1 00:00:01,030 --> 00:00:02,150 Hi everyone. 2 00:00:02,150 --> 00:00:06,790 Welcome to Online Voting Theory and Practice with Porter Adams and Emily Stamm. 3 00:00:06,790 --> 00:00:09,970 We're at the DEF CON Crypto Village in August 2020. 4 00:00:11,510 --> 00:00:13,390 My name is Porter Adams. 5 00:00:13,390 --> 00:00:17,810 I'm a software engineer at Blacktop Government Solutions and founder of Disappear Digital. 6 00:00:17,810 --> 00:00:20,690 You can contact me on Twitter at Privacy Porter. 7 00:00:21,250 --> 00:00:22,430 I'm Emily. 8 00:00:22,430 --> 00:00:25,670 I'm a security research engineer at Allstate. 9 00:00:25,670 --> 00:00:31,130 I'm also the COO and co-founder of Cybersecurity Nonprofit or CSNP. 10 00:00:31,130 --> 00:00:34,650 And you can find me on Instagram at Crypto.Emily. 11 00:00:37,350 --> 00:00:40,390 So our talk outline, we've got three major pieces. 12 00:00:40,390 --> 00:00:52,850 We're doing a quick intro now and then I will be talking about the practice of online voting and Emily will talk about the theory of online voting going into homomorphic encryption, mixed nets, and blind signatures. 13 00:00:53,550 --> 00:00:56,950 The scope of our talk, so we're talking about online voting. 14 00:00:56,950 --> 00:01:02,490 So not all election security, not even all voting, just online voting. 15 00:01:02,490 --> 00:01:04,550 So what do I mean by that? 16 00:01:06,850 --> 00:01:16,650 So one form of online voting is anything that's called electronic voting or e-voting, and that just refers to something that includes at least some electronics. 17 00:01:16,650 --> 00:01:27,310 So in the United States, a lot of our voting systems already use e-voting by having computer screens that you can touch, but e-voting does not necessarily mean all online. 18 00:01:27,990 --> 00:01:33,030 Internet voting is what people would think of as like 100% online. 19 00:01:33,190 --> 00:01:41,050 Internet voting is when it's all gone fully digital and there's no need for in-person, anything in person. 20 00:01:44,050 --> 00:01:48,950 So safety of voting machines, I'm just going to refer you to the DEF CON Voting Village. 21 00:01:48,950 --> 00:01:51,170 They do a lot of really great work over there. 22 00:01:51,170 --> 00:01:52,770 It's not the focus of our talk. 23 00:01:52,770 --> 00:02:00,270 We're going to be talking more about the internet voting side of things and how it would be possible to vote entirely online. 24 00:02:01,850 --> 00:02:06,470 So this is the biggest question I get, is why can't we all vote from our phones? 25 00:02:06,590 --> 00:02:15,410 And it's a really great question, and so we're going to spend some time explaining the actual reasons why we can't yet. 26 00:02:16,030 --> 00:02:25,630 The advantage in why people want to vote from our phones in the first place, the first one is just the convenience factor. 27 00:02:25,630 --> 00:02:29,270 It's so much easier if I can sit at home and vote from my phone. 28 00:02:29,270 --> 00:02:42,150 It's also especially easier for overseas voters who, if they currently have to vote by mail, that can take a long time for their mail to get in, and their votes may not even be counted by the time. 29 00:02:42,450 --> 00:02:48,910 And so it's a lot easier for expats to vote from their phones. 30 00:02:50,070 --> 00:02:59,250 It also would hopefully improve voter turnout, because it's a lot less effort to download an app on my phone and click some buttons than it is to show up at the polling station. 31 00:03:00,550 --> 00:03:02,390 Less human error. 32 00:03:02,590 --> 00:03:10,850 So we all remember the 2000 election with the hanging chads in Florida and not being able to determine which way the votes went. 33 00:03:11,090 --> 00:03:19,950 When we vote on a computer it's either 0 or 1, so it's pretty clear and doesn't leave room for human error when filling out the ballot. 34 00:03:22,330 --> 00:03:24,870 So let's talk a bit about usability. 35 00:03:25,010 --> 00:03:41,290 So even if we had a totally working mobile app that everyone could download and use and it was all safe and private, which are concerns I'll get to later in the talk, in Finland in 2008 they had some issues with the user interface. 36 00:03:41,770 --> 00:03:59,170 And what happened was people, when they were going to vote, they would see the screen, they would tap through, click all the candidates they wanted to vote for, but at the bottom of the screen was a submit button, and about two percent of voters did not see the submit button on the screen, 37 00:03:59,170 --> 00:04:04,990 and therefore their votes were not counted in the Finland election in 2008. 38 00:04:05,170 --> 00:04:13,470 It is a user interface problem that would be a big issue if people tried to vote but mistakenly like didn't hit submit button. 39 00:04:13,650 --> 00:04:18,430 It would be a concern even if everything else was safe and secure and working. 40 00:04:19,190 --> 00:04:31,490 The other case I want to bring up is Iowa in 2020 at the Democratic Caucus had many problems with their mobile app that they tried to use to help tally up the votes. 41 00:04:31,490 --> 00:04:49,350 We can learn a lot of lessons from that, but one I want to highlight is that some people had trouble even downloading the app correctly, and so even again if we had like all the security and privacy stuff worked out, there's still some usability concerns with can people download the app, 42 00:04:49,350 --> 00:04:51,210 can people use the app. 43 00:04:51,530 --> 00:05:04,810 All of this kind of comes down to like comfort with electronics, which a lot of us have here at like DEF CON, but not everyone else in the world is as comfortable as we are with using these things. 44 00:05:08,630 --> 00:05:14,950 So here are some of the big concerns, and security is by far the biggest one. 45 00:05:14,950 --> 00:05:18,170 We need to make sure that our election is actually safe. 46 00:05:20,010 --> 00:05:33,150 Privacy is making sure like is it possible to even do a secret ballot online, because we all know there's so much tracking and surveillance with what we do online that having actually a private vote would be pretty tough. 47 00:05:33,150 --> 00:05:36,270 So I'm going to try and answer both these questions in the remainder of my talk. 48 00:05:37,010 --> 00:05:39,830 So first, security isn't safe. 49 00:05:39,890 --> 00:06:04,010 There is a huge attack service for anything that's going to be online, some sort of mobile app, and so let's just kind of go quickly over like all the different ways that would need to be like that could be a voting app could be attacked by, and we would need if we wanted to do this in practice to sure up all of these things and make sure that none of these could happen. 50 00:06:04,570 --> 00:06:15,710 So if I was a hacker trying to attack a voting app, I could install a backdoor either as you vote on the client side or when the votes are tallied on the server side. 51 00:06:15,870 --> 00:06:24,270 I could create an exploit for the voting app itself or for the phone operating system or for the server code a server operating system. 52 00:06:24,270 --> 00:06:32,310 I could spy on votes by intercepting the connection maybe with a fake wireless access point or a keylogger on the person's device. 53 00:06:32,370 --> 00:06:37,210 There's always social engineering you'd have to worry about with phishing app. 54 00:06:37,210 --> 00:06:57,190 Insider threat, whoever like created the code for any of these pieces you have to watch out for and whoever's running the election and then just destructive attacks like a distributed denial of service where the the app just goes down on the day we're all supposed to be voting. 55 00:07:01,710 --> 00:07:22,350 Okay so usually when I'm trying to explain all this to someone they always come up with but banks have mobile apps and this is a really smart point and so it's worth addressing why even though banks have mobile apps it's still very tough for a voting system to be on a mobile app. 56 00:07:24,550 --> 00:07:27,750 So what's the difference between a voting app and a banking app? 57 00:07:27,790 --> 00:07:29,570 First one is identity. 58 00:07:29,570 --> 00:07:39,970 When you're banking basically anyone with your credit card info can go online order some stuff on Amazon but when you're voting we need to make sure that it's really only you. 59 00:07:40,410 --> 00:07:53,370 In terms of security, banking has the benefit of being able to detect fraud kind of later and afterwards whereas with an election if there's any sort of fraud going on we need to know about it immediately. 60 00:07:54,250 --> 00:08:07,710 And privacy is one of the biggest differences where when it's just you and your bank talking and like your bank knows everything and you know all of your own stuff that's fairly easy to figure out just between the two of you. 61 00:08:07,870 --> 00:08:13,050 But for voting we all have secret ballots which I'll get to in a little bit. 62 00:08:13,050 --> 00:08:20,090 It makes it very challenging for my vote to stay secret while everybody else still trusting that votes were placed correctly. 63 00:08:20,490 --> 00:08:39,870 And then lastly trust in banking like it's really just between you and the bank and other accounts like don't really affect you or like other people using your bank versus in a voting system, in a voting app, I need to trust all of the votes from everybody not just my own. 64 00:08:41,090 --> 00:08:45,010 And so trust is very different for a voting app. 65 00:08:48,010 --> 00:08:51,930 So the privacy challenges specifically of online voting. 66 00:08:51,930 --> 00:08:55,330 First you got the secret ballot and so what does that mean? 67 00:08:55,330 --> 00:08:58,970 More or less that I need to be anonymous when I vote. 68 00:08:58,970 --> 00:09:11,690 So no one should be able to figure out based on like like no one should be able to figure out who I voted for and there shouldn't even be a way for me to prove it to anyone next to each other next to me or around me. 69 00:09:11,690 --> 00:09:14,430 So no one can force me to vote a certain way. 70 00:09:14,810 --> 00:09:16,890 It's very important for elections. 71 00:09:17,390 --> 00:09:21,650 Voter registration is not exactly a privacy challenge. 72 00:09:21,650 --> 00:09:25,890 It's like an identity thing but it's going to be kind of related so I include it here. 73 00:09:26,430 --> 00:09:36,850 Voter registration, it needs, I need to be very sure that like whoever is submitting the information in this voting app is the person on the registration list. 74 00:09:37,590 --> 00:09:50,650 And this counts against like double voting which on the internet is much more, it would be much easier to happen where you could submit something twice and have it accidentally be double counted. 75 00:09:51,430 --> 00:10:02,630 And trust is the big third privacy challenge where all votes must be trusted and typically to ensure that trust that means lots of visibility. 76 00:10:02,910 --> 00:10:25,430 And so the big, the challenge here overall is combining the secret ballots with trust and you have to somehow like include all of the anonymity expected for voters while still having all of the visibility needed for the overall election and everyone to trust the results. 77 00:10:25,770 --> 00:10:36,610 And putting these two together digitally is actually extremely tough and will require some really cool math that Emily will talk about in the second half of this talk. 78 00:10:38,870 --> 00:10:42,930 So it's cryptography for online voting is the answer. 79 00:10:42,930 --> 00:10:45,410 It's going to solve all of our privacy concerns. 80 00:10:46,070 --> 00:10:51,910 And I just want to say big thanks to cryptographer David Chom for inventing a lot of this stuff. 81 00:10:51,910 --> 00:10:58,210 I know if you're at the crypto privacy village at DEF CON and have not heard of David Chom before, please look up some of his work. 82 00:10:58,210 --> 00:10:59,530 He's done awesome stuff. 83 00:11:02,560 --> 00:11:05,120 Okay, so how does Estonia vote online? 84 00:11:05,240 --> 00:11:12,100 Especially in the United States, anytime this gets brought up, it's like how is some other country doing it, but we can't. 85 00:11:12,160 --> 00:11:13,840 First step's identity. 86 00:11:14,080 --> 00:11:32,980 In Estonia, they all have a national ID card that includes a chip on it where they can create digital signatures from, which essentially means their like government issued IDs can act as a form of identity on the internet so they can log in using these chips. 87 00:11:32,980 --> 00:11:48,620 Although I believe in the last two years they have switched from hardware chips to an authenticator app, but this still stands that they have some sort of way of converting from your real life presence to your online presence. 88 00:11:49,180 --> 00:11:51,220 Secondly, cryptography. 89 00:11:52,220 --> 00:12:06,300 Estonia uses a combination of, I think, mixed nets and homomorphic encryption, specifically using ElGamal, and Emily will explain what those are in the later half of this talk. 90 00:12:06,620 --> 00:12:16,520 And in terms of trust, Estonia has been voting online since, I think, 2005, and every year they keep making gradual improvements. 91 00:12:16,520 --> 00:12:37,080 Anytime security people go check out, there's always something that's broken, which isn't really a surprise, but Estonia has done a good job of fixing the things that are broken, and over time the system's gotten a lot better and hopefully is mostly safe from real threats. 92 00:12:37,080 --> 00:12:50,720 They haven't had any giant accusations of election interference, so either that means they haven't caught anyone interfering in their elections, or they've actually been doing a good job. 93 00:12:54,020 --> 00:13:09,400 In 2019, almost a quarter million Estonians voted online, which is very impressive numbers and goes to show that this is possible in the future if it is done slowly and correctly. 94 00:13:12,950 --> 00:13:17,870 Now, one big thing to watch out for is cryptographic backdoors. 95 00:13:18,010 --> 00:13:20,050 These are tough to catch. 96 00:13:20,050 --> 00:13:42,530 So Switzerland has been doing online voting, and some researchers looked into their Mixnet shuffle proof and found a naive implementation of the zero-knowledge proof inside of there, which would have allowed for all of the votes to be changed by an attacker. 97 00:13:42,940 --> 00:14:03,040 And so just making sure that every last inch of the app needs to be very carefully done, and especially when it comes to cryptography, you need the person who's coding it to be aware of all of the cryptographic assumptions and make sure that they are coding in everything properly. 98 00:14:05,350 --> 00:14:08,930 So let's look at voting cryptography around the world. 99 00:14:09,410 --> 00:14:18,330 Three big ones I want to point out are in Estonia, Switzerland, and then Moscow has some local elections that are online. 100 00:14:18,590 --> 00:14:27,930 And Estonia uses a combination of homomorphic encryption and Mixnets, same thing for Switzerland, and Moscow is using homomorphic encryption and blind signatures. 101 00:14:28,430 --> 00:14:34,970 So not too many countries or places around the world have an online option right now. 102 00:14:34,970 --> 00:14:38,830 There are a lot more countries that have tried doing this and quit. 103 00:14:38,830 --> 00:14:44,670 Belgium, Finland, France, Germany, Ireland, Kazakhstan, other ones, Norway are on the list. 104 00:14:44,790 --> 00:15:00,510 And the reasons for quitting are mostly either every security person says it's not very safe, or the voter trust in an online system is just not very high. 105 00:15:00,530 --> 00:15:05,350 And one of the most important things for an election is that voters do trust the system. 106 00:15:05,490 --> 00:15:15,990 And so even if online voting is safe, if the voters all think that it's not safe, then it's not a good idea to offer an internet voting option. 107 00:15:17,790 --> 00:15:29,700 All right, so now I'll talk about the cryptography behind the scenes that makes online voting possible. 108 00:15:31,060 --> 00:15:42,200 So some of the considerations we have, the first is security, so preventing attacks, preventing adversaries from tampering with the election, and being able to detect faulty voters and centers. 109 00:15:42,540 --> 00:15:47,520 The second is robustness, so no small set of servers should be able to disrupt the election. 110 00:15:48,100 --> 00:15:51,880 Accuracy, the results should reflect the way people actually voted. 111 00:15:52,760 --> 00:16:01,560 Verifiability, we should be able to verify that the votes are accurate, in particular, individuals should be able to verify that their vote was counted correctly. 112 00:16:01,900 --> 00:16:05,160 Confidentiality, keeping votes secret is crucial. 113 00:16:05,200 --> 00:16:12,300 Usability for all ages, and speed and efficiency, including casting the votes, processing them, and counting them. 114 00:16:13,460 --> 00:16:22,260 So there are three types of cryptographic protocols I'll cover in this talk, homomorphic encryption, mixed networks, and blind signatures. 115 00:16:22,460 --> 00:16:24,770 So first, homomorphic encryption. 116 00:16:25,490 --> 00:16:29,770 So homomorphic encryption is computation on encrypted data. 117 00:16:29,770 --> 00:16:36,070 So this form of encryption actually allows us to do computations on the data when it's in its encrypted state. 118 00:16:36,370 --> 00:16:47,370 There's been a lot of research into this area, and it's very promising, because generally our cryptography, when we have our data and it's encrypted, we can't use that data in any way. 119 00:16:47,370 --> 00:16:52,130 The only way we can actually make use of it is to decrypt it back into its original form. 120 00:16:52,130 --> 00:16:58,110 But with homomorphic encryption, we can actually perform computations on the encrypted data. 121 00:16:58,390 --> 00:17:03,870 So this means we could outsource data to cloud environments for processing, all while encrypted. 122 00:17:04,570 --> 00:17:09,970 We could perform data analysis, again, while data remains in its encrypted form. 123 00:17:10,350 --> 00:17:20,590 And in particular, with election voting, we could obtain a tally of the encrypted votes without actually having to decrypt the individual votes, maintaining privacy the entire time. 124 00:17:23,390 --> 00:17:36,430 So to give a little bit more of the mathematics of the scheme, so homomorphic, the term actually comes from a math term called homomorphism, which is a map that preserves some structure. 125 00:17:36,430 --> 00:17:39,850 So that's what you can kind of think of homomorphic encryption as doing. 126 00:17:39,850 --> 00:17:44,270 It preserves some underlying structure, enough to perform functions on it. 127 00:17:45,630 --> 00:17:52,710 So you have a message, you encrypt that message, you perform a function on it, and then you decrypt it. 128 00:17:52,710 --> 00:17:58,470 And that would be the same thing as if you apply the function directly to the message. 129 00:18:00,350 --> 00:18:03,350 And there's different types of homomorphic encryption. 130 00:18:03,930 --> 00:18:14,010 Generally, they are categorized based on what kinds of computations you can perform, whether it's just partial, whether it's addition, multiplication. 131 00:18:14,190 --> 00:18:24,670 But we even have fully homomorphic encryption, and that actually can perform arbitrary gates and depth, meaning really arbitrary computations. 132 00:18:25,680 --> 00:18:33,060 The only practical and secure fully homomorphic encryption implementations currently are based off of lattices. 133 00:18:35,410 --> 00:18:47,470 So lattice cryptography, it's this new, relatively new form of cryptography that is beginning a lot of attention recently, partially because it's quantum secure cryptography. 134 00:18:48,130 --> 00:18:50,790 Meaning that it's secure against quantum computers. 135 00:18:51,130 --> 00:18:58,570 And it's actually, most of the finalists in the post-quantum cryptography NIST competition are lattice-based. 136 00:18:58,810 --> 00:19:07,770 And lattice cryptography has some very strong security assumptions, especially compared to our classical cryptography, like RSA. 137 00:19:07,770 --> 00:19:11,250 It's also very flexible and efficient. 138 00:19:11,250 --> 00:19:19,190 Generally, the main downside is that it has large key sizes, but depending on the scheme, they're not even always much larger than RSA. 139 00:19:20,470 --> 00:19:32,110 So lattice cryptography is very important for the fully homomorphic encryption, but we'll also touch on it when we come back to blind signatures. 140 00:19:32,390 --> 00:19:34,310 So I just wanted to mention what that is. 141 00:19:36,510 --> 00:19:41,110 And now we'll turn back to homomorphic encryption and voting in particular. 142 00:19:41,170 --> 00:19:43,090 So how does it help? 143 00:19:43,370 --> 00:19:52,590 So we can tally the votes in the encrypted state, which means we take all the votes in, in their encrypted state, add them together, and then decrypt the result. 144 00:19:53,030 --> 00:19:59,030 And because of the homomorphic encryption, we get the same result as if we decrypted them separately and added them together. 145 00:19:59,530 --> 00:20:02,830 So this allows voters to maintain their privacy. 146 00:20:03,770 --> 00:20:09,590 There's also a protocol that allows voters to verify their votes. 147 00:20:11,070 --> 00:20:17,110 And even if we don't use homomorphic encryption in the election, we can still use it for ballot comparison. 148 00:20:17,110 --> 00:20:25,830 So ballot comparison is very important in the election process to inspire voter confidence by comparing ballots and the electronic records. 149 00:20:25,930 --> 00:20:34,550 And the way we could use homomorphic encryption in this is that we can actually do this comparison on the votes in their encrypted state. 150 00:20:34,610 --> 00:20:40,510 So we would inspire voter confidence without actually giving any information about the votes. 151 00:20:40,630 --> 00:20:52,210 And how this is done now is the votes are anonymous, but even still with anonymous, with not tying them back to the individuals, you can still find patterns. 152 00:20:52,210 --> 00:20:55,910 So it would be more secure if they were in their encrypted state. 153 00:20:57,390 --> 00:21:00,010 So next I'll talk about mixed networks. 154 00:21:00,250 --> 00:21:12,290 So mixed networks, also called mixnets, are routing protocols that use a chain of proxy servers, mixes, to take in messages from senders and send them to receivers in some random order. 155 00:21:12,290 --> 00:21:18,650 Additionally, they use encryption at each state, and it makes it harder to trace. 156 00:21:19,250 --> 00:21:26,930 And you can also think of it as being kind of like a Russian doll, some nested encryption going through. 157 00:21:26,930 --> 00:21:27,990 So there's two types. 158 00:21:27,990 --> 00:21:35,930 There's the decryption mixnet, so that's where you do all the encryption in the beginning, and then you partially decrypt and mix at each stage. 159 00:21:35,930 --> 00:21:42,750 There's also re-encryption, where you re-encrypt and mix at each stage and do the full decryption at the last round. 160 00:21:43,490 --> 00:21:47,770 And there's also shuffle and decrypt proofs for verifications as well. 161 00:21:51,800 --> 00:21:54,900 So lastly, we'll talk about blind signatures. 162 00:21:55,300 --> 00:22:11,880 So just to recall, a digital signature provides authenticity, so verifying that you're talking to the person you think you are, verifying a known sender, and integrity, verifying that the message you're receiving has not been altered in transit, maliciously or accidentally. 163 00:22:12,180 --> 00:22:25,320 So how it works is one party signs the message and creates a signature with a private key, and then the other party will verify that with a public key. 164 00:22:26,960 --> 00:22:36,380 So with blind signatures, it's a digital signature where the message is masked or blinded and then sent and then signed. 165 00:22:36,620 --> 00:22:42,240 So blind signatures can then be verified against the original message, the same way digital signatures are. 166 00:22:42,240 --> 00:22:49,720 The key difference is that with blind signatures, the person signing them doesn't know the contents of the message. 167 00:22:49,820 --> 00:22:53,700 So voting is actually a common analogy with blind signatures. 168 00:22:54,100 --> 00:23:01,920 So imagine you have a voter and they complete an anonymous ballot, which they then place in an envelope with their credentials. 169 00:23:02,480 --> 00:23:11,580 They hand that envelope to an official who signs it, and the signature of the official imprints through the envelope onto the ballot, and they return that envelope to the voter. 170 00:23:14,210 --> 00:23:20,370 The voter then places the ballot in a different unmarked envelope before submitting it. 171 00:23:21,610 --> 00:23:29,090 So now the message was correctly and sufficiently signed by an official, without the official having to know the contents of the message. 172 00:23:29,810 --> 00:23:35,810 So it provided the authenticity and integrity, but maintained the confidentiality. 173 00:23:37,670 --> 00:23:43,350 So to talk a little bit more about the scheme, in a less analogous way, what actually happens. 174 00:23:43,350 --> 00:23:50,250 So a user has some message, D, and they blind the message to get a new message, D star. 175 00:23:51,750 --> 00:23:53,950 And that's what they send to the signer. 176 00:23:53,950 --> 00:24:00,470 The signer then uses the private key to generate a signature, sigma star, for that message, D star, and returns it to the user. 177 00:24:01,350 --> 00:24:09,310 The user can then create, from sigma star, a valid signature sigma corresponding to their original message. 178 00:24:09,590 --> 00:24:14,950 So any recipient can now validate the signature sigma, as they would any other signature. 179 00:24:15,290 --> 00:24:20,310 And the signer gets no information about the contents of the message, or the actual signature. 180 00:24:23,190 --> 00:24:26,510 And there's different mathematics behind blind signatures. 181 00:24:27,050 --> 00:24:29,530 There are RSA-based options. 182 00:24:30,150 --> 00:24:40,410 I wouldn't recommend using these, because with where we are right now, if we're implementing new technology, we want to be looking as far ahead as possible. 183 00:24:40,710 --> 00:24:48,890 And in the long run, RSA is not secure against quantum computers, and just is not secure compared to these other types of schemes. 184 00:24:48,990 --> 00:24:52,650 But there's also some attacks on the RSA-based blind signatures. 185 00:24:52,930 --> 00:24:57,870 So I'm mostly going to focus on the lattice and the multivariate-based. 186 00:24:57,870 --> 00:25:11,830 So the lattice-based blind signatures, again, they're post-quantum secure, and they rely on similar problems, similar types of schemes, as those that are finalists in the NIST post-quantum cryptography competition. 187 00:25:12,150 --> 00:25:17,930 So we have a lot of faith in these lattice-based schemes, and we can create blind signatures from them. 188 00:25:18,530 --> 00:25:27,030 Additionally, multivariate, there's a scheme called the Rainbow Scheme that's a finalist in the NIST post-quantum cryptography signature schemes competition. 189 00:25:27,870 --> 00:25:30,590 So again, leads to be post-quantum secure. 190 00:25:30,830 --> 00:25:34,110 And we can turn this scheme into a blind signature scheme. 191 00:25:34,410 --> 00:25:40,750 And there's a lot of benefits to multivariate cryptography, such as having very fast and short signatures. 192 00:25:41,450 --> 00:25:46,030 And this diagram just kind of shows how the Rainbow Scheme works. 193 00:25:46,550 --> 00:26:00,130 Essentially, you have a message w, the hashed message, and you recursively obtain inverses of these functions to get the signature z. 194 00:26:00,430 --> 00:26:10,490 And then that signature z can be verified by using the public key function and just applying that to see if you get the correct message back. 195 00:26:10,730 --> 00:26:15,790 With blind signatures, there's just some extra steps in this process. 196 00:26:15,790 --> 00:26:26,170 You use a special function called r that actually, by using that, you create the blind aspect of it. 197 00:26:26,170 --> 00:26:33,550 And then you use zero-knowledge proofs at the end as well as part of the verification proof. 198 00:26:33,550 --> 00:26:39,350 So a little bit more complicated, but again, very similar mathematics. 199 00:26:41,350 --> 00:26:51,110 So in summary, we talked about homomorphic encryption, so computation on encrypted votes, which allows us to tally the votes in their encrypted form. 200 00:26:51,170 --> 00:26:57,750 And it can use different types of cryptography, but lattice space is one that is post-quantum secure and very flexible. 201 00:26:58,510 --> 00:27:09,890 Then we talked about the mixed networks protocol, where you have a nested series of encryption or re-encryptions and shufflings, and this way you cannot determine which person the vote came from. 202 00:27:09,970 --> 00:27:17,150 And there's also a range of underlying public key cryptography mathematics that I didn't go over, but the protocol itself is fairly flexible. 203 00:27:18,470 --> 00:27:20,750 And finally, we talked about blind signatures. 204 00:27:20,930 --> 00:27:26,050 So this is where you create a valid signature without knowing the contents of the message. 205 00:27:26,050 --> 00:27:31,670 So you're verifying authenticity and integrity of a vote while maintaining confidentiality of a voter. 206 00:27:31,670 --> 00:27:34,890 And we talked about lattice and multivariate-based schemes. 207 00:27:35,290 --> 00:27:38,550 To summarize everything, is it possible theoretically? 208 00:27:38,550 --> 00:27:39,790 Yes, eventually. 209 00:27:39,790 --> 00:27:43,090 Cryptographers will help us get it right, as well as security people. 210 00:27:43,090 --> 00:27:44,690 Is it ready in practice? 211 00:27:44,690 --> 00:27:46,350 Not yet in the United States. 212 00:27:46,350 --> 00:27:52,270 Let's start small scale, and maybe eventually we'll be able to have more voters vote from their phones. 213 00:27:55,500 --> 00:27:56,840 So thank you. 214 00:27:58,040 --> 00:27:59,960 Thank you for coming to the talk.