Usable Verifiable Remote Electronic Voting case study HELIOS - PowerPoint PPT Presentation

Usable Verifiable Remote Electronic Voting case study HELIOS 18.07.2012 SecVote Dagstuhl

Comments • Based on research results from the project “Usable Verifiability in Remote Electronic Voting” – Project funded by – Research conducted by M. Maina Olembo • Assumptions: – voter cast vote from trustworthy environment – voter receives authentication tokens (PWD) over secure channel • Focus on individual verifiability – Cast as intended SecVote - Dagstuhl 2

Overview 1. Why Helios and how Helios works? 2. Helios version 1.0 interfaces 3. Cognitive Walkthrough (KOKV2011) 1. Findings 2. Improved Interfaces 4. User study (KKOVV2011) 1. Design 2. Findings 5. Online survey 1. Design 2. Findings 6. Next steps SecVote - Dagstuhl 3

Why ? • Proposed by Ben Adida in 2008: http://heliosvoting.org/ • Implemented verifiable electronic voting protocol – User interface – Open � source system – Well studied from security point of view • Has been used in legally binding elections • in academic contexts: UCL, Princeton, IACR, … SecVote - Dagstuhl 4

How Helios works? key holder 1 key holder 2 pk 4 out of 5 key holder 5 key holder 3 key holder 4 SecVote - Dagstuhl 5

How Helios works? Voting Booth Invitation Email Voting Booth Voting Booth • Election Fingerprint Click • Election URL Press • Election Fingerprint Press • All Choices 2nd • Direct Voting URL • Election Fingerprint Button: • Questions Button: • Link: Update URL Start • Election Fingerprint • Voting Instructions • Check Boxes Review • Button: • Email Address • Button: Start • Button: Choices Encrypt Ballot • Password Review Choices Click Link: Click 1st Update Press Button: Encrypt Ballot Click Link URL write down/ Vote store/ print Helios Voting Voting Booth Confirmation Email Voting Booth ballot fingerprint Press • Election ID • Election Fingerprint Press Button: • Election Fingerprint • Election Fingerprint • Ballot Fingerprint Button: Submit Press Button: • Election Fingerprint • Ballot Fingerprint • Link:Vote • Panel: Email Send Back to Choices • Ballot Fingerprint Ballot • Button: Submit • Link: Audit • Panel: Password Encrypted Ballot • Link: Bulletin Board • Button: Send • Button: Audit Ballot • Box: Administration Press Button: Audit Ballot Independent application in separate window Copy and paste Audited Ballot Information into Empty Box Helios Verifier Voting Booth Helios Verifier Close Verifier • Box with Audited Press Click • Election Fingerprint to end Ballot Information Button: Link: • Box: Audited Ballot • Empty Box • Button: Verify Verifier Information Verifying Verify • Button: Verify • Result Verifying • Link: Helios Verifier Process Process • Button: Back to Choices Loop Compare

Bulletin Board Pseudonym/Voter’s ID 1 � ballot fingerprint 1 Pseudonym/Voter’s ID 2 � ballot fingerprint 2 …… ….. …. Pseudonym/Voter’s ID n � ballot fingerprint n SecVote - Dagstuhl 7

Important aspects • Separation of vote preparation/encryption and vote casting � Everyone, including auditors or election observers can verify cast as intended • Software commits to its encryption by displaying a hash of the ciphertext = ballot fingerprint � To ensure that the software provides the same ciphertext for verification and vote casting SecVote - Dagstuhl 8

Important aspects • Voter can verify as many (test) ballots as he/she wants � From the software’s perspective, it cannot encrypt the wrong candidate with a sufficiently high probability of not being detected • In order to ensure the secrecy of the vote, it is not possible to first verify and then cast this ballot but needs first to be re � encrypted � New ballot fingerprint � The voter cannot verify the encrypted ballot he finally casts but must trust the system due to previous checks. SecVote - Dagstuhl 9

Individual verifiability – stored as cast • Use ballot finger print from vote casting • Verify whether is stored on the bulletin board next to the voter’s ID / pseudonym by comparing • Remarks: – Can be repeated during the vote casting phase as well as during and after the tallying phase – Voter or external observers verify that encrypted votes match to published hash values SecVote - Dagstuhl 10

Properties and Assumptions Properties Verifiability Coercion � resistance Receipt � freeness • • • Assumptions Cryptography works Not coercion � Cryptography works • • Trusted environment resistant (voter ID Trusted environment • tied to hash value on (n � k+1) honest key Bulletin Board) trustee SecVote - Dagstuhl 11

Helios version 1.0 SecVote - Dagstuhl 12

Helios version 1.0 SecVote - Dagstuhl 13

SecVote

SecVote - Dagstuhl 15

SecVote - Dagstuhl 16

Cognitive Walkthrough [KOKV11] SecVote - Dagstuhl 19

Cognitive Walkthrough [KOKV11] • Carried out on Helios version 1.0 and later on version 3.0 – Interfaces evaluated from voter perspective • How usable is it to cast and verify a vote? – Five experts from security, e � voting and psychology – Fictitious university president election SecVote - Dagstuhl 20

? O/0? ? ? ? might be scary What to do with the ballot fingerprint / receipt SecVote - Dagstuhl 21

where ? ? verify/audit? “ … how your options where encrypted”? How to continue verifying / casting a ballot?

Independent? ? “ … how your options where encrypted”? ? C&P is error prone how to continue?/ vote cast? anything to verify? what to do if it does not match?

Cognitive Walkthrough [KOKV11] • Carried out on Helios version 1.0 and later on version 3.0 – Interfaces evaluated from voter perspective • How usable is it to cast and verify a vote? – Five experts from security, e � voting and psychology – Fictitious university president election SecVote - Dagstuhl 24

? SecVote - Dagstuhl 25

Missing instruction: comparison ? ! new: trust? SecVote - Dagstuhl 26

? ? new ? verify again? ? SecVote - Dagstuhl 27

Independent? ? even worse! SecVote - Dagstuhl 28

Findings Missing: clear terminology and clear instructions Complicate (many steps) and error prone verifiability Same design for verification and main voting interface Irritation to authenticate at the end of the voting process SecVote - Dagstuhl 29

Improved Interfaces (1) Clear instructions To authenticate servers SecVote - Dagstuhl 30

Improved Interfaces (2) Added verifiability step Instructions to voters SecVote - Dagstuhl 31

Improved Interfaces (3) Back and Forward Buttons SecVote - Dagstuhl 32

Improved Interfaces (4) Shortened verification code Options for voter SecVote - Dagstuhl 33

Improved Interfaces (5) Trusted institutions for verification SecVote - Dagstuhl 34

Improved Interfaces (6) Simplified results Clear instructions SecVote - Dagstuhl 35

Improved Interfaces (5) Only button SecVote - Dagstuhl 36

Improved Interfaces (7) Automatically re � encrypted Explanation for voter SecVote - Dagstuhl 37

Comparison Old New Click Audit (Drops down to give more information) Click Verify Encryption Click verify the ballot Click link to select information Right � click and copy Click Ballot Verifier link Click on verifying institute Paste information in ballot verifier window Click Verify Close window Click close window (as in PPT) Click Back to Voting Click enter new vote button (as in PPT) Click Confirm button to re � encrypt or Update to change vote [automatic] SecVote - Dagstuhl 38

User Study [KKOVV2011] SecVote - Dagstuhl 39

Design of the user study (lab study) • Mock mayoral election in Darmstadt • Material/Interface in German • 34 participants • Asked to put on a modified bicycle helmet with a video camera and eye � tracking • Participants cast a vote w/o instructions (2 rounds) – Would people verify? How? – Can people verify if we tell them to do so? – Instructions emphasized verifying with different techniques, different votes Note: hard for participants to take it serious as it is not a secret election • 3 questionnaires due to eye tracker and log files SecVote - Dagstuhl 40

General Usability (after round 1) do not agree fully agree SecVote - Dagstuhl 41

General Usability • 1 of 20 who answered that they verified further stated not having noticed that the code changed (round 1) • 1 of the remaining 14 stated this in round 2 � Most of participates noticed it • After round 2 • 8 of 34 participants stated that it was not clear to them that they had to compare the verification codes or/and the candidates • All stated that it was clear to them that their vote was not cast after having verified SecVote - Dagstuhl 42