ) is generated and their su y = l +...+l n stored. When citizen r is voting a r, the electronic voting achine stores only the nuber 4

5 l r + a r. This way the privacy of the vote is protected. At the end of the day the stored nubers are added, and then y subtracted. This protocol is secured only to the extent that the values of the rando nubers are protected. In the classical world there is always an interval of tie when the values of the l r s theselves are present in the syste. In the quantu protocol, by contrast, the nubers l r are generated only upon easureent, and are present only in the copounds l r a r. Note that an identical result obtains if we change the protocol slightly: Firstly, we distribute aong the voters the state U = (F F... F) W = n l +...+l n 0(od ) l... l n, (8) and secondly, each voter applies Π for a YES vote, or I for NO. The choice between the two versions will depend on the technical detail of ipleentation. It goes without saying that even a quantu protocol cannot be secured against all possible attacks by Big Brother, such as coplete rewiring of the voting achine, or the installation of video caeras in the voting booths.. The single eleent that akes the protocol difficult to execute is the nuber of voters n. The difficulty is expressed in the structure of the initial state W in Eq.(3), where each coponent is a tensor product of n states. If we consider a vote of a sall coittee then producing W sees feasible; but what if illions of people vote? Luckily we can siplify the protocol to include this case. To do this let N stand for the nuber of ballot boxes, and assue that in the state W each coponent has N copies, one for each box. However, we keep larger than the total nuber of voters n. Now, early in the orning on election day, an official perfors F once for each box, and this is the last tie the Fourier transfor is applied to the box. Subsequently, any NO voter applies I (identity) to the part of the state corresponding to his box, and any YES voter applies Π. By repeating the sae calculation we get the post election state V = N l +...+l N 0(od ) l + a a k (od)... ln + a a k N (od) Where a,..., a k, are the votes cast in box, and so on, to a,..., a k N, the votes in box N. Again, since l +...+l N 0(od), then easuring the basis states and adding the results od yields the su of all YES votes fro all boxes (recall that we kept larger than n). (9) 5

6 So why not take N =, that is, only one box for all voters? In this case W = j, and F W = 0, and thus V = Πa Π a...π an 0 = a a n is the su of all YES votes. In other words, using the protocol with a single ballot box brings us back to a classical voting syste represented by an unentangled quantu state. But already with N = there is a rando eleent in the protocol, hiding the nuber of YES votes that each box contributes. 3. Suppose that there are ore than two alternatives, not just YES and NO, but three candidates to choose fro, call the I, II, and III. For n voters we choose to be bigger than n and use two copies of W, call the W and W. Now, each voter applies the following rule: For candidate I apply F to W and F to W, For candidate II apply ΠF W and ΠF W, and for III apply Π F W and ΠF W. Let n I, n II and n III be the nubers of votes cast for the respective candidates. Applying a easureent to V, the post elections state of W, we obtain the outcoe n II + n III. Measuring V yields n II + n III. Since we know n = n I + n II + n III, we can infer the election results. Generalizations to a larger nuber of alternatives is straightforward. IV. COMPLEXITY OF IMPLEMENTATION. The ipleentation of the protocol requires three steps:. The creation of the state W. Consider first the basis states copier defined on C... C (n copies) and whose effect is, in particular j j j... j 0 j (0) To ipleent this suppose = k, then the operation j 0 j j can be achieved using bit by bit copying, each bit by the ipleentation of two CNOT gates [4], altogether k gates. Generalizing to n copies we need O(kn) gates, k = log. To create W, therefore, we apply this copying echanis to ( j ) , where the state ( j ) is obtained fro 0 by the application of k Hadaard transfors, one for each bit.. The application of the Fourier transfor F. By the central result of Shor [5] F can be ipleented using O[(log ) ] gates, and we apply one Fourier transfor per copy. Therefore, the fact that has to be a large nuber, larger than the nuber of voters n, 6

7 should not pose a big proble. In fact, with k = 5 binary digits we can accoodate elections in a id size country. However, even saller scale Fourier transfors suffice to ipleent an elections protocol using the following trick: Let n be the nuber of voters and suppose first that we know n in advance. Suppose, oreover, that n =... s, where,,..., s are coprie. Now, perfor the election in parallel on the s states W l = l l j j... j, l s () Where each ter in Eq () has n copies. Assue that after the easureent on the k post-election states we get the results c, c,..., c k. The nuber of YES votes x is satisfying x = c (od ), x = c (od ),..., x = c s (od s ), () and this set of congruences has a unique solution odn [6]. If we do not know n in advance, or if there is no nice decoposition of n to a product of copries, we can do as indicated previously: Choose a large enough n to be on the safe side, and ake sure it has a cofortable decoposition. After election day is over push the NO button as any tie as needed to bring the nuber of votes to n, and subsequently subtract the fictional votes before the result is announced. 3. Application of Π: Is just an ipleentation of an algorith that perfors j j+ od, which takes O(log ) steps per copy. Altogether, the coplexity of the protocol is O[n(log ) ] where n is the nuber of voters (or in another schee, the nuber of ballot boxes) and is the least power of two greater than the nuber of voters. [] S. K.Singh and R. Srikanth, quant-ph/ [] J. A. Vaccaro, J. Spring, and A Chefles, quant-ph/05046 [3] M. Hillery, M. Zian, V. Buzek, and M. Bielikova, quant-ph/ [4] N. D. Merin, erin/qcop/cs483.htl (online course) [5] P. W. Shor, SIAM J. of Cop. 6, 484 (997). [6] G. H. Hardy and E. M. Wright, An Introduction to the Theory of Nubers, Oxford University Press, Oxford (988). 7