An easily validated security model for e-voting based on anonymous public key certificates

From the academic stream of the AusCERT 2008 Security Conference, Gold Coast, May 2008.

Abstract

Most electronic voting solutions have so far been complex and correspondingly difficult for regulators to validate. We propose a simple and robust new security model for e-voting based on public key technology and ‘smart’ personal authentication devices such as smartcards or SIMs. Highly tamper resistant digital signatures and public key certificates protect both the ballots and individual voters’ electoral enrollment. The solution can be deployed on a variety of modern smartcards, SIMs and so on, featuring built-in cryptographic processors.

Each electronic ballot cast using this solution is unique and anonymous. Ballots cannot be replayed, nor modified after lodgement. Repeat votes are readily detectable. The security model, based on mature PKI standards and commercial off-the-shelf components, is simple, transparent, and inexpensive to implement. Moreover, there is no reliance whatsoever on “security by obscurity”, rendering the solution easy to independently validate and certify.