Distributed, End-to-end Verifiable, and Privacy-Preserving Internet Voting Systems

TL;DR

This paper introduces D-DEMOS, a suite of distributed, privacy-preserving, end-to-end verifiable e-voting systems that enhance election security, privacy, and verifiability, with practical deployment and performance evaluation.

Contribution

It presents two novel e-voting systems with human-verifiable voting, distributed components, and security guarantees, addressing limitations of prior single-point-of-failure systems.

Findings

First system used in national elections and civil union in Greece.

Achieved large-scale election handling with measurable performance.

Ensured voter privacy and verifiability even with potentially unsafe web clients.

Abstract

E-voting systems are a powerful technology for improving democracy. Unfortunately, prior voting systems have single points-of-failure, which may compromise availability, privacy, or integrity of the election results. We present the design, implementation, security analysis, and evaluation of the D-DEMOS suite of distributed, privacy-preserving, and end-to-end verifiable e-voting systems. We present two systems: one asynchronous and one with minimal timing assumptions but better performance. Our systems include a distributed vote collection subsystem that does not require cryptographic operations on behalf of the voter. We also include a distributed, replicated and fault-tolerant Bulletin Board component, that stores all necessary election-related information, and allows any party to read and verify the complete election process. Finally, we incorporate trustees, who control result production while guaranteeing privacy and end-to-end-verifiability as long as their strong majority is honest. Our suite of e-voting systems are the first whose voting operation is human verifiable, i.e., a voter can vote over the web, even when her web client stack is potentially unsafe, without sacrificing her privacy, and still be assured her vote was recorded as cast. Additionally, a voter can outsource election auditing to third parties, still without sacrificing privacy. We provide a model and security analysis of the systems, implement complete prototypes, measure their performance experimentally, and demonstrate their ability to handle large-scale elections. Finally, we demonstrate the performance trade-offs between the two versions of the system. A preliminary version of our system was used to conduct exit-polls at three voting sites for two national-level elections and is being adopted for use by the largest civil union of workers in Greece, consisting of over a half million members.