Security analysis of the Australian Capital Territory's eVACS 2020/2024 paperless direct recording electronic voting system

TL;DR

This paper analyzes the security of Australia's eVACS electronic voting system, revealing cryptographic errors in its dependencies, and discusses the implications for election integrity and security.

Contribution

It identifies and discloses cryptographic vulnerabilities in the eVACS system's underlying libraries, highlighting the importance of security audits in electronic voting systems.

Findings

Cryptographic errors found in Ada Web Services Library used by eVACS

Disclosed vulnerabilities to AdaCore and electoral authorities

Implications for election security and trust in electronic voting

Abstract

This report describes the implications for eVACS of two cryptographic errors in the Ada Web Services Library that it depends on. We identified these errors in the course of examining and testing the 2024 eVACS code, which was made publicly available in March 2024. We disclosed the problems to AdaCore, and explained the implications at the time to the relevant electoral authorities.