start	end	text
1030	6790	Hi everyone. Welcome to Online Voting Theory and Practice with Porter Adams and Emily Stamm.
6790	9970	We're at the DEF CON Crypto Village in August 2020.
11510	15850	My name is Porter Adams. I'm a software engineer at Blacktop Government Solutions
15850	20690	and founder of Disappear Digital. You can contact me on Twitter at Privacy Porter.
21250	28470	I'm Emily. I'm a security research engineer at Allstate. I'm also the COO and co-founder of
28470	34650	Cybersecurity Nonprofit or CSNP. And you can find me on Instagram at Crypto.Emily.
37350	41550	So our talk outline, we've got three major pieces. We're doing a quick intro now
41550	47130	and then I will be talking about the practice of online voting and Emily will talk about the
47130	52850	theory of online voting going into homomorphic encryption, mixed nets, and blind signatures.
53550	59130	The scope of our talk, so we're talking about online voting. So not all election security,
59130	64550	not even all voting, just online voting. So what do I mean by that?
66850	72350	So one form of online voting is anything that's called electronic voting or e-voting,
72350	77530	and that just refers to something that includes at least some electronics. So in the United States,
77630	83150	a lot of our voting systems already use e-voting by having computer screens that you can touch,
83150	90590	but e-voting does not necessarily mean all online. Internet voting is what people would
90590	96650	think of as like 100% online. Internet voting is when it's all gone fully digital and there's
96650	106790	no need for in-person, anything in person. So safety of voting machines, I'm just going to
106790	111570	refer you to the DEF CON Voting Village. They do a lot of really great work over there. It's not
111570	115270	the focus of our talk. We're going to be talking more about the internet voting side of things
115270	124190	and how it would be possible to vote entirely online. So this is the biggest question I get,
124190	130710	is why can't we all vote from our phones? And it's a really great question, and so we're going
130710	137990	to spend some time explaining the actual reasons why we can't yet. The advantage in why people want
137990	145630	to vote from our phones in the first place, the first one is just the convenience factor.
145630	150710	It's so much easier if I can sit at home and vote from my phone. It's also especially easier for
150710	156950	overseas voters who, if they currently have to vote by mail, that can take a long time for their
156950	164470	mail to get in, and their votes may not even be counted by the time. And so it's a lot easier for
165350	172430	expats to vote from their phones. It also would hopefully improve voter turnout,
172430	177110	because it's a lot less effort to download an app on my phone and click some buttons than it is to
177110	186070	show up at the polling station. Less human error. So we all remember the 2000 election with the
186070	191930	hanging chads in Florida and not being able to determine which way the votes went. When we vote
191930	198230	on a computer it's either 0 or 1, so it's pretty clear and doesn't leave room for human error when
198230	207390	filling out the ballot. So let's talk a bit about usability. So even if we had a totally working
207390	212630	mobile app that everyone could download and use and it was all safe and private,
212630	218310	which are concerns I'll get to later in the talk, in Finland in 2008 they had some issues
218310	226330	with the user interface. And what happened was people, when they were going to vote,
226330	230670	they would see the screen, they would tap through, click all the candidates they wanted to vote for,
230670	236810	but at the bottom of the screen was a submit button, and about two percent of voters did not
236810	243030	see the submit button on the screen, and therefore their votes were not counted in the Finland
243030	250250	election in 2008. It is a user interface problem that would be a big issue if people tried to vote
250250	256270	but mistakenly like didn't hit submit button. It would be a concern even if everything else
256270	263170	was safe and secure and working. The other case I want to bring up is Iowa in 2020 at the Democratic
263170	271490	Caucus had many problems with their mobile app that they tried to use to help tally up the votes.
271490	276090	We can learn a lot of lessons from that, but one I want to highlight is that some people
276090	283530	had trouble even downloading the app correctly, and so even again if we had like all the security
283530	289030	and privacy stuff worked out, there's still some usability concerns with can people download the
289030	296610	app, can people use the app. All of this kind of comes down to like comfort with electronics,
296610	302770	which a lot of us have here at like DEF CON, but not everyone else in the world is as comfortable
302770	311910	as we are with using these things. So here are some of the big concerns, and security
311910	318170	is by far the biggest one. We need to make sure that our election is actually safe.
320010	326950	Privacy is making sure like is it possible to even do a secret ballot online, because we all know
326950	331690	there's so much tracking and surveillance with what we do online that having actually a private
331690	335270	vote would be pretty tough. So I'm going to try and answer both these questions in the remainder
335270	343190	of my talk. So first, security isn't safe. There is a huge attack service for anything that's going
343190	348850	to be online, some sort of mobile app, and so let's just kind of go quickly over like all the
348850	354990	different ways that would need to be like that could be a voting app could be attacked by,
355510	361890	and we would need if we wanted to do this in practice to sure up all of these things and make
361890	369430	sure that none of these could happen. So if I was a hacker trying to attack a voting app, I could
369430	374610	install a backdoor either as you vote on the client side or when the votes are tallied on the
374610	379990	server side. I could create an exploit for the voting app itself or for the phone operating
379990	386550	system or for the server code a server operating system. I could spy on votes by intercepting the
386550	392310	connection maybe with a fake wireless access point or a keylogger on the person's device.
392370	398690	There's always social engineering you'd have to worry about with phishing app. Insider threat,
398690	405670	whoever like created the code for any of these pieces you have to watch out for and whoever's
405670	412170	running the election and then just destructive attacks like a distributed denial of service
412170	417190	where the the app just goes down on the day we're all supposed to be voting.
421710	425830	Okay so usually when I'm trying to explain all this to someone they always come up with
425830	433690	but banks have mobile apps and this is a really smart point and so it's worth addressing why
434410	442350	even though banks have mobile apps it's still very tough for a voting system to be on a mobile app.
444550	449990	So what's the difference between a voting app and a banking app? First one is identity. When you're
449990	455110	banking basically anyone with your credit card info can go online order some stuff on Amazon
455650	461990	but when you're voting we need to make sure that it's really only you. In terms of security,
461990	468470	banking has the benefit of being able to detect fraud kind of later and afterwards whereas with
468470	474990	an election if there's any sort of fraud going on we need to know about it immediately. And privacy
474990	481030	is one of the biggest differences where when it's just you and your bank talking and like your bank
481030	486750	knows everything and you know all of your own stuff that's fairly easy to figure out just between the
486750	493170	two of you. But for voting we all have secret ballots which I'll get to in a little bit. It
493170	498090	makes it very challenging for my vote to stay secret while everybody else still trusting that
498090	505470	votes were placed correctly. And then lastly trust in banking like it's really just between you and
505470	510610	the bank and other accounts like don't really affect you or like other people using your bank
510610	518110	versus in a voting system, in a voting app, I need to trust all of the votes from everybody
518110	525010	not just my own. And so trust is very different for a voting app.
528010	534150	So the privacy challenges specifically of online voting. First you got the secret ballot and so
534150	540010	what does that mean? More or less that I need to be anonymous when I vote. So no one should be able
540010	546250	to figure out based on like like no one should be able to figure out who I voted for and there
546250	551290	shouldn't even be a way for me to prove it to anyone next to each other next to me or around
551290	557550	me. So no one can force me to vote a certain way. It's very important for elections. Voter
557550	563350	registration is not exactly a privacy challenge. It's like an identity thing but it's going to be
563350	570530	kind of related so I include it here. Voter registration, it needs, I need to be very sure
570530	575650	that like whoever is submitting the information in this voting app is the person on the registration
575650	584250	list. And this counts against like double voting which on the internet is much more,
584250	589090	it would be much easier to happen where you could submit something twice and have it accidentally
589090	596590	be double counted. And trust is the big third privacy challenge where all votes must be trusted
597650	604850	and typically to ensure that trust that means lots of visibility. And so the big,
605710	613210	the challenge here overall is combining the secret ballots with trust and you have to somehow
613210	620490	like include all of the anonymity expected for voters while still having all of the
620490	627070	visibility needed for the overall election and everyone to trust the results. And putting these
627070	633430	two together digitally is actually extremely tough and will require some really cool math
633430	636610	that Emily will talk about in the second half of this talk.
638870	644390	So it's cryptography for online voting is the answer. It's going to solve all of our privacy
644390	651190	concerns. And I just want to say big thanks to cryptographer David Chom for inventing a lot of
651190	655890	this stuff. I know if you're at the crypto privacy village at DEF CON and have not heard of David
655890	664200	Chom before, please look up some of his work. He's done awesome stuff. Okay, so how does Estonia vote
664200	669800	online? Especially in the United States, anytime this gets brought up, it's like how is some other
669800	676920	country doing it, but we can't. First step's identity. In Estonia, they all have a national
676920	683300	ID card that includes a chip on it where they can create digital signatures from, which essentially
683300	690780	means their like government issued IDs can act as a form of identity on the internet so they can log
690780	697700	in using these chips. Although I believe in the last two years they have switched from hardware
697700	704120	chips to an authenticator app, but this still stands that they have some sort of way of converting
704120	713740	from your real life presence to your online presence. Secondly, cryptography. Estonia uses
714080	719240	a combination of, I think, mixed nets and homomorphic encryption, specifically using
719240	726300	ElGamal, and Emily will explain what those are in the later half of this talk.
726620	734260	And in terms of trust, Estonia has been voting online since, I think, 2005, and every year they
734260	739700	keep making gradual improvements. Anytime security people go check out, there's always something
739700	745820	that's broken, which isn't really a surprise, but Estonia has done a good job of fixing the
745820	755500	things that are broken, and over time the system's gotten a lot better and hopefully is mostly safe
755500	764120	from real threats. They haven't had any giant accusations of election interference, so either
764120	769640	that means they haven't caught anyone interfering in their elections, or they've actually been doing
769640	780560	a good job. In 2019, almost a quarter million Estonians voted online, which is very
780560	788220	impressive numbers and goes to show that this is possible in the future if it is done slowly
788220	798510	and correctly. Now, one big thing to watch out for is cryptographic backdoors. These are
798510	806270	tough to catch. So Switzerland has been doing online voting, and some researchers looked into
806270	814690	their Mixnet shuffle proof and found a naive implementation of the zero-knowledge proof
814690	822530	inside of there, which would have allowed for all of the votes to be changed by an attacker.
822940	829650	And so just making sure that every last inch of the app needs to be very carefully done,
829650	835430	and especially when it comes to cryptography, you need the person who's coding it to be aware
835430	843040	of all of the cryptographic assumptions and make sure that they are coding in everything properly.
845350	848930	So let's look at voting cryptography around the world.
849410	855110	Three big ones I want to point out are in Estonia, Switzerland, and then Moscow has
855110	861090	some local elections that are online. And Estonia uses a combination of homomorphic
861090	865910	encryption and Mixnets, same thing for Switzerland, and Moscow is using homomorphic
865910	872410	encryption and blind signatures. So not too many countries or places around the world
872410	877530	have an online option right now. There are a lot more countries that have tried doing this
877530	883510	and quit. Belgium, Finland, France, Germany, Ireland, Kazakhstan, other ones, Norway are on
883510	892970	the list. And the reasons for quitting are mostly either every security person says it's not very
892970	901750	safe, or the voter trust in an online system is just not very high. And one of the most important
901750	909290	things for an election is that voters do trust the system. And so even if online voting is safe,
909290	914650	if the voters all think that it's not safe, then it's not a good idea to offer an internet
914650	927500	voting option. All right, so now I'll talk about the cryptography behind the scenes
927500	934900	that makes online voting possible. So some of the considerations we have, the first is security,
934900	939360	so preventing attacks, preventing adversaries from tampering with the election,
939360	945100	and being able to detect faulty voters and centers. The second is robustness, so no small set of
945100	950300	servers should be able to disrupt the election. Accuracy, the results should reflect the way
950300	956180	people actually voted. Verifiability, we should be able to verify that the votes are accurate,
956180	961560	in particular, individuals should be able to verify that their vote was counted correctly.
961900	967240	Confidentiality, keeping votes secret is crucial. Usability for all ages,
967240	972300	and speed and efficiency, including casting the votes, processing them, and counting them.
973460	978220	So there are three types of cryptographic protocols I'll cover in this talk, homomorphic
978220	984770	encryption, mixed networks, and blind signatures. So first, homomorphic encryption.
985490	991290	So homomorphic encryption is computation on encrypted data. So this form of encryption
991290	996070	actually allows us to do computations on the data when it's in its encrypted state.
996370	1000130	There's been a lot of research into this area, and it's very promising,
1000130	1006310	because generally our cryptography, when we have our data and it's encrypted, we can't use that
1006310	1011130	data in any way. The only way we can actually make use of it is to decrypt it back into its original
1011130	1017110	form. But with homomorphic encryption, we can actually perform computations on the encrypted
1017110	1022750	data. So this means we could outsource data to cloud environments for processing, all while
1022750	1029970	encrypted. We could perform data analysis, again, while data remains in its encrypted form.
1030350	1034810	And in particular, with election voting, we could obtain a tally of the encrypted votes
1034810	1040590	without actually having to decrypt the individual votes, maintaining privacy the entire time.
1043390	1049010	So to give a little bit more of the mathematics of the scheme,
1049010	1053310	so homomorphic, the term actually comes from a math term called homomorphism,
1053310	1058390	which is a map that preserves some structure. So that's what you can kind of think of homomorphic
1058390	1064270	encryption as doing. It preserves some underlying structure, enough to perform functions on it.
1065630	1071110	So you have a message, you encrypt that message, you perform a function on it,
1071130	1074590	and then you decrypt it. And that would be the same thing as if you
1074590	1078470	apply the function directly to the message.
1080350	1085990	And there's different types of homomorphic encryption. Generally, they are categorized
1085990	1090070	based on what kinds of computations you can perform, whether it's just
1090970	1097490	partial, whether it's addition, multiplication. But we even have fully homomorphic encryption,
1097490	1104670	and that actually can perform arbitrary gates and depth, meaning really arbitrary computations.
1105680	1109150	The only practical and secure fully homomorphic encryption
1109890	1113060	implementations currently are based off of lattices.
1115410	1121850	So lattice cryptography, it's this new, relatively new form of cryptography that is
1122440	1127470	beginning a lot of attention recently, partially because it's quantum secure cryptography.
1128130	1133010	Meaning that it's secure against quantum computers. And it's actually, most of the
1133010	1139530	finalists in the post-quantum cryptography NIST competition are lattice-based. And lattice
1139530	1144870	cryptography has some very strong security assumptions, especially compared to our
1144870	1151870	classical cryptography, like RSA. It's also very flexible and efficient. Generally, the main
1151870	1156770	downside is that it has large key sizes, but depending on the scheme, they're not even always
1156770	1168250	much larger than RSA. So lattice cryptography is very important for the fully homomorphic
1168250	1172110	encryption, but we'll also touch on it when we come back to blind signatures.
1172390	1174310	So I just wanted to mention what that is.
1176510	1181110	And now we'll turn back to homomorphic encryption and voting in particular.
1181170	1186170	So how does it help? So we can tally the votes in the encrypted state,
1186170	1190750	which means we take all the votes in, in their encrypted state, add them together,
1190750	1195210	and then decrypt the result. And because of the homomorphic encryption, we get the same result
1195210	1201690	as if we decrypted them separately and added them together. So this allows voters to maintain
1201690	1209590	their privacy. There's also a protocol that allows voters to verify their votes.
1211070	1216030	And even if we don't use homomorphic encryption in the election, we can still use it for ballot
1216030	1221350	comparison. So ballot comparison is very important in the election process to inspire
1221350	1226870	voter confidence by comparing ballots and the electronic records. And the way we could use
1226870	1233130	homomorphic encryption in this is that we can actually do this comparison on the votes in
1233130	1238790	their encrypted state. So we would inspire voter confidence without actually giving any
1238790	1244910	information about the votes. And how this is done now is the votes are anonymous, but even still
1244910	1252690	with anonymous, with not tying them back to the individuals, you can still find patterns. So it
1252690	1258990	would be more secure if they were in their encrypted state. So next I'll talk about mixed
1258990	1265110	networks. So mixed networks, also called mixnets, are routing protocols that use a chain of proxy
1265110	1272290	servers, mixes, to take in messages from senders and send them to receivers in some random order.
1272290	1280090	Additionally, they use encryption at each state, and it makes it harder to trace. And you can also
1280090	1287330	think of it as being kind of like a Russian doll, some nested encryption going through. So there's
1287330	1292310	two types. There's the decryption mixnet, so that's where you do all the encryption in the
1292310	1297930	beginning, and then you partially decrypt and mix at each stage. There's also re-encryption, where
1297930	1302750	you re-encrypt and mix at each stage and do the full decryption at the last round.
1303490	1307770	And there's also shuffle and decrypt proofs for verifications as well.
1311800	1317920	So lastly, we'll talk about blind signatures. So just to recall, a digital signature provides
1317920	1323780	authenticity, so verifying that you're talking to the person you think you are, verifying a known
1323780	1329920	sender, and integrity, verifying that the message you're receiving has not been altered in transit,
1329920	1338520	maliciously or accidentally. So how it works is one party signs the message and creates a
1338520	1347600	signature with a private key, and then the other party will verify that with a public key.
1347600	1353040	So with blind signatures, it's a digital signature where the message is masked or blinded and then
1353040	1360480	sent and then signed. So blind signatures can then be verified against the original message,
1360480	1364640	the same way digital signatures are. The key difference is that with blind signatures,
1365420	1371440	the person signing them doesn't know the contents of the message. So voting is actually a common
1371440	1378300	analogy with blind signatures. So imagine you have a voter and they complete an anonymous ballot,
1378300	1381920	which they then place in an envelope with their credentials.
1382480	1387280	They hand that envelope to an official who signs it, and the signature of the official
1387280	1391580	imprints through the envelope onto the ballot, and they return that envelope to the voter.
1394210	1400370	The voter then places the ballot in a different unmarked envelope before submitting it.
1401610	1405930	So now the message was correctly and sufficiently signed by an official,
1405930	1409090	without the official having to know the contents of the message.
1409810	1415810	So it provided the authenticity and integrity, but maintained the confidentiality.
1417670	1423350	So to talk a little bit more about the scheme, in a less analogous way, what actually happens.
1423350	1430250	So a user has some message, D, and they blind the message to get a new message, D star.
1431750	1436070	And that's what they send to the signer. The signer then uses the private key to generate
1436230	1440470	a signature, sigma star, for that message, D star, and returns it to the user.
1441350	1448030	The user can then create, from sigma star, a valid signature sigma corresponding to their
1448030	1453510	original message. So any recipient can now validate the signature sigma, as they would
1453510	1458490	any other signature. And the signer gets no information about the contents of the message,
1458490	1466510	or the actual signature. And there's different mathematics behind blind signatures.
1467050	1473850	There are RSA-based options. I wouldn't recommend using these, because
1474870	1479090	with where we are right now, if we're implementing new technology, we want to be looking as far
1479090	1485450	ahead as possible. And in the long run, RSA is not secure against quantum computers, and just
1485450	1490970	is not secure compared to these other types of schemes. But there's also some attacks on the
1490970	1497870	RSA-based blind signatures. So I'm mostly going to focus on the lattice and the multivariate-based.
1497870	1505830	So the lattice-based blind signatures, again, they're post-quantum secure, and they rely on
1505830	1510290	similar problems, similar types of schemes, as those that are finalists in the NIST post-quantum
1510290	1515870	cryptography competition. So we have a lot of faith in these lattice-based schemes, and we can
1515870	1521730	create blind signatures from them. Additionally, multivariate, there's a scheme called the Rainbow
1521730	1527030	Scheme that's a finalist in the NIST post-quantum cryptography signature schemes competition.
1527870	1534110	So again, leads to be post-quantum secure. And we can turn this scheme into a blind signature scheme.
1534410	1538890	And there's a lot of benefits to multivariate cryptography, such as having very fast and short
1539450	1546030	signatures. And this diagram just kind of shows how the Rainbow Scheme works.
1546550	1554810	Essentially, you have a message w, the hashed message, and you recursively obtain
1555450	1564170	inverses of these functions to get the signature z. And then that signature z can be verified by
1564170	1570490	using the public key function and just applying that to see if you get the correct message back.
1570730	1577470	With blind signatures, there's just some extra steps in this process. You use a special function
1577470	1586450	called r that actually, by using that, you create the blind aspect of it. And then you
1586450	1593550	use zero-knowledge proofs at the end as well as part of the verification proof.
1593550	1599350	So a little bit more complicated, but again, very similar mathematics.
1601350	1607730	So in summary, we talked about homomorphic encryption, so computation on encrypted votes,
1607730	1612310	which allows us to tally the votes in their encrypted form. And it can use different
1612310	1617750	types of cryptography, but lattice space is one that is post-quantum secure and very flexible.
1618510	1622750	Then we talked about the mixed networks protocol, where you have a nested series
1622750	1628630	of encryption or re-encryptions and shufflings, and this way you cannot determine which person
1628630	1633370	the vote came from. And there's also a range of underlying public key cryptography mathematics
1633370	1639530	that I didn't go over, but the protocol itself is fairly flexible. And finally, we talked about
1639530	1645450	blind signatures. So this is where you create a valid signature without knowing the contents of
1645450	1649730	the message. So you're verifying authenticity and integrity of a vote while maintaining
1649730	1654890	confidentiality of a voter. And we talked about lattice and multivariate-based schemes.
1655290	1660270	To summarize everything, is it possible theoretically? Yes, eventually. Cryptographers
1660270	1665450	will help us get it right, as well as security people. Is it ready in practice? Not yet in the
1665450	1671170	United States. Let's start small scale, and maybe eventually we'll be able to have more voters vote
1671170	1679960	from their phones. So thank you. Thank you for coming to the talk.