# untitled section
**\[tex2md\] this section could not be converted; its LaTeX follows verbatim:** `Error at (line 178, column 175): unexpected } expecting \end{document} \author{Anonymized for submission to EuroS\&P 2016\iftr\relax\else\footnotemark{*}\thanks`
``` latex
\title{Election Verifiability:
Cryptographic Definitions\\and an Analysis of Helios, Helios-C, and JCJ
\iftr \\ {\Large (Technical Report)}
\\ {\large \today}
\else\relax\fi}
\ifanon
\author{Anonymized for submission to EuroS\&P 2016\iftr\relax\else\footnotemark{*}\thanks{\footnotemark{*}An anonymized companion technical report is available~\cite{tr}.}\fi}
\else
\ifieee
\author{\IEEEauthorblockN{Ben Smyth}
\IEEEauthorblockA{%SnT, %Interdisciplinary Centre for Security, Reliability and Trust,\\
University of Luxembourg\\
Luxembourg\\
research@bensmyth.com}
\and
\IEEEauthorblockN{Steven Frink}
\IEEEauthorblockA{IBM Watson\\
Durham, NC, US\\
steven.frink@ibm.com}
\and
\IEEEauthorblockN{Michael R. Clarkson}
\IEEEauthorblockA{Cornell University\\
Ithaca, NY, US\\
clarkson@cs.cornell.edu}}
\else
\author{Ben Smyth\inst{1} \and
Steven Frink\inst{2} \and
Michael R. Clarkson\inst{3}}
\institute{
University of Luxembourg\\
Luxembourg\\
\email{research@bensmyth.com}
\and
IBM Watson, Durham, NC, US\\
\email{steven.frink@ibm.com}
\and
Cornell University, Ithaca, NY, US \\
\email{clarkson@cs.cornell.edu}
}
\fi
\fi
%\ifanon
%\numberofauthors{1}
%\author{Anonymized for submission to CCS 2014\iftr\relax\else\thanks{An anonymized companion technical report is available~\cite{tr}.}%\fi}
%\else
%\numberofauthors{3}
%\author{
%\alignauthor Ben Smyth\\
% \affaddr{INRIA Paris-Rocquencourt}\\
% \affaddr{Paris, France}\\
% \email{research@bensmyth.com}
%\alignauthor Steven Frink \\
% \affaddr{Cornell University}\\
% \affaddr{Ithaca, NY, US}\\
% \email{sfrink@cs.cornell.edu}
%\alignauthor Michael R. Clarkson \\
% \affaddr{Cornell University}\\
% \affaddr{Ithaca, NY, US}\\
% \email{clarkson@cs.cornell.edu}
%}
%\fi
\maketitle
%Fix Springer footenote bug (institutions aren't footnotes!)
\setcounter{footnote}{0}
\thispagestyle{plain}
\pagestyle{plain}
% !TEX root = main-jcj-ev.tex
\newcommand{\ctx}{\mathit{ctx}}
\newcommand{\FSSymb}{\mathsf{wFS}}
\newcommand{\FS}[2]{\FSSymb(#1,#2)}
\newcommand{\sFSSymb}{\mathsf{FS}}
\newcommand{\sFS}[2]{\sFSSymb(#1,#2)}
\newcommand{\ProveSymb}{\mathsf{Prove}}
\newcommand{\CommSymb}{\mathsf{Comm}}
\newcommand{\RespSymb}{\mathsf{Resp}}
\newcommand{\VerSymb}{\mathsf{Verify}}
\newcommand{\ChallSymb}{\mathsf{Chal}}
\newcommand{\AuxSpace}{\mathsf{Auxiliary}}
\newcommand{\Comm}[2]{\CommSymb(#1,#2)}
\newcommand{\Chal}{\ChalSymb()}
\newcommand{\Resp}[2]{\RespSymb(#1,#2)}
\newcommand{\Ver}[2]{\VerSymb(#1,#2)}
\newcommand{\Chall}[1]{\ChallSymb(#1)}
\newcommand{\comm}{{\sf comm}}
\newcommand{\chal}{{\sf chal}}
\newcommand{\resp}{{\sf resp}}
\newcommand{\VoteInv}{\mathsf{Extract}}
\newcommand{\Voter}{\mathsf{Voter}}
\newcommand{\ProveKeySymb}{\mathsf{ProveKey}}
\newcommand{\ProveKey}[2]{\ProveKeySymb((#1),(#2),k)}
\newcommand{\SimProveKeySymb}{\mathsf{Sim}\ProveKeySymb}
\newcommand{\VerKeySymb}{\mathsf{VerKey}}
\newcommand{\VerKey}[2]{\VerKeySymb((#1),#2,k)}
\newcommand{\SignCiphSymb}{\mathsf{ProveCiph}}
\newcommand{\SignCiph}[3]{\SignCiphSymb((#1),(#2),#3,k)}
\newcommand{\SimSignCiphSymb}{\mathsf{Sim}\SignCiphSymb}
\newcommand{\SignCiphh}[2]{\SignCiphSymb((#1),(#2),k)}
\newcommand{\VerCiphSymb}{\mathsf{VerCiph}}
\newcommand{\VerCiph}[3]{\VerCiphh{#1}{#2,#3}}
\newcommand{\VerCiphh}[2]{\VerCiphSymb((#1),#2,k)}
\newcommand{\ProveBindSymb}{\mathsf{ProveBind}}
\newcommand{\ProveBind}[2]{\ProveBindSymb(#1,#2)}
\newcommand{\SimProveBindSymb}{\mathsf{Sim}\ProveBindSymb}
\newcommand{\VerBindSymb}{\mathsf{VerBind}}
\newcommand{\VerBind}[2]{\VerBindSymb(#1,#2)}
\newcommand{\ProveDecSymb}{\mathsf{ProveDec}}
\newcommand{\ProveDec}[2]{\ProveDecSymb((#1),#2,k)}
\newcommand{\VerDecSymb}{\mathsf{VerDec}}
\newcommand{\VerDec}[2]{\VerDecSymb((#1),#2,k)}
\newcommand{\ProveEQSymb}{\mathsf{ProvePET}}
\newcommand{\ProveEQ}[1]{\ProveEQSymb(#1)}
\newcommand{\VerEQSymb}{\mathsf{VerPET}}
\newcommand{\VerEQ}[2]{\VerEQSymb(#1,#2)}
\newcommand{\ProveMixSymb}{\mathsf{ProveMix}}
\newcommand{\ProveMix}[2]{\ProveMixSymb((#1),(#2),k)}
\newcommand{\VerMixSymb}{\mathsf{VerMix}}
\newcommand{\VerMix}[2]{\VerMixSymb((#1),#2)}
\newcommand{\ProveMixPairSymb}{\mathsf{ProveMixPair}}
\newcommand{\ProveMixPair}[2]{\ProveMixPairSymb((#1),(#2),k)}
\newcommand{\VerMixPairSymb}{\mathsf{VerMixPair}}
\newcommand{\VerMixPair}[2]{\VerMixPairSymb((#1),#2)}
\newcommand{\ProveReencSymb}{\mathsf{ProveReenc}}
\newcommand{\ProveReenc}[2]{\ProveReencSymb((#1),(#2))}
\newcommand{\VerReencSymb}{\mathsf{VerReenc}}
\newcommand{\VerReenc}[2]{\VerReencSymb((#1),#2)}
\newcommand{\GGenSymb}{\mathsf{Gen}}
\newcommand{\EEncSymb}{\mathsf{Enc}}
\newcommand{\DDecSymb}{\mathsf{Dec}}
\newcommand{\pk}{\mathit{pk}}
\newcommand{\sk}{\mathit{sk}}
\newcommand{\GGen}[1][k]{\GGenSymb(#1)}
\newcommand{\EEnc}[2][\PKT]{\EEncSymb(#1,#2)}
\newcommand{\DDec}[2][\SKT]{\DDecSymb(#1,#2)}
\newcommand{\VrfySymb}{\mathsf{Ver}}
\newcommand{\SgnSymb}{\mathsf{Sign}}
\newcommand{\Vrfy}[1][\pk,m,\sigma]{\VrfySymb(#1)}
\newcommand{\Sgn}[1][\sk,m]{\SgnSymb(#1)}
\newcommand{\SetupSymb}{\mathsf{Setup}}
\newcommand{\InitSymb}{\mathsf{Init}}
\newcommand{\RegisterSymb}{\mathsf{Register}}
\newcommand{\VoteSymb}{\mathsf{Vote}}
\newcommand{\BBSymb}{\mathsf{BB}}
\newcommand{\TallySymb}{\mathsf{Tally}}
\newcommand{\ResultSymb}{\mathsf{Result}}
\newcommand{\VerifySymb}{\mathsf{Verify}}
\newcommand{\Server}{\mathsf{Platform}}
\newcommand{\VerIntentSymb}{\mathsf{VerIntent}}
\newcommand{\ValidateSymb}{\mathsf{Validate}}
\newcommand{\BoxSymb}{\mathsf{Box}}
\newcommand{\VerifyVoteSymb}{\mathsf{VerifyVote}}
\newcommand{\SKT}{\mathit{SK}_{\mathcal T}}
\newcommand{\SKR}{\mathit{SK}_{\mathcal R}}
\newcommand{\PKR}{\mathit{PK}_{\mathcal R}}
\newcommand{\PKT}{\mathit{PK}_{\mathcal T}}
%\newcommand{\bb}{\mathcal B\mathcal B}
%\newcommand{\bbb}{\mathfrak{bb}}
%\newcommand{\bbb}{\bb}
% MRC: bulletin boards aren't active agents in our model, unlike
% talliers, so there's no reason I see to distinguish them typographically.
% Also, for some reason we had both \bb and \bbb. I standardized on \bbb,
% for no good reason really.
\newcommand{\bbb}{\mathit{BB}}
\newcommand{\Setup}[1][k_0]{\SetupSymb(#1)}
\newcommand{\Init}[1][\pk,\ctx]{\InitSymb(#1)}
\newcommand{\Register}[1][\SKR,\allowbreak{}i,\allowbreak{}k_1]{\RegisterSymb(#1)}
\newcommand{\Vote}[1][\sk,\allowbreak{}%\PKR,
\PKT,\allowbreak{}n_C,\allowbreak{}\beta,\allowbreak{}k_2]{\VoteSymb(#1)}
\newcommand{\BB}[3][\pk,\allowbreak{}\ctx]{\BBSymb(#1,#2,#3)}
\newcommand{\Tally}[1][\SKT,\allowbreak{}\bbb,\allowbreak{}n_C,\allowbreak{}\{\pk_i\}_{i=1}^{n_V},\allowbreak{}k_3]{\TallySymb(#1)}
\newcommand{\Result}[2]{\ResultSymb(#1,#2)}
\newcommand{\Verify}[1][\PKR,\allowbreak{}\PKT,\allowbreak{}\bbb,\allowbreak{}n_C,\allowbreak{}{\bf X},\allowbreak{}P]{\VerifySymb(#1)}
\newcommand{\Validate}[1][\PKT,b]{\ValidateSymb(#1)}
\newcommand{\BBox}[1][\PKT,\bbb,b]{\BoxSymb(#1)}
\newcommand{\VerifyVote}[1][\PKT,\bbb,i,\pk,\sk,b]{\VerifyVoteSymb(#1)}
\newcommand{\EncSymb}{\mathsf{enc}}
\newcommand{\PkSymb}{\mathsf{pk}}
\newcommand{\Enc}[3]{\EncSymb(#1,#2,#3)}
\newcommand{\Pk}[1]{\PkSymb(#1)}
\newcommand{\Adv}{\mathcal B}
\newcommand{\adv}{\mathcal A}
\newcommand{\advv}{\mathcal A'}
\newcommand{\chl}{\mathcal C}
\newcommand{\chll}{\mathcal C'}
\newcommand{\Exp}{\mathsf{Exp}}
\newcommand{\Succ}{\mathsf{Succ}}
\newcommand{\ExpVerifNoParam}[1][\Pi,\adv]{\Exp\text{-}\mathsf{JCJ}\text{-}\mathsf{Ver}}
\newcommand{\ExpVerif}[1][\Pi,\adv]{\Exp\text{-}\mathsf{JCJ}\text{-}\mathsf{Ver}(\allowbreak#1,\allowbreak n_C,\allowbreak n_V,\allowbreak k_1,\allowbreak k_2,\allowbreak k_3)}
\newcommand{\SuccVerif}[1][\Pi,\adv]{\Succ(\allowbreak\ExpVerif[#1])}
\newcommand{\ExpVerifCortierNoParam}[1][\Pi,\adv,k]{\Exp\text{-}\mathsf{CGGI}\text{-}\mathsf{Ver}\text{-}\mathsf{b}}
\newcommand{\ExpVerifCortier}[1][\mathbb V, \rho,\Pi,\star,\adv,k]{\Exp\text{-}\mathsf{CGGI}\text{-}\mathsf{Ver}\text{-}\mathsf{b}(\allowbreak#1)}
\newcommand{\SuccVerifCortier}[1][\mathbb V, \rho,\Pi,\star,\adv,k]{\Succ(\allowbreak\ExpVerifCortier[#1])}
\newcommand{\ExpVerifCortierGNoParam}[1][\Pi,\adv,k]{\Exp\text{-}\mathsf{CGGI}\text{-}\mathsf{Ver}\text{-}\mathsf{g}}
\newcommand{\ExpVerifCortierG}[1][\mathbb V, \rho,\Pi,\star,\adv,k]{\Exp\text{-}\mathsf{CGGI}\text{-}\mathsf{Ver}\text{-}\mathsf{g}(\allowbreak#1)}
\newcommand{\SuccVerifCortierG}[1][\mathbb V, \rho,\Pi,\star,\adv,k]{\Succ(\allowbreak\ExpVerifCortierG[#1])}
\newcommand{\ExpCorNoParam}[1][\Pi,\adv]{\Exp\text{-}\mathsf{JCJ}\text{-}\mathsf{Cor}}
\newcommand{\ExpCor}[1][\Pi,\adv]{\Exp\text{-}\mathsf{JCJ}\text{-}\mathsf{Cor}(\allowbreak#1,\allowbreak n_C,\allowbreak n_V,\allowbreak k_1,\allowbreak k_2,\allowbreak k_3)}
\newcommand{\SuccCor}[1][\Pi,\adv]{\Succ(\allowbreak\ExpCor[#1])}
\newcommand{\ExpLeakNoParam}[1][]{\Exp\text-\mathsf{leak}(\cdot)}
\newcommand{\ExpLeak}[1][\Pi,\adv]{\Exp\text-\mathsf{leak}(#1,k_1,\allowbreak \allowbreak k_3,\allowbreak n_C,\allowbreak n_V)}
\newcommand{\SuccLeak}[1][\Pi,\adv]{\Succ(\ExpLeak[#1])}
\newcommand{\ExpLeakINoParam}[1][]{\Exp\text-\mathsf{leak}(\cdot)}
\newcommand{\ExpLeakI}[1][\Pi,\adv]{\Exp\text-\mathsf{leak}(#1,k)}
\newcommand{\SuccLeakI}[1][\Pi,\adv]{\Succ(\ExpLeakI[#1])}
%\newcommand{\ExpIVNoParam}[1][\Pi,\adv]{\Exp_{#1}^\mathit{IV}(\cdot)}
\newcommand{\EASymb}{\mathsf{Ext}}
\newcommand{\IASymb}{\mathsf{Int}}
\newcommand{\Weak}{\mathsf{Weak}}
\newcommand{\Strong}{\mathsf{Strong}}
\newcommand{\IVSymb}{\mathsf{IV}}
\newcommand{\UVSymb}{\mathsf{UV}}
\newcommand{\EVSymb}{\mathsf{EV}}
\newcommand{\GVSymb}{\mathsf{GV}}
\newcommand{\VISymb}{\mathsf{CI}}
\newcommand{\ExpIVSymb} {\Exp\text{-}\IVSymb\text{-}\EASymb}
\newcommand{\ExpIVVSymb}{\Exp\text{-}\IVSymb\text{-}\IASymb}
\newcommand{\ExpUVSymb} {\Exp\text{-}\UVSymb\text{-}\EASymb}
\newcommand{\ExpUVVSymb}{\Exp\text{-}\UVSymb\text{-}\IASymb}
\newcommand{\ExpEVSymb} {\Exp\text{-}\EVSymb\text{-}\EASymb}
\newcommand{\ExpEVVSymb}{\Exp\text{-}\EVSymb\text{-}\IASymb}
\newcommand{\ExpEVVWeakSymb}{\Exp\text{-}\EVSymb\text{-}\IASymb\text{-}\Weak}
\newcommand{\ExpGVSymb}{\Exp\text{-}\GVSymb}
\newcommand{\ExpVISymb}{\Exp\text{-}\VISymb\text{-}\EASymb}
\newcommand{\ExpVIISymb}{\Exp\text{-}\VISymb\text{-}\IASymb}
\newcommand{\V}{\mathsf{V}}
\newcommand{\ExpIV} {\ExpIVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpIVV}{\ExpIVVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpUV} {\ExpUVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpUVV}{\ExpUVVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpEV} {\ExpEVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpEVV}{\ExpEVVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpGV}{\ExpGVSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpVI}{\ExpVISymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpVII}{\ExpVIISymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpEVVWeak}{\ExpEVVWeakSymb(\Pi, \allowbreak \adv, \allowbreak k)}
\newcommand{\ExpEVVV}{\Exp\text{-}\EVSymb\text{-}1\text{-}\IASymb\text{-}\Strong}
\newcommand{\ExpEVVVWeak}{\ExpEVVWeakSymb'}
\newcommand{\SuccVI}{\Succ(\ExpVI)}
\newcommand{\SuccIV}{\Succ(\ExpIV)}
\newcommand{\SuccIVV}{\Succ(\ExpIVV)}
\newcommand{\SuccUV}{\Succ(\ExpUV)}
\newcommand{\SuccUVV}{\Succ(\ExpUVV)}
\newcommand{\SuccEV}{\Succ(\ExpEV)}
\newcommand{\SuccEVV}{\Succ(\ExpEVV)}
\newcommand{\SuccEVVWeak}{\Succ(\ExpEVVWeak)}
\newcommand{\SuccEVVV}[1][\Pi,\adv]{\Succ_{#1}^\mathit{EV^*}(k)}
\newcommand{\SuccGV}{\Succ(\ExpGV)}
\newcommand{\ExpCPA}[1][\Pi,\adv]{\Exp_{#1}^\mathit{IND-CPA}(k)}
\newcommand{\SuccCPA}[1][\Pi,\adv]{\Succ_{#1}^\mathit{IND-CPA}(k)}
\newcommand{\gameShort}{\mathsf{IND}\textsf{-}\mathsf{CPA}}
\newcommand{\gameP}[3]{\gameShort_{#1, #2}(#3)}
\newcommand{\game}{\gameP{\adv}{\Gamma}{n}}
\newcommand{\gameShortINDCPA}{\mathsf{IND}\textsf{-}\mathsf{CPA}}
\newcommand{\gamePINDCPA}[3]{\gameShortINDCPA(#1, #2,#3)}
\newcommand{\gameINDCPA}{\gamePINDCPA{\Pi}{\adv}{k}}
\newcommand{\gameShortINDPA}{\mathsf{IND}\textsf{-}\mathsf{PA0}}
\newcommand{\gamePINDPA}[3]{\gameShortINDPA(#1, #2,#3)}
\newcommand{\gameINDPA}{\gamePINDPA{\Pi}{\adv}{k}}
\newcommand{\nmcpaShort}{\textsf{IND-1-CPA}}
\newcommand{\nmcpaP}[3]{\nmcpaShort_{#1, #2}(#3)}
\newcommand{\nmcpa}{\nmcpaP{\adv}{\Gamma}{n}}
\newcommand{\gameShortK}[1]{\textsf{IND-}#1\textsf{-CPA}}
%\newcommand{\gameShortOne}[1]{\gameShortK{1}}
\newcommand{\gamePOne}[4]{\gameShortK{#1}_{#2, #3}(#4)}
\newcommand{\gameOne}{\gamePOne{1}{\adv}{\Pi}{n}}
\newcommand{\gameK}[1]{\gamePOne{#1}{\adv}{\Pi}{n}}
\newcommand{\gameShortG}{\textsf{IND-$j$-CPA}}
\newcommand{\PGSymb}{\mathsf{CPA}}
\newcommand{\gamePGSymb} {\Exp\text{-}\PGSymb}
\newcommand{\gamePG}[3]{\gamePGSymb(j,#1, #2, #3)}
\newcommand{\gameG}{\gamePG{\Gamma}{\adv}{k}}
\newcommand{\gamerm}{$\widebar{\textrm{IND}}\textrm{-CPA}$}
\newcommand{\gameShortt}{\widebar{\textsf{IND}}\textsf{-CPA}}
\newcommand{\gameeP}[3]{\gameShortt_{\mathcal #1, #2}(#3)}
\newcommand{\gamee}{\gameeP{\adv}{\Pi}{n}}
\newcommand{\gameShortNM}{\textsf{NM-CPA}}
\newcommand{\gamePNM}[3]{\gameShortNM_{#1, #2}(#3)}
\newcommand{\gameNM}{\gamePNM{\adv}{\Pi}{n}}
\newcommand{\atk}{\textsf{atk}}
\newcommand{\gameAtk}{\textsf{IND-}\atk}
\newcommand{\gamePAtk}[2]{\gameAtk_{#1}(#2)}
\newcommand{\gameSec}{\textsf{IND-BS}}
\newcommand{\gamePSec}[3]{\gameSec_{#1, #2}(#3)}
\newcommand{\gameDSec}{\gamePSec{\adv}{\Gamma}{n}}
\newcommand{\gameSReceipt}{\textsf{IND-SRF}}
\newcommand{\gamePSReceipt}[4]{\gameSReceipt_{#1, #2, #3}(#4)}
\newcommand{\gameDSReceipt}{\gamePSReceipt{\adv}{\Gamma}{V}{n}}
\newcommand{\gameReceipt}{\textsf{IND-RF}}
\newcommand{\gamePReceipt}[4]{\gameReceipt_{#1, #2, #3}(#4)}
\newcommand{\gameDReceipt}{\gamePReceipt{\adv}{\Gamma}{V}{n}}
\newcommand{\gameCoer}{\textsf{IND-CR}}
\newcommand{\gamePCoer}[4]{\gameCoer_{#1, #2, #3}(#4)}
\newcommand{\gameDCoer}{\gamePCoer{\adv}{\Gamma}{V}{n}}
\newcommand{\mC}{\mathit{m_C}}
\newcommand{\mB}{\mathit{m_B}}
\newcommand{\aux}{\mathit{aux}}
\newcommand{\votespace}{\mathfrak m}
\newcommand{\outcome}{\mathfrak v}
\newcommand{\prooff}{\mathfrak{p}}
%\newcommand{\bb}{\mathfrak{bb}}
%\newcommand{\bbi}{\mathit{bb}}
\newcommand{\oracleSymb}[1][]{\mathcal O_{#1}}
\newcommand{\oracle}[2][]{\oracleSymb[#1](#2)}
\newcommand{\bbOracle}{B}
\newcommand{\corruptOracle}{C}
\newcommand{\revealOracle}{R}
\newcommand{\registerOracle}{E}
\newcommand{\Add}[2][\beta,\kappa]{\mathtt{Add}(#2,#1)}
\newcommand{\Sub}[2][\beta,\kappa]{\mathtt{Sub}(#2,#1)}
\newcommand{\auxDupl}{{\bf P_{dupl}}}
\newcommand{\auxMix}[1]{P_{mix,#1}}
\newcommand{\auxInelig}{{\bf P_{inelig}}}
\newcommand{\auxDec}{{\bf P_{dec}}}
\newcommand{\MixSymb}{\mathsf{Mix}}
\newcommand{\Mix}[1]{\MixSymb(#1)}
\newcommand{\ESStyle}[1]{\mathsf{#1}}
\newcommand{\Nonce}{\ESStyle{Nonce}}
\newcommand{\Commit}{\ESStyle{Commit}}
\newcommand{\Choice}{\ESStyle{Choice}}
\newcommand{\Sign}{\ESStyle{Sig}}
\newcommand{\AlwaysVerify}{\ESStyle{AlwaysVerify}}
\newcommand{\IgnoreCreds}{\ESStyle{IgnoreCreds}}
\newcommand{\Com}{\mathsf{Com}}
\newcommand{\correcttally}{\mathit{correct\text{-}tally}}
\newcommand{\electoralroll}{L}
\newcommand{\electoralrollprivate}{M}
\newcommand{\refappendixaux}[2]{\iftr{Appendix~{#1}}\else{{#2} companion technical report~\cite{tr}}\fi}
\newcommand{\refappendix}[1]{\refappendixaux{#1}{the}}
\newcommand{\Refappendix}[1]{\refappendixaux{#1}{The}}
%\newcommand{\heliosspec}{Helios'12}
\newcommand{\heliosnext}{Helios'16}
\newcommand{\JCJ}{JCJ}
\newcommand{\JCJnext}{JCJ'16}
\newcommand{\JCJc}{\widehat{\mathsf{JCJ}}}
\newcommand{\cryptofootnote}[1]{\footnote{#1 defined in \refappendix{\ref{sec:crypto}}.}}
\newcommand{\trcryptofootnote}[1]{\iftr\footnote{#1 defined in \refappendix{\ref{sec:crypto}}.}\else\relax\fi}
\newcommand{\EVGV}{\ensuremath{\mathsf{Glo\text{-}Ver\text{-}Ext}}}
\newcommand{\EVEA}{\ensuremath{\mathsf{Ver\text{-}Ext}}}
\newcommand{\EVIA}{\ensuremath{\mathsf{Ver\text{-}Int}}}
\newcommand{\EVIAWeak}{\ensuremath{\mathsf{Ver\text{-}Int\text{-}\Weak}}}
\newcommand{\proofparagraph}[1]{\medskip\noindent\textbf{#1}}
\newcommand{\subscriptReject}{R}
\newcommand{\ExpZKName}{\Exp\text{-}\mathsf{ZK}}
\newcommand{\authorized}{\mathit{authorized}}
\newcommand{\gv}{\delta_{\mathit{GV}}}
% !TEX root = main-jcj-ev.tex
\begin{abstract}
Election verifiability is defined in the computational
model of cryptography. The definition formalizes
notions of voters verifying their own votes, auditors
verifying the tally of votes, and auditors verifying that
only eligible voters vote.
The Helios (Adida et al., 2009)\ifheliosc, Helios-C (Cortier et al., 2014)\fi\ and
JCJ (Juels et al., 2010) election schemes are analyzed using the definition.
\begin{comment}
Helios 4.0 satisfies the definitions, but Helios 2.0 does not because of previously
known attacks.
\ifheliosc
A variant of Helios-C satisfies the definitions, whereas the original does not
because of an attack.
\fi
\end{comment}
%\sout{Vulnerabilities are discovered against both the Helios and Helios-C schemes.}
Neither Helios nor Helios-C satisfy the definition
because they do not ensure that recorded ballots are
tallied in certain cases when the adversary posts malicious material on the bulletin board.
A variant of Helios is proposed and shown to satisfy the definition.
\later{Variants of Helios and Helios-C are proposed and shown to satisfy the definition.}
JCJ similarly does not ensure that recorded ballots are tallied in certain cases.
%\sout{JCJ does not satisfy the definition because of a trust assumption it makes,
%but it does satisfy a weakened definition.}
Moreover, JCJ does not ensure that only eligible voters vote, due to a trust assumption it makes.
A variant of JCJ is proposed and shown to satisfy a weakened definition
that incorporates the trust assumption.
Previous definitions of verifiability (Juels et al., 2010; Cortier et al., 2014; Kiayias et al., 2015)
and definitions of global verifiability (K\"usters et al., 2010; Cortier et al., 2016)
are shown to permit election schemes vulnerable to attacks, whereas the new definition
prohibits those schemes.
And a relationship between the new definition and a variant of global verifiability is shown.
\end{abstract}
%\keywords{Electronic voting; individual verifiability; universal verifiability;
%eligibility verifiability; collusion attack; authentication; applied cryptography}
\later{\ben{TO DO: variant of Helios-C.}}
\later{There's a "to do" list in \texttt{main-jcj-ev.tex}}
\begin{comment}
\begin{color}{olive}
[Later] The dream (emails 25 \& 29 April'15; updated 4 Nov'15).
\noindent For conference submission:
\begin{itemize}
\item{} [Ben] well-hidden errors in crypto appendix -- \textcolor{red}{{\bf ready for review. UPDATE: Steven is satisfied. Ben recommends that Michael makes a careful pass.}}
\item{} [Ben] Ballot weeding attacks \& implications for Helios (\S\ref{sec:helios})
-- \textcolor{red}{{\bf a sketch is ready for review; comments for improvments are welcome.}}
\item{} [Ben] Re-voting / making correct-tally work with re-voting, and an attack against JCJ which exploits re-voting -- \textcolor{red}{{\bf I started on this and decided that JCJ simply doesn't handle re-votes. I've updated the text in Section~\ref{sec:def:uvv} to reflect this. Since we aren't considering voting schemes with re-voting (re-voting in Helios is uninteresting, because it simply relies on a trusted third part, cf. \S\ref{sec:def:uvv}), we needn't generalised our definitions.)}}
\item{} [\sout{Michael}Ben] Revise introduction to make claims less significant (addressing reviewer 1)
\item{} [?Michael\&Steven?] Address recent reviews, including confusion over re-voting. -- \textcolor{red}{{\bf BEN (8 Apr 16): I think the only outstanding issue concerns generality (as per the previous bullet point), which I've addressed in revision 895.}}
\item{} [Ben] Sig case study -- \textcolor{red}{\bf Update (29 Dec 2015): Considering the more general sign(election scheme, signature scheme) construction seems like a considerable body of work. Accordingly, I suggest that we consider the sign(signature scheme) construction in this work. If we want to consider sign(election scheme, signature scheme), then let's do so elsewhere. It would make sense to also prove that the construction ensures privacy, assuming the underlying election scheme satisfies privacy. Perhaps this could be done in collaboration with Cortier et al.}
\end{itemize}
\noindent In addition, Ben suggests considering whether we can make anything of:
\begin{itemize}
\item{} [Ben] critic of global verifiability by K\"usters -- \textcolor{red}{{\bf ready for review.}}
\end{itemize}
\noindent For journal submission:
\begin{itemize}
\item{} [Steven/Michael] voter intent
\item{} [All] Proof checking! (An important, but regularly neglected task.)
\item{} [?] Proofs that our toy examples are really election schemes, i.e.,
correctness/completeness/injectivity proofs. I think this will give us
confidence that we have the right notion of an election scheme.
\end{itemize}
\noindent Other:
\begin{itemize}
\item{} [?] Add a notion of ``global verifiability" (not necessarily in Ralf's framework) and prove relation(s) with our definitions.
\item{} [?] Injectivity / everlasting privacy / how to make correct-tally work
\item{} [?] Explore the possibility of adversary controlling registration.
\item{} [?] clash attacks from malicious Vote implementations
\item{} [?] extension to Civitas
\item{} [?] Consistent horizontal alignment of algorithms
\end{itemize}
\end{color}
\end{comment}
%\ben{I pushed footnotes to the right column, in the hope that it aids presentation. If that doesn't work, then remote ftnright from \texttt{main-jcj-ev.tex}.}
% !TEX root = main-jcj-ev.tex
```
# Introduction
Electronic voting systems that have been deployed in real-world, large-scale public elections place extensive trust in software and hardware. Unfortunately, instead of being trustworthy, many systems are vulnerable to attacks that could bring election outcomes into disrepute (**JonesSimons12:VotingBook?**; **GermanyCourt09?**; **DebraBowenCalifornia07?**; **ElectoralCommision07?**). So relying solely on trust in voting systems is unwise; verification of election outcomes is essential. [^1]
*Election verifiability* enables voters and auditors to ascertain the correctness of election outcomes, regardless of whether the software and hardware of the voting system are trustworthy (**JCJ02?**; **ChaumRyanSchneider2005?**; **BenAdidaThesis?**; **DagstuhlAccord07?**; **Adida08?**). Kremer et al. (**Smyth10:ElectionVerifiability?**) decompose election verifiability into three aspects:
- *Individual verifiability:* voters can check that their own ballots are recorded.
- *Universal verifiability:* anyone can check that the tally of recorded ballots is computed properly.
- *Eligibility verifiability:* anyone can check that each tallied vote was cast by an authorized voter.
We propose new definitions of these three aspects of verifiability in the computational model of cryptography. We show that individual and universal verifiability are orthogonal, and that eligibility verifiability implies individual verifiability. Because some electronic voting systems implement voter authentication themselves, whereas other systems outsource voter authentication to third parties, we develop two variants of our definitions—one for systems with *internal authentication* and another for systems with *external authentication*.
We employ our definitions to analyze the verifiability of two well-known election schemes, JCJ (**JCJ10?**) and Helios (**AdidaPereiraMarneffeQuisquater?**). JCJ is an election scheme that achieves *coercion resistance* and has been implemented as Civitas (**CCM08?**); it implements its own internal authentication. Helios is a web-based voting system that has been deployed in the real-world and outsources authentication.
We also analyze the verifiability of Helios-C (**Cortier14:verifiability?**), a variant of Helios that implements internal authentication by digitally signing ballots.
The first implementation of Helios, namely *Helios 2.0*, and the current release, namely *Helios 3.1.4*, are known to have vulnerabilities that can be exploited to violate ballot secrecy and verifiability (**Smyth11:Helios?**; **Smyth12:Helios?**; **Bernhard12:Helios?**; **Essex16:HeliosVerifiability?**).
A variant of Helios, henceforth , is proposed, and shown to satisfy our definition of election verifiability with external authentication. Helios 2.0 and Helios 3.1.4 fail to satisfy our definition.
Our analysis of Helios-C reveals that an adversary could record an ill-formed ballot that causes tallying to abort in a manner that anyone will accept. Yet, our definition of universal verifiability demands that accepted outcomes include the choices used to construct any well-formed ballots. Hence, each voter can be assured that their choice contributed to the outcome. By comparison, Helios-C does not assure this, because ill-formed ballots cause tallying to abort and that abort will be accepted. Thus, Helios-C does not satisfy our definition of universal verifiability. Nevertheless, a straightforward variant of Helios-C that disregards ill-formed ballots should satisfy our definition.
Our analysis of JCJ reveals that an adversary could cause the acceptance of tallies which exclude authorized ballots in favour of unauthorized ballots. Yet, our definition of universal verifiability demands that accepted outcomes include only the choices cast by authorized voters. Thus, JCJ does not satisfy our definition of universal verifiability. The JCJ election scheme does not satisfy our definition of eligibility verifiability either, because an adversary who learns the tallier’s private key could cast unauthorized votes. We introduce a weakened definition of eligibility verifiability, incorporating JCJ’s trust assumption that the private key is not known to the adversary, and show that variants of JCJ, henceforth , satisfy our weakened definition of election verifiability with internal authentication.
Küsters et al. (**Kusters10?**; **Kusters11:UniversalVerifiability?**; **Kusters12:ClashAttacks?**; **Kusters10b?**) propose an alternative, holistic notion of verifiability called *global verifiability*, which must be instantiated with a goal. We undertake a formal comparison of election verifiability and global verifiability, when instantiated with a goal proposed by the aforementioned authors and a goal by Cortier et al. (**Cortier16:VerifiabilitySoK?**). We found that does not satisfy global verifiability with those goals. Nonetheless, we were able to show that satisfies a slightly weaker goal. And, moreover, election verifiability is strictly stronger than global verifiability with that goal.
Our definitions of election verifiability improve upon two previous definitions (**JCJ10?**; **Cortier14:verifiability?**) by detecting a new class of *collusion attacks*, in which the tallying algorithm announces an incorrect tally, and the verification algorithm colludes with the tallying algorithm to accept the incorrect tally. Examples of collusion attacks include vote stuffing, and announcing tallies that are independent of the election. Our definitions also improve upon those previous definitions and a further definition (**Kiayias15?**) by detecting a new class of *biasing attacks*, in which the verification algorithm rejects some legitimate election outcomes. Examples of biasing attacks include rejecting outcomes in which a particular candidate does not win, and rejecting all election outcomes, even correct outcomes. Moreover, our definitions improve upon global verifiability instantiated with goals by Küsters et al. (**Kusters10b?**) and Cortier et al. (**Cortier16:VerifiabilitySoK?**) by detecting a new class of *revelation attacks*, in which the verification algorithm accepts incorrect outcomes when coins used to construct some ballots are leaked. Examples of revelation attacks include announcing tallies that exclude or replace some votes.
This paper thus contributes to the security of electronic voting systems by:
- proposing definitions of election verifiability in the computational model;
- showing that individual, universal, and eligibility verifiability are mostly orthogonal properties of voting systems;
- proving that Helios 2.0, Helios 3.1.4, Helios-C and JCJ do not satisfy election verifiability, and that and do;
- formally comparing election and global verifiability; and
- identifying new classes of attacks on voting systems and demonstrating that they are not detected by earlier works.
Our definitions are sufficient to analyze Helios, Helios-C, and JCJ. They correctly identify Helios 2.0, Helios 3.1.4, Helios-C and JCJ as not satisfying verifiability. And they enable the first proofs that and satisfy a definition of verifiability in the computational model. Although some protocols may fall outside the scope of our definitions, they are sufficiently general to be useful.
### Structure
Section [sec:ev] defines election verifiability with external authentication. Section [sec:helios] analyzes Helios. Section [sec:ev2] defines election verifiability with internal authentication.
Section [sec:heliosc] analyzes Helios-C.
Section [sec:civitas] analyzes JCJ. Section [sec:global-verifiability] presents a comparison between election and global verifiability. Section [sec:newAttacks] introduces collusion, biasing and revelation attacks. Section [sec:related] reviews related work and Section [sec:conclusion] concludes.
Appendix [sec:crypto] defines cryptographic primitives. The remaining appendices explore alternative definitions of verifiability, give the details of Helios and JCJ, and present proofs.
# External Authentication
**\[tex2md\] this section could not be converted; its LaTeX follows verbatim:** `Error at (line 850, column 13): expecting \end{document} & ~\qquad\qquad \mathrel\wedge b'=\Vote[\sk,\PKT,n_C,\beta',k; r']\}. ^`
``` latex
\section{External Authentication}
\label{sec:ev}
Some election schemes do not implement authentication themselves, but instead rely on an external authentication mechanism.
Helios, for example, supports authentication with Facebook, Google and Twitter credentials.\footnote{\url{https://github.com/benadida/helios-server/tree/master/helios_auth/auth_systems}, accessed 4 Aug 2015.}
In essence, the election scheme outsources ballot authentication.
We begin by defining election verifiability for that model.
\subsection{Election scheme syntax}
\label{sec:def:externalscheme}
We define syntax for an election scheme with external authentication, which henceforth in this section we abbreviate as ``election scheme.''\footnote{We focus
on modeling first-past-the-post voting systems. Smyth shows the syntax is sufficiently versatile to capture ranked-choice voting systems too~\cite{2017-FPTP-suffices-for-ranked-voting}.}
\begin{definition}[Election scheme with external authentication]
An \emph{election scheme with external authentication} is a tuple $(\SetupSymb, \VoteSymb, \allowbreak \TallySymb, \VerifySymb)$ of
probabilistic pol\-y\-no\-mi\-al-time (PPT) algorithms:%\footnote{%
%\review{Algorithms, rather than interactive protocols, suffice
%to model many election schemes.
%We leave generalization to interactive protocols as future work.}
%\mrc{Arguably it's not sufficient, given that we can't model the Benaloh challenges used by Helios, which are a key component of its verifiability. I am in favor of removing this footnote. I no longer recall why it's here...}
%}
% !TEX root = main-jcj-ev.tex
\begin{itemize}
\item \textbf{Setup}, denoted\footnote{%
Let $\mathsf{Alg}(\mathit{in}; r)$ denote the output of probabilistic algorithm $\mathsf{Alg}$ on input $\mathit{in}$ and coins $r$.
Let $\mathsf{Alg}(\mathit{in})$ denote $\mathsf{Alg}(\mathit{in};r)$, where $r$ is chosen uniformly at random (from the coin space of algorithm $\mathsf{Alg}$).
And let $\leftarrow$ denote assignment.}
%\footnote{%
%Let $\mathit{out} \leftarrow \mathsf{Alg}(\mathit{in}; r)$ denote running the probabilistic algorithm $\mathsf{Alg}$ on input $\mathit{in}$ and random coins $r$, and assigning the output to $\mathit{out}$.
%Let $\mathsf{Alg}(\mathit{in})$ denote $\mathsf{Alg}(\mathit{in};r)$, where $r$ is chosen uniformly at random.
%Hence $\mathit{out} \leftarrow \mathsf{Alg}(\mathit{in})$ denotes sampling $\mathit{out}$ uniformly at random from $\mathsf{Alg}(\mathit{in})$.}
$(\PKT,\SKT,\mB,\mC) \leftarrow \Setup[k]$, is executed by the \emph{tallier}, who is responsible for tallying ballots.\footnote{Some election schemes (e.g., Helios\ifheliosc, Helios-C,\fi\ and JCJ) permit the tallier's role to be distributed amongst several talliers. For simplicity, we consider only a single tallier in this paper.}
$\SetupSymb$ takes a security parameter $k$ as input and outputs a key pair ($\PKT$, $\SKT$),
% a non-interactive proof $Q$ that the key pair is correctly constructed,
a maximum number of ballots $\mB$, and a maximum number of candidates $\mC$.\iftr\footnote{%
The maximum ballots and candidate numbers are used to formalize Correctness.
Helios requires that the maximum number of ballots is less than or equal to the size of the underlying encryption scheme's message space, and JCJ requires that the maximum number of candidates is less than or equal to the size of the underlying encryption scheme's message space.
%\review{\sout{These maximums might also be useful to algorithms $\VoteSymb$, $\TallySymb$, and $\VerifySymb$.
%However, parameters $\mB$ and $\mC$ do not need to be explicitly supplied as input to these algorithms, because they can be
%included in the public key, where necessary.}}
}\fi
\item \textbf{Vote}, denoted $b \leftarrow \Vote[\PKT,n_C,\beta,k]$, is executed by voters.
A voter makes a \emph{choice} of candidate from a sequence $c_1, \ldots, c_{n_C}$ of candidates.
A \emph{well-formed} choice is an integer $\beta$, such that $1 \leq \beta \leq n_C$. \never{
\ben{Do we need the notion of \emph{well-formed choice}?} \mrc{Yes, it appears we use that
notion later in the paper. Grep for it and I think you'll see.}
There's no reason to typographically distinguish choices from other data (even if JCJ did so). Let's get rid of the Greek. Replace $\beta$ with $c$? BEN: $c$ clashes with ciphertext.}
$\VoteSymb$ takes as input the public key $\PKT$ of the tallier,
%a proof $Q$ of correct key pair construction,
the number $n_C$ of candidates,
the voter's choice $\beta$ of candidate, and security parameter $k$.
%\footnote{An upper bound on the number of candidates might be required for verifiability---for example, JCJ requires that the maximum number of candidates is less than or equal to the size of the underlying encryption scheme's message space. The number of candidates is henceforth assumed to be bounded by a polynomial in the security parameter.}\
It outputs a ballot $b$, or error symbol $\perp$.
An error might occur if the candidate choice is not well-formed
%if $Q$ is not a correct proof of construction for $\PKT$,
%\review{if $\PKT$ is not correct with respect to $k$,}
%\review{if $n_C>\mC$,}
or for other reasons particular to the election scheme.
\item \textbf{Tally}, denoted $({\bf X},P) \leftarrow \Tally[\SKT,\allowbreak\bbb,\allowbreak n_C,\allowbreak k]$, is executed by the tallier.
It involves a public \emph{bulletin board} $\bbb$, which we model as a set.%
\footnote{Bulletin boards have also been modeled as public broadcast channels~\cite{CramerGennaroSchoenmakers97:AdditiveElGamal,Peters05:bb,Sandler07:Auditorium}.
We abstract from the details of channels by employing sets to represent the data sent on them. We favor sets over multisets, because
Cortier and Smyth~\cite{Smyth11:Helios,Smyth12:Helios} demonstrate attacks against privacy
when the bulletin board is modeled as a multiset.}
$\TallySymb$ takes as input the private key $\SKT$ of the tallier, the bulletin board $\bbb$,
the number of candidates $n_C$, and security parameter $k$.
%\footnote{An upper bound on the bulletin board's length might be required for verifiability---for example, Helios requires that the maximum number of ballots on the bulletin board is less than or equal to the size of the underlying encryption scheme's message space. For brevity, the bulletin board's length is henceforth assumed to be bounded by a polynomial in the security parameter.}
It outputs a tally ${\bf X}$ and a non-interactive proof $P$ that the tally is correct.
A \emph{tally} is a vector ${\bf X}$ of length $n_C$ such that ${\bf X}[j]$ indicates the number of votes for candidate $c_j$.%
\footnote{Let ${\bf X}[i]$ denote component $i$ of vector ${\bf X}$.
%\ben{Do we use $|{\bf X}|$? YES, we do: in case studies and collusion attacks. I have pushed the definition until collusion attacks.}
% MRC: I can't find any place this notation is actually used. I think we always turn the
% vector into a multiset first, then use multiset membership.
% Let $x\in{\bf X}$ denote that $x$ is some component of vector $\bf X$.
\never{We have both vectors and sequences. Let's get rid of vectors.}}
\item \textbf{Verify}, denoted $v \leftarrow \Verify[\PKT,\bbb, n_C,{\bf X},P,k]$, can be executed by anyone to audit the election.
$\VerifySymb$ takes as input the public key $\PKT$ of the tallier,
%a proof $Q$ of correct key pair construction,
the bulletin board $\bbb$, the number of candidates $n_C$, a tally ${\bf X}$,
a proof $P$ of correct tallying,
and security parameter $k$.
It outputs a bit $v$, which is $1$ if the tally successfully verifies and $0$ otherwise.
We assume that $\VerifySymb$ is deterministic.
%\ifmax\textcolor{red}{We also assume that $\VerifySymb$ checks that $n_C,n_V\leq|\mathfrak m|$, where $\mathfrak m$ is the message space corresponding to $\PKT$. If $\PKT=\bot$, then $n_C$ and $n_V$ need not be bounded.}\steven{We can use footnote 5 here to explain the reasons for this.}\fi
%\mrc{Are we actually going to use that assumption anywhere? Or is this because of notation?}
%\ben{I think it is a sensible requirement and I have stated a similar condition for encryption schemes, signatures schemes and sigma protocols. The job of the $\VerifySymb$ algorithm is to check proofs. If the algorithm is non-deterministic, then it is doing something peculiar. Moreover, from a practical perspective, to ensure confidence in an election, the $\VerifySymb$ algorithm must output the same thing every time. However, I must concede that every deterministic algorithm can be turned into a non-deterministic algorithm which does the same thing with overwhelming probability and our definition could be designed to consider them.}
\end{itemize}
%\ben{I have a slight preference for not defining the type of proof that should be used. However, if you would like to define a type of proof, then we should not require [interactive] \emph{zero-knowledge proofs}. By definition, proofs derived by the Fiat-Shamir transformation are not zero-knowledge, because the verifier has a proof that could not have been constructed by the verifier. I'd be happy with \emph{proofs of knowledge}.}
%\mrc{My main concern is actually for readers confused (as I am to some degree when I read this text) about what we mean by the word ``proof.'' I agree that it would be better not to imply interactive zero-knowledge. But ``proofs of knowledge'' are interactive, too. What if we wrote ``non-interactive proof''? Another alternative could be ``non-interactive zero-knowledge proof'' [\url{http://dl.acm.org/citation.cfm?id=62222}].}
%\ben{You're right: proofs of knowledge are interactive. I'm thinking of a particular paper which used the term exclusively for non-interactive proofs (after defining their usage). I quite like signature of knowledge, but I think this terminology is slightly controversial. Moreover, it isn't sufficiently generally, since not all non-interactive proofs of knowledge are signatures (a proof of knowledge is only a signature of knowledge if it takes a message [to be signed] as input). I'm happy with ``non-interactive proof." I've made this change.}
%The executors of algorithm $\VoteSymb$ could be distributed---i.e., algorithm $\VoteSymb$ could be replaced by an interactive protocol. Indeed, EXAMPLES.
%The tallier's role can be distributed amongst several talliers. Indeed, Helios and JCJ both permit threshold keys. For simplicity, a single tallier is considered throughout this paper.
%\ifmax
%\textcolor{red}{Throughout this paper, we assume that $n_C$ and $n_V$ are bounded by a polynomial in the security parameter. Similarly, we assume that the message space $\mathfrak m$ output by the key generation algorithm of cryptographic primitives, when run on security parameter $k$, has size exponential in $k$.}
%This is necessary in cases where ballots for a candidate include, for example, an encryption of that candidate, as otherwise it would not be possible to encode candidates $\beta>|\mathfrak m|$ into the message space.} %%%Note: This is explained in footnote 5
%\steven{If $\VerifySymb$ is checking this, we may not need these assumptions. I think they are still reasonable though.}
%\fi
\noindent
Election schemes must satisfy \emph{Correctness}:
%\steven{Do we want ``for sufficiently large" or ``for infinitely many" $k$, perhaps? Similarly in Correctness for internal authentication.}
%
% !TEX root = main-jcj-ev.tex
%
%
there exists a negligible function $\mu$,
such that for all security parameters $k$,
integers $n_B$ and $n_C$, and
choices $\beta_1,\dots,\beta_{n_B}\in\{1,\dots,n_C\}$, it holds that
if ${\bf Y}$ is a vector of length $n_C$ whose components are all $0$, then\\
%\begin{equation*}
%\begin{split}
%\Pr [&(\PKT,\SKT,Q) \leftarrow \Setup[k]; \\
%%% Ugly \hskip hack
% &\textrm{\lFor{$1 \leq i \leq n_B$}{${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$}}; \\
% &\textrm{\lFor{$1 \leq i \leq n_B$}{$b_i \leftarrow \Vote[\PKT,Q,n_C,\beta_i,k]$}}; \\
% &\bbb \leftarrow \{b_1,\dots,b_{n_B}\};\\
% &({\bf X},P) \leftarrow \Tally[\PKT,\SKT, \bbb,n_C,k]:\\
% &{\bf X} = {\bf Y} ] > 1 - \mu(k).
%\end{split}
%\end{equation*}
{\upshape
\noindent $\Pr[(\PKT,\SKT,\mB, \mC) \leftarrow \Setup[k]$;\\
\begin{algorithm}[H]
\For{$1 \leq i \leq n_B$}{
\ifint$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$;\\\fi
$b_i \leftarrow \Vote[\ifint\sk_i,\fi\PKT,n_C,\beta_i,k]$;\\
${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$;
}
\ifint$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_B}\}$; \\\fi
$\bbb \leftarrow \{b_1,\dots,b_{n_B}\}$;\\
$({\bf X},P) \leftarrow \Tally[\SKT, \bbb,\ifint\electoralroll,\fi n_C,k]:$
$n_B \leq \mB \wedge n_C\leq \mC \Rightarrow {\bf X} = {\bf Y}] > 1 - \mu(k)$.
\end{algorithm}
}
%\steven{Does correctness imply injectivity? If ballots collide, then the set $\bbb$ above will be missing a ballot and the resulting tally
%will not be correct.}
%\ben{I'm not immediately convinced that this is true, because I could design a Tally algorithm that considers the size of the bulletin board when computing ${\bf X}$ such that ${\bf X}$ does not contain votes arising from collisions.}
%\steven{I don't understand your example. Consider a scheme where a ballot for candidate $\beta$ is just $\beta$, and the simple case where $n_C=1$, $n_V=2$, and both voters submit votes for $\beta=1$. Then $\bbb=\{1\}$. How can the Tally algorithm know that it should count 2 votes for candidate 1 and not just 1 vote?}
%\begin{algorithmic}
%\FORALL{$1 \leq i \leq n_V$}
% \STATE $b_i \leftarrow \Vote[\PKT,Q,n_C,\beta_i,k]$;
% \STATE ${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$;
%\ENDFOR
%\STATE $\bbb \leftarrow \{b_1,\dots,b_{n_V}\}$;\\
%\STATE $({\bf X},P) \leftarrow \Tally[\PKT,\SKT, \bbb,n_C,k]:$
%\STATE ${\bf X} = {\bf Y}] > 1 - \mu(k)$.
%\end{algorithmic}
%\begin{equation*}
%\begin{split}
%\Pr [&(\PKT,\SKT,Q) \leftarrow \Setup[k];\\
% &\FORALL{$1 \leq i \leq n_V$}
% &\STATE $b_i \leftarrow \Vote[\PKT,Q,n_C,\beta_i,k]$;
% &\STATE ${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$;
% &\ENDFOR
% &b\neq b' \wedge b\neq \bot \wedge b'\neq \bot] > 1 - \mu(k).
%\end{split}
%\end{equation*}
%\end{definition}
%%%Terminology: Correctness vs. completeness
%
%\ben{I advocate Completeness $\rightarrow$ Correctness. We need to change terminology throughout if we agree.}
%\mrc{I disagree. ``Correctness'' intuitively means that Verify is correct---but what it means for Verify to be correct is exactly what IV, UV, EV are trying to pin down.
%The current property is not about correctness.
%OTOH, ``completeness'' is exactly the right word from logic to be using: a proof system
%is complete w.r.t.\ a model theory if the proof system has no false negatives,
%i.e., it never rejects a statement deemed true by the model theory.
%Here, Verify is the analogue of the proof system, and we want that it never rejects
%an output produced by Tally. So Verify is complete w.r.t.\ Tally.}
\end{definition}
\begin{comment}
\later{
\ben{Do we want to point out that our precondition (in essence: $n_C$ and $n_V$ are chosen outside of the message space) captures a point missed by (many cryptographers in) many other definitions of correctness in many other domains\footnotemark? I don't think we do. At least, not here. We could seek to write ``Another look at correctness" with Koblitz or Menezes.}\footnotetext{Hence, those definitions are unsatisfiable and thus, in some sense, useless.}\steven{Are you referring to the check that the actual $\beta$'s we are voting for are within the bounds of the message space? If so, I agree that we don't need to mention it here.} \ben{I don't think I am. I don't believe that encryption schemes (e.g., ElGamal) satisfy standard correctness definitions, because the message spaces aren't given sufficient attention.}
\mrc{I don't think that discussion is worth including.}
}
\end{comment}
\noindent
Correctness asserts that tallies produced by $\TallySymb$ correspond to the choices input to $\VoteSymb$.
Note that Correctness does not involve an adversary.
Correctness therefore stipulates that, under ideal conditions, an election scheme does indeed produce the correct tally.
Correctness is not actually necessary to achieve verifiability: our definition of universal verifiability will ensure that, in the presence of an adversary, $\VerifySymb$ detects any errors in the tally.
But it is reasonable to rule out election schemes that simply do not work properly under ideal conditions.
\paragraph*{Limitations}
Our model of election schemes is sufficient to analyze
Helios and, after we extend the model to handle internal authentication in Section~\ref{sec:def:internalscheme},\ifheliosc\ Helios-C and\fi\ JCJ.
These are notable schemes, and formally analyzing their verifiability is a valuable contribution.
But there are other notable schemes that fall outside our model:
\begin{itemize}
\item Pr\^et \`{a} Voter~\cite{ChaumRyanSchneider2005}, MarkPledge~\cite{Neff04:MarkPledge}, Scantegrity II~\cite{Chaum08II}, and Remotegrity~\cite{Zagorski13} all rely on features implemented with paper, such as scratch-off surfaces and detachable columns.
\item Everlasting privacy~\cite{Moran06}, which requires $\VoteSymb$ to output a public ballot and a secret proof, involving temporal information, to the voter.
\item Scytl's Pnyx.core ODBP 1.0~\cite{Scytl08}, which requires the bulletin board to be divided into two parts: a public part visible to all participants, and a secret part visible only to election administrators.
\end{itemize}
\noindent
Distributed tallying also falls outside our model.
We leave extension of our model to other election schemes and distributed
tallying as future work.
%\steven{I think computational injectivity allows schemes that have everlasting privacy. For example, the Moran-Naor scheme uses perfectly-hiding commitments of candidates to achieve everlasting privacy. The commitment is distributed uniformly over some group when the random coins are chosen uniformly. Therefore, ballots can collide, but for any two choices $\beta,\beta'$, the probability that
%you choose the $r,r'$ that cause the collision is negligible.}
%%% MRC: I'm preserving the following discussion in case we need to return to it one day.
%\mrc{I feel like we need a discussion here of why Injectivity must always hold, but Completeness can fail with negligible probability. I don't fully recall our discussions on this. But practically I can see why: Injectivity boils down to the encryption scheme being injective, which for practical schemes is always the case, whereas Completeness boils down to the ZKPFs, which in practical schemes can sometimes fail. Ben, do you have any thoughts?}
%\ben{Your intuition is right. However, our definition of an encryption scheme only requires correctness with overwhelming probability, rather than absolute correctness. You can observe issues that this causes from the proofs.}
%\mrc{I note that kind of definition for encryption schemes is also used by Katz and Lindell and by Goldreich.}
%\ben{We want absolute Injectivity for $\correcttally$. I have suggested that we add a hint to this above.}
%\ben{Getting back to your question: how can we justify the need for absolute Injectivity vs. overwhelming Completeness? Perhaps the answer is purely practical: we need/want Injectivity to define UV, we would like absolute Completeness, but schemes rarely achieve this, so we settle for a slightly weaker notion.}
%\later{Make Injectivity WOP rather than absolute.
%\review{Completeness permits a negligible probability of failure, as is common in cryptographic definitions (e.g., the usual correctness property of encryption schemes~\cite[p.~337]{Katz07}), whereas Injectivity does not.
%That raises the question of whether Injectivity could be weakened to permit a negligible probability of failure.
%Our definition of how to correctly tally an election in Section~\ref{sec:def:uv} is in fact not compatible with such a weakening.
%\mrc{Although that conclusion is what we agreed to on the phone, I'm not convinced by it now. If Injectivity did have a negligible failure probability, then the adversary could still win UV with only negligible advantage. So why do we need absolute Injectivity for $\correcttally$?}
%\ben{You're right. We do not require absolute Injectivity. We can weaken this. Let's leave the decision for a day or two.}
%We do not know whether the strong definition of Injectivity is actually necessary to achieve election verifiability.}
%}
%\ben{It remains to consider if there are repercussions to this change.}
%\later{MRC: I've often mused that the right way to handle Injectivity and $\correcttally$ is to have a $\VoteSymb^{-1}$. Then we could state $\correcttally$ in terms of running $\VoteSymb^{-1}$ on each ballot on $\bbb$. And Injectivity would be replaced by an analogue of the usual correctness property of encryption schemes.}
% !TEX root = main-jcj-ev.tex
\subsection{Election verifiability}
\ifint
\else
\label{sec:def:ivuv}
\fi
\ifint
Secure construction of electoral rolls is not a topic that electronic
voting systems usually address---though it seems an important part of
any real-world deployment. Indeed, voting systems typically assume
the registrar is honest. In our experiments, below,
we model an adversary who cannot corrupt the registration
process that issues credentials to voters.
Hence our definitions will not detect attacks against verifiabilities
that result solely from weaknesses in the registration process.%
\footnote{K\"usters and Truderung~\cite{Kusters09:CoercionResistance} explore some consequences of permitting adversarial influence during registration.}
\fi
\ifonce
Election verifiability comprises three aspects: individual, universal, and eligibility verifiability.
We express each as an \emph{experiment}, which is an algorithm that outputs 0 or 1.
The adversary \emph{wins} an experiment by causing it to output 1.
\else
Recall (from \S\ref{sec:def:ivuv}) that election verifiability is expressed with experiments, and that an adversary wins by causing an experiment to output 1.
\fi
\ifint
We \ifonce\else henceforth \fi
assume that the adversary is \emph{stateful}---that is,
information persists across invocations of the adversary in a single experiment.
\fi
\ifonce\else
Our experiments in Section~\ref{sec:ev} did not need this assumption, because they never invoked the adversary more than once.
\fi
\subsubsection{Individual verifiability}
\ifint
\label{sec:def:ivv}
\else
\label{sec:def:iv}
\fi
\ifonce
In our model of election schemes, all recorded ballots are posted on the bulletin board.
So for a voter to verify that their ballot has been recorded, it suffices to enable them to uniquely identify their ballot on the bulletin board.%
\footnote{Section~\ref{sec:conclusion} addresses the complementary issue of whether a recorded ballot corresponds to the candidate choice a voter intended to make.}
\else
The individual verifiability experiment again challenges adversary $\adv$ to generate a scenario in which the voter could not uniquely identify their ballot:%
\ifint
\footnote{Unlike $\ExpIVSymb$,
%experiment $\ExpIVVSymb$ cannot equivalently be formulated as an experiment that challenges $\adv$ to predict the output of $\VoteSymb$.
a variant of $\ExpIVVSymb$ that challenges $\adv$ to predict the output of $\VoteSymb$ is strictly stronger.
See \refappendix{\ref{sec:ivaltII}} for details.}
\fi
\fi
\ifonce
Individual verifiability experiment \ifint$\ExpIVV$\else$\ExpIV$\fi, where $\Pi$ denotes an election scheme, $\adv$ denotes the adversary, and $k$ denotes a security parameter, therefore challenges $\adv$ to generate a scenario in which the voter cannot uniquely identify their ballot.
In essence, \ifint$\ExpIVVSymb$\else$\ExpIVSymb$\fi\ challenges $\adv$ to generate a collision from $\VoteSymb$.%
\ifint\else
\footnote{$\ExpIVSymb$ can be equivalently formulated as an experiment that challenges $\adv$ to predict the output of $\VoteSymb$. See \refappendix{\ref{sec:ivalt}} for details.}
\fi\
If $\adv$ cannot win, then voters can uniquely identify their ballots on the bulletin board:
\fi
\begin{inlineexperiment}{\ifint$\ExpIVV$\else$\ExpIV$\fi}
$(\PKT,\ifint n_V\else n_C,\beta,\beta'\fi) \leftarrow \adv(k)$\; \ifint\else\label{alg:iv:candidates}\fi
\ifint
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\; \ifint\label{alg:ivv:register}\else\fi
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\;
$\mathit{Crpt}\leftarrow\emptyset;$\\
$(n_C,\beta,\beta',i,j) \leftarrow \adv^{\corruptOracle}(\electoralroll)$\; \ifint\label{alg:ivv:candidates}\else\fi
\fi
$b\leftarrow\Vote[\ifint \sk_i,\fi\PKT,n_C,\beta,k]$\; \ifint\label{alg:ivv:ballot}\else\label{alg:iv:ballot}\fi
$b'\leftarrow\Vote[\ifint \sk_j,\fi\PKT,n_C,\beta',k]$\; \ifint\label{alg:ivv:ballot2}\else\label{alg:iv:ballot2}\fi
\eIf{
$b = b'
\wedge b \not= {\perp}
\wedge b' \not= {\perp}
\ifint
\wedge i \not= j
\wedge \sk_i \not\in \mathit{Crpt}
\wedge \sk_j\not\in \mathit{Crpt}
\fi
$\ifint\label{alg:ivv:conditional}\fi}{
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
%\steven{May not need the $\wedge n_C\leq|\mathfrak m|$ here, since it will presumably map to $\bot$ otherwise.}
%\steven{Does $\adv$ need to output $m_C$ as well? There's no administrator to perform the proper checks here.}
%\ben{Vote can perform any necessary checks and outputs $\perp$ on error}
\ifonce
\begin{comment}
\later{{\bf Ben}'s wild speculation: ballot secrecy implies IV.
{\bf Michael}'s thoughts: Yeah, that seems right. Use the alternative
definition of IV from the Appendix. Suppose you have an adversary against
it. Use that adversary to get a candidate $\beta$ for which there's
a non-negligible chance that the output of $\VoteSymb$ is $b$.
Now give that $\beta$ along with some $\beta'$ to the
ballot secrecy experiment, which I'm assuming looks like
a CPA kind of game. It gives you back a challenge. If
that challenge is not $b$, guess with advantage 1/2. If it
is $b$, output $\beta$. Since the output must be $b$ with non-negligible
probability, the overall advantage is 1/2 + non-neg.
{\bf Ben}: I'll revisit this at some stage, perhaps later in the year.
{\bf Steven}: I took a look at a definition of ballot secrecy from one of Ben's papers
from 2 years ago and tried to prove this, but since in our experiment the
adversary picks the keys and in the ballot secrecy (and in the usual CPA experiment, I think)
the public key is provided to the adversary, I couldn't get the reduction to go through.
I didn't spend too much time on it though, so there may be another way to prove this.
{\bf Ben}: Steven is right, in particular, an adversary against IV might rely on a
maliciously generated key to cause a collision, but that adversary cannot cause a collision
in the ballot secrecy game, because keys are honestly generated.
}
\end{comment}
\fi
\noindent
\ifonce
\ifint
The adversary is given access to an oracle $\corruptOracle$ in line~5.
\fi
\else
The main differences from the corresponding experiment for external authentication (\S\ref{sec:def:iv}) are that voters are registered in line~2, and that $\adv$ is given access to an oracle $\corruptOracle$ in line~5.
\fi
\ifint
The oracle is used to model $\adv$ corrupting voters and learning their private credentials:
on invocation $\corruptOracle(\ell)$, where $1\leq \ell \leq n_V$, the oracle records that voter $\ell$ is corrupted by updating $\mathit{Crpt}$ to be $\mathit{Crpt} \cup \{\sk_\ell\}$ and outputs $\sk_\ell$.
In line~5, the voter indices output by $\adv$ must be legal with respect to $n_V$, but we elide that detail from the experiment for simplicity.
Line~8 ensures that $\adv$ cannot trivially win by corrupting voters.
%% MRC: preserving the following discussion so that we can add the lines to the experiment more easily one day, if it becomes important to do so.
%\mrc{This reads a bit oddly, as though we're trying to hide something. It's only one more line in the experiment, right? Maybe we should add it.}
%\ben{We want lines 6 \& 7 to be well-defined. We can achieve this by adding}
%
%\If{$i\not\in\{1,\dots,n_C\} \vee j\not\in\{1,\dots,n_C\}$}{
% \Return 0
%}
%
%\noindent
%\ben{between lines 5 and 6. But this seems like an ugly detail which detracts the reader's attention from more important aspects of the experiment. Cryptographers tend to brush such details aside in a similar fashion, e.g., messages are usually assumed to be in the message space, but this detail appears in the text, rather than the experiment.}
%\review{\sout{As in Section~\ref{sec:def:iv}, if $\adv$ does win $\ExpIVSymb$, then Injectivity implies $\beta=\beta'$.}}
%, hence $\adv$ has managed to generate a collision on a particular candidate.
%\steven{In $\ExpIVSymb$, the random coins in $\VoteSymb$ need to be enough to avoid collisions. Why is that not the case
%here, i.e., why can't the adversary know the secret keys for the voters he is making a collision for? It's certainly a reasonable
%assumption, but is it necessary?}
%\ben{I think the definition can be strengthened and simplified in this way:}
%\begin{inlineexperiment}{$\ExpIVV$}
% $(\PKT,Q, n_V) \leftarrow \adv(k)$\;
% \lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$}\\ %\tcp{register voters}
% $\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}$\; %\tcp{set of voters' private keys}
% $(n_C,\beta,\beta',i,j) \leftarrow \adv(M)$\; %\tcp{$\adv$ selects a key, number of candidates, vote, voter, and ballot}
% $b\leftarrow\Vote[\sk_i,\PKT,Q,n_C,\beta,k]$\;
% $b'\leftarrow\Vote[\sk_j,\PKT,Q,n_C,\beta',k]$\; %\tcp{generate a ballot for $\adv$'s vote}
% \eIf{%$\exists n_C\mathrel :
% $b = b'
% \wedge b\neq{\perp}
% \wedge i \not= j $}{
% \Return 1 %\tcp{$\adv$ wins}
% }{
% \Return 0 %\tcp{$\adv$ loses}
% }
%\end{inlineexperiment}
%\noindent\review{
%$\ExpIVV=$
%\begin{algorithmic}[1]
% \STATE $(\PKT,Q, n_V) \leftarrow \adv(k)$\;
% \FORALL{$1 \leq i \leq n_V$}
% \STATE $(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$\\ %\tcp{register voters}
% \ENDFOR
% \STATE $\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V}\}$\; %\tcp{set of voters' public keys}
% \STATE $(n_C,\beta,\beta',i,j) \leftarrow \adv(\electoralrollprivate)$\; %\tcp{$\adv$ selects a key, number of candidates, vote, voter, and ballot}
% \STATE $b\leftarrow\Vote[\sk_i,\PKT,Q,n_C,\beta,k]$\;
% \STATE $b'\leftarrow\Vote[\sk_j,\PKT,Q,n_C,\beta',k]$\; %\tcp{generate a ballot for $\adv$'s vote}
% \IF{%$\exists n_C\mathrel :
% $b = b'
% \wedge b\neq{\perp}
% \wedge i \not= j
% \wedge \sk_i \not\in \mathit{Crpt}
% \wedge \sk_j\not\in \mathit{Crpt}$}
% \STATE \Return 1 %\tcp{$\adv$ wins}
% \ELSE
% \STATE \Return 0 %\tcp{$\adv$ loses}
% \ENDIF
%\end{algorithmic}
%}
%\steven{After giving this some more thought, I'm not sure we should give the adversary the secret keys. The reason is that signature schemes can have randomized key generation algorithms, but deterministic signing algorithms. Thus it's unclear that IV still holds for our toy scheme from digital signatures. The variant in which the adversary has to predict the output of Vote is easily breakable for such signature schemes as well.}
%\steven{For now we'll stick with the original IV definition. We may need to look into the MU-EU-CMA definition for signatures.}
\fi
\ifonce
Line~1 asks $\adv$ to compute two candidate choices $\beta$ and $\beta'$, such that ballots $b$ and $b'$ for those choices, as computed by $\VoteSymb$ in lines~2 and~3, are equal.
One way to achieve individual verifiability is to base the election scheme on a probabilistic encryption scheme, such as El Gamal~\cite{ElGamal85}.
Intuitively, if $\VoteSymb$ encrypts the choice using coins chosen uniformly at random, then it is overwhelmingly unlikely that two votes will result in the same ballot. %; formal details are given in \refappendix{\ref{sec:randomizedBallots}}.
Our proofs that Helios\ifheliosc, Helios-C\fi\ and JCJ satisfy individual verifiability are based on this idea.
\fi
\ifonce
\paragraph*{Clash attacks}
In a \emph{clash attack} \cite{Kusters12:ClashAttacks}, the adversary
convinces some voters that a single ballot belongs to all of them.
Some clash attacks are possible because of vulnerabilities in the design of $\VoteSymb$.
For example, if $\VoteSymb$ simply outputs candidate choice $\beta$, then a voter has no way to distinguish their vote for $\beta$ from another voter's vote for $\beta$.
\ifint$\ExpIVVSymb$\else$\ExpIVSymb$\fi\ detects clash attacks resulting from vulnerabilities in $\VoteSymb$.
Some clash attacks, however, are possible because the adversary subverts
the implementation of $\VoteSymb$.
For example, the adversary might replace some hardware or software, or compromise the random number generator.
If any one of these aspects is compromised, then $\VoteSymb$ has effectively been changed to a different algorithm $\VoteSymb'$.
The conclusions drawn by a security analyst who uses our definition of individual verifiability to analyze $\VoteSymb$ would not necessarily be applicable
to $\VoteSymb'$.
In short, a voter can verify that their ballot has been recorded if and only if they run the correct $\VoteSymb$ algorithm.
We make no guarantees to voters that do not run the correct $\VoteSymb$ algorithm.
One way to make stronger guarantees is to use cut-and-choose
protocols to audit ballots~\cite{Benaloh06:BallotAudit,Benaloh07:BallotAudit}.
This would require modeling voting as an interactive protocol with the adversary, rather than as an algorithm.
We leave this extension as future work.
%Notes on clash attacks:
%
%\ben{Do existing definitions defend against clash attacks? If so, then we can mention this, otherwise, I think we can drop the sentence and define clash attacks in \S\ref{sec:def:iv}.}
%\ben{ (UPDATE) I have revisited JCJ's definition. Given that $BB$ is modelled as a set (in our paper---it is unclear what JCJ intended), I believe clash attacks are detected, in particular, if two ballots collide, then only one ballot will appear in $BB$ and this can be detected, since an honest vote will be missing from $X'$. (On the other hand, I think we can interpret JCJ in a way such that clash attacks are not detected---I'm not in favour of this.)}
\fi
\subsubsection{Universal verifiability}
\ifint
\label{sec:def:uvv}
\else
\label{sec:def:uv}
\fi
\ifonce
For an election to be universally verifiable, anyone must be able to check that a tally is correct with respect to recorded ballots---that is, the tally represents the choices used to construct the recorded ballots.
Because anyone can execute $\VerifySymb$, it suffices that $\VerifySymb$ accepts if and only if that property holds.
\fi
\ifonce
Universal verifiability experiment \ifint$\ExpUVV$\else$\ExpUV$\fi\ therefore challenges adversary $\adv$
\else
The universal verifiability experiment again challenges $\adv$
\fi
to concoct a scenario in which $\VerifySymb$ incorrectly accepts\ifonce, thereby capturing the \emph{only if} requirement\fi:
\ifonce\iftr\relax\else\ifanon\newpage\fi\fi\fi
\begin{inlineexperiment}{\ifint$\ExpUVV$\else$\ExpUV$\fi}
$(\PKT,\ifint n_V\else\bbb,n_C,{\bf X}, P\fi) \leftarrow \adv(k)$\;
\ifint
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\;
$\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}$\;
$(\bbb,n_C,{\bf X}, P) \leftarrow \adv(\electoralrollprivate)$\;
\fi
${\bf Y}\leftarrow \correcttally(\PKT,\bbb,\ifint\electoralrollprivate, \fi n_C,k)$\;
\eIf{${\bf X} \not= {\bf Y} \mathrel\wedge \Verify[\PKT,\bbb,\ifint\electoralroll, \fi n_C,{\bf X},P,k] = 1 $}{
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\noindent
\ifonce
In line~\ifint5\else1\fi, $\adv$ is challenged to create a bulletin board $\bbb$ and purported tally ${\bf X}$ of that bulletin board.
Line~\ifint6\else2\fi\ constructs the correct tally ${\bf Y}$ of $\bbb$
(using function $\correcttally$, which we define below), and line~\ifint7\else3\fi\ checks whether $\VerifySymb$ accepts an incorrect tally.
If $\adv$ cannot win \ifint$\ExpUVVSymb$\else$\ExpUVSymb$\fi, then $\VerifySymb$ will not accept incorrect tallies.
In particular, no ballots can be omitted from the tally, and at most one candidate choice can be included in the tally for each ballot.
\else
The main differences from the corresponding experiment for external authentication (\S\ref{sec:def:uv}) are that voters are registered in line 2, and their credential pairs are used in the rest of the experiment.
The tally of recorded ballots should contain at most one vote per voter. Hence,
election schemes must handle \emph{revotes}---i.e., multiple ballots submitted
by the same voter. Election schemes with external authentication implicitly
handle revoting, by assuming a third party ensures that the recorded
ballots contain at most one ballot per voter. Election schemes
with internal authentication must explicitly handle revoting by tallying
only authorized ballots.
A ballot is \emph{authorized} if it is constructed with a private credential from $\electoralrollprivate$, and that private credential was not used to construct any other ballot on $\bbb$.%
%
\footnote{Helios-C is claimed to support an alternative definition of authorized, whereby only
the last ballot cast by a voter is authorized. We found that Helios-C does not
support this definition. In particular, an adversary can observe the
ballots cast by a voter and replay one of those ballots. The replayed ballot will overwrite the
last ballot cast by the voter and will be authorized instead of it.}\textsuperscript{,}%
\footnote{JCJ is claimed to support alternative definitions of authorized---e.g., only
the last ballot cast by a voter is authorized---using a policy~\cite[\S4.1]{JCJ10}.
We found that the policy proposed by Juels et al. (namely, ``order of postings to [the bulletin board]")
does not support this definition of authorized. In particular, an adversary can intercept a voter's ballot and replay that ballot after observing the voter's
revote, thus the policy incorrectly defines the first ballot as authorized. This could be
prevented by proving knowledge of previously constructed ballots (cf. Clarkson et al.~\cite{CCM08}).}
\fi
\ifint
\ifonce
Let function $\correcttally$
\else
Function $\correcttally$ is now modified to tally only authorized ballots:
let function $\correcttally$ now
\fi
be defined such that
for all $\PKT$, $\bbb$, $\electoralrollprivate$, $n_C$, $k$, $\ell$, and $\beta \in \{1,\ldots,n_C\}$,
\begin{align*}
&\hspace{0ex}\correcttally(\PKT,\bbb,\electoralrollprivate,n_C,k)[\beta] = \ell \\
&\iff \exists^{=\ell} b\in\authorized(\PKT,(\bbb \setminus \{\bot\}),\electoralrollprivate, n_C,k) : \\
& ~\qquad\qquad \exists \sk, r : b=\Vote[\sk,\PKT,n_C,\beta,k; r].
\end{align*}
By comparison, the original $\correcttally$ function (\S\ref{sec:def:uv}) tallies all the ballots on $\bbb$.
\else
Let function $\correcttally$ be defined such that for all
$\PKT$, $\bbb$, $n_C$, $k$, $\ell$, and $\beta \in \{1,\ldots,n_C\}$,
\begin{align*}
&\correcttally(\PKT,\bbb,n_C,k)[\beta] = \ell \\
&\iff \exists^{=\ell} b\in (\bbb \setminus \{\bot\}) : \\
&\qquad\qquad\exists r : b=\Vote[\PKT,n_C,\beta,k; r].
%[\beta \mid \Vote[\PKT,n_C,\beta,k; r] \in \bbb$\\
% $\quad\mathrel\wedge 1\leq\beta\leq n_C]$\; %\tcp{votes corresponding to ballots on $\bbb$}
\end{align*}
%\steven{How does $m_C$ come into play here?}
%\ben{It doesn't come into play.}
\fi
\ifonce
\noindent
The vector produced by $\correcttally$ must be of length $n_C$.
Component $\beta$ of vector
%
$\correcttally(\PKT,\allowbreak\bbb,\allowbreak\ifint\electoralrollprivate,\allowbreak\fi n_C,\allowbreak k)$
%
equals $\ell$ iff there exist%
\footnote{The definition of $\correcttally$ employs a
\emph{counting quantifier}~\cite{Schweikardt05} denoted $\exists^{=}$.
Predicate $(\exists^{=\ell} x : P(x))$ holds exactly when there are
$\ell$ distinct values for $x$ such that $P(x)$ is satisfied.
Variable $x$ is bound by the quantifier, whereas $\ell$ is free.}
$\ell$ ballots on the bulletin board that are votes for candidate $\beta$.
It follows that the output of $\correcttally$ represents the choices used to construct the recorded ballots.
%Note that, without Injectivity, the existential quantification in $\correcttally$ could permit a ballot to be tallied for more than one candidate.
Of course, $\correcttally$ cannot be computed by a PPT algorithm for typical cryptographic election schemes.
But that does not matter, because $\correcttally$ is never actually computed as part of an election scheme---its use is solely in the definition of
\ifint$\ExpUVVSymb$\else$\ExpUVSymb$\fi.\footnote{%
Kiayias et al.~\cite{Kiayias15} use a similar super-polynomial \emph{vote extractor} to recover choices from ballots in an experiment defining verifiability.}
\fi
\ifonce
\fi
Function $\correcttally$ requires that ballots can only be interpreted
for one candidate, which can\ifonce\else\ again\fi\ be ensured by \ifonce\emph{Injectivity}\else{}Injectivity\fi\ifonce\else, which we update to include private credentials\fi:
\begin{definition}[Injectivity]\ifint\label{def:injectivity}\fi
An election scheme $(\SetupSymb\ifint,\allowbreak \RegisterSymb\fi,\allowbreak \VoteSymb, \allowbreak \TallySymb,\allowbreak \VerifySymb)$
satisfies \emph{Injectivity}, if for all security parameters $k$, public keys $\PKT$,
integers $n_C$, and
choices $\beta$ and $\beta'$, such that $\beta\not=\beta'$, we have
\begin{equation*}
\begin{split}
\Pr [%&(\PKT,\SKT,Q) \leftarrow \Setup[k];\\
&\ifint(\pk,\sk)\leftarrow\Register[\PKT,k];\\
&(\pk',\sk')\leftarrow\Register[\PKT,k];\\
&\fi b\leftarrow \Vote[\ifint\sk,\fi\PKT,n_C,\beta,k];\\
&b'\leftarrow \Vote[\ifint\sk',\fi\PKT,n_C,\beta',k]:\\
&b\neq \bot \wedge b'\neq \bot \Rightarrow b\neq b'] = 1. %> 1 - \mu(k).
\end{split}
\end{equation*}
\end{definition}
%%%DISCUSSION: IV doesn't imply IV
%
%
%\ben{There's a relation between Injectivity and IV. I suspect that IV implies Injectivity, if we accept Injectivity WOP.}\steven{I'm not entirely sure. In Injectivity, $n_C$, $\beta$, and $\beta'$ are all universally quantified, while in the IV game $n_C$ is chosen by the adversary and therefore $n_C$ and the $\beta$'s must be bounded. For example, suppose that for some $\VoteSymb$ function, there exists some exponentially large $n_C$ such that there is a collision between a particular $\beta$, $\beta'$ pair for every choice of randomness. Then no PPT adversary should be able to win the IV game. However, I don't think such a scheme would satisfy Injectivity.}\ben{Steven is right.}
\ifonce
\noindent
Injectivity ensures that distinct choices are not map\-ped by $\VoteSymb$ to the same ballot.\footnote{Individual verifiability resembles Injectivity,
but individual verifiability allows choices to be equal and allows adversary $\adv$ to choose election parameters.}
Without Injectivity, an election scheme might produce ballots whose meaning is ambiguous.
For example, if $\Vote[\ifint\sk,\fi\PKT, \allowbreak n_C, \beta, k; r]$ were defined to be $\beta+r$, then a ballot $b$ could be tallied as any well-formed choice $\beta'$ such that $\beta' = b-r'$ for some $r'$.
But that definition of $\VoteSymb$ is prohibited by Injectivity.
Thus, Injectivity helps to ensure that the choices used to construct ballots can be uniquely tallied.
\fi
\ifint
\ifonce
A ballot is \emph{authorized} if it is constructed with a private credential from $\electoralrollprivate$, and that private credential was not used to construct any other ballot on $\bbb$.
\fi
Let $\authorized$ be defined as follows:
%
\begin{align*}
&\hspace{0ex}\authorized(\PKT,\bbb,\electoralrollprivate,n_C,k) =\\
& \{ b \mathrel{:}\; b \in \bbb \\
& ~\mathrel\wedge \exists \pk,\sk, \beta, r \mathrel : b=\Vote[\sk,\PKT,n_C,\beta,k; r] \\
& \qquad~\mathrel\wedge (\pk,\sk)\in\electoralrollprivate\wedge \neg \exists b',\beta',r' : b' \in (\bbb \setminus \{b\}) \\
& ~\qquad\qquad \mathrel\wedge b'=\Vote[\sk,\PKT,n_C,\beta',k; r']\}.
\end{align*}
%
\noindent
Function $\authorized$ discards ballots submitted under the same credential---that is, if there is more than one ballot submitted with a private credential $\sk$, then all ballots submitted under that credential are discarded.
Therefore, election schemes that permit revoting cannot by analyzed with this definition of $\authorized$. But
alternative definitions of $\authorized$ are possible---for example, if ballots were timestamped, $\authorized$ could discard all but the most recent ballot submitted under a particular credential. Smyth presents such a formalization~\cite[Appendix~C]{2019-Athena-voting-system}.
%We leave such definitions as future work.
\fi
%%% MRC: I'm preserving this discussion in case I ever forget why we have to rule out \bot.
%\ben{The definition of $\correcttally$ still looks wrong. Ballot $\perp$ seems to be counted. I think we ensure that $\beta\in\{1,\dots,n_C\}$, because \emph{``the vector produced by $\correcttally$ must be of length $n_C$"}, but I'm concerned that this point is hidden. \sout{I wonder if adding the condition $1 \leq \beta \leq n_C$ on both sides helps; probably not, because then $\correcttally$ can produce a longer vector containing items which are ignored}}
%\mrc{I don't see how $\beta$ could be counted. It's not an integer, so it's not a legal component of the vector.} \ben{Do you mean ``I don't see how \emph{[$\perp$]} could be counted"? Suppose $\PKT$ and $Q$ are such that for all $n_C$, $\beta$, $k$ and $r$ we have
%${\perp} = \Vote[\PKT,Q,n_C,\beta,k; r]$. (This could occur when $Q$ is an invalid proof, for example.)
%We have for all $1 \leq \beta \leq n_C$ that $\exists^{=1} b\in\{\perp\} : \exists r : b=\Vote[\PKT,Q,n_C,\beta,k; r]$, hence, $\correcttally(\PKT,Q,\{\perp\},n_C,k)[\beta] = 1$. It follows that the vector produced by $\correcttally$ contains $n_C$ votes, but the bulletin board contains one ballot.
%}
\ifonce
%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% Start commentary
%%%%%%%%%%%%%%%%%%%%%%%%%
\iffalse
%%%%The following commentary might be useful.
\ben{this isn't immediately obvious from the definition, in particular, suppose $b =\Vote[\PKT,Q,n_C,\beta,k;r] = \Vote[\PKT,Q,n_C,\beta',k;r']$ such that $\beta\not=\beta'$, hence, $\{b\}$ can be tallied as two votes!
%However, this situation cannot arise if the IV experiment is satisfied.
Any thoughts on how to address this?
%Perhaps adding ``\emph{in the absence of clash attacks}" is sufficient.
Worryingly, this casts doubt over my claim (below) that verifying function $\correcttally$ is trivial.}
\mrc{I have two ideas: (i) Add a kind of soundness condition on Vote (as we have for Completeness) that says there's only one candidate a ballot could possibly represent. That's entirely reasonable, and it rules out the issue you've identified. (ii) Introduce a Vote$^{-1}$ that permits ``decrypting'' of ballots into choices, and use it to iterate over all the ballots on $\bbb$ to construct the correct tally. That's also reasonable, and arguably the easiest way to convince oneself that $\correcttally$ is indeed correct.}
\ben{If we assume Vote is injective, then we get (i) and, moreover, there exists an inverse function Vote$^{-1}$, hence, we get (ii) for free (i.e., no need to ``\emph{Introduce a Vote$^{-1}$ that [...]}").
%I favour (ii) over (i), because (i) seems to hide an important detail which could be overlooked, whereas (ii) makes it clear exactly what is happening.
}
%\mrc{I don't appreciate the reason why (i) hides an important detail. Which detail would that be?}
%\ben{The detail that ``\emph{there's only one candidate a ballot could possibly represent}" appears as a soundness condition, rather than a condition of the UV experiment. IMO, this buries an important detail. This could be overcome in the text, however, I favour a solution which makes the details more obvious and I believe (ii) manages this. Having said that, I have now looked into how (ii) would be formalised and it looks somewhat ugly, so I'm now in favour of (i) and discussing the issue in the text.}
%\ben{As a further alternative, we could redefine $\correcttally$, see above. Which is the most intuitive solution? Which is easier to work with---that is, is it easier to work with $\correcttally$ or prove that Vote is injective?}
%\mrc{I favour a separation of concerns.
%Let's impose a new constraint on $\VoteSymb$, either (i) or (ii) above, to ensure that there's a unique way to interpret votes. Let's not let this issue get mixed up with how to define $\correcttally$. Indeed, to make the argument that Ben set out to make here, we need $\correcttally$ to be as simple as possible. See also my changes to $\correcttally$ in section 4.}
\ben{%As noted above,
I'm in favor of (i). In terms of implantation, can we simply say that $\VoteSymb$ is injective in
$\EVEA$, as I suggested above? I've added an alternative solution to the Completeness definition.}
\mrc{A further thought: when Ben visited GW, we came up with an Add scheme that added the credential to the choice. We never did add a requirement to prevent such (unreasonable) schemes, though we talked about doing so. Idea (i) above would prevent it. Idea (ii) presumably would, too, because Vote$^{-1}$ isn't implementable for Add.}
\ben{I don't recall exactly what the Add scheme was. Does it satisfy our definitions as they currently stand?}
\mrc{iirc, the Vote function in Add simply added together $\sk_i$ and $\beta$ and output that as $b$. So $b = \sk_i + \beta$. Add is not IV, but it is UV. Moreover, there are (infinitely) many tallies that are UV with Add. But insisting on (i) or (ii) above would fix this.}
\ben{I remember. It certainly makes sense to rule out this scheme! I have a variant of Add which doesn't need a secret key, see \S\ref{sec:bias} (NB: the variant would satisfy our IV experiment). I don't think other definitions will accept Add, in particular, the JCJ definition specifies the set of honest votes.}
\fi
%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% End commentary
%%%%%%%%%%%%%%%%%%%%%%%%%
Security analysts must convince themselves that $\correcttally$ is indeed correct.
Because of the function's simplicity, this should be relatively straightforward.
By comparison, $\TallySymb$ algorithms for real voting schemes tend to be complicated.
For example, compare the complexity of $\correcttally$ to %JCJ's
Helios's $\TallySymb$
algorithm, which appears in
\iftr
%Figure~\ref{elec:gjcj} of \refappendix{\ref{sec:jcj-construction}}.
Definition~\ref{def:elec:helios} of \refappendix{\ref{sec:helios-construction}}.
\else
\refappendix{}.
\fi
\ifint\else
By design, $\ExpUVSymb$ assumes the ballots on bulletin board $\bbb$ are exactly the ballots that should be tallied.
The external authentication mechanism is assumed to prohibit unauthorized ballots from being posted on $\bbb$. Helios makes such an assumption about its external authentication mechanism.
%\footnote{An alternative formulation of \ifint$\ExpUVVSymb$\else$\ExpUVSymb$\fi\
%could assume that the ballots on $\bbb$ include authorized and unauthorized ballots, and the external authentication mechanism could filter out any unauthorized ballots.}
\fi
%%%BEN: This footnote possibly contains too much detail. If you want to cut, then please comment out, rather than delete (so that I have the text for reference).
%%%MRC: Yes, I was just about to strike it out when I discovered your comment. I will instead comment out the footnote.
%\footnotetext{Revoting allows voters to cast arbitrarily many ballots,
%%MRC: I have, at least in discussions, hears of schemes that don't allow arbitrarily many revotes, but instead some finite number.
%with the last ballot being the one that is tallied. Motivation for revoting includes: allowing voters to ``vote, verify [that their ballot has been recorded], and revote until verification succeeds"~\cite[\S1]{AdidaN06} and to ``ask the help of anyone for submitting a random ballot, and
%then re-voting privately afterwards"~\cite[\S3.3]{AdidaPereiraMarneffeQuisquater}.
%}
\fi
Election schemes must
\ifonce
also satisfy Completeness, which stipulates that tallies produced
by $\TallySymb$ will actually be accepted by $\VerifySymb$, capturing the \emph{if} requirement:
\else
continue to satisfy Completeness, which we update to include credentials and the electoral roll:
\fi
\begin{definition}[Completeness]
An election scheme $(\SetupSymb\ifint,\allowbreak \RegisterSymb\fi,\allowbreak \VoteSymb, \allowbreak \TallySymb,\allowbreak \VerifySymb)$
satisfies \emph{Completeness}, if for all PPT adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$,
it holds that
\begin{equation*}
\begin{split}
\Pr [&(\PKT,\SKT,\mB, \mC) \leftarrow \Setup[k]; \\
\ifint
&n_V \leftarrow \adv(\PKT,k); \\
%%% Ugly \hskip hack
&\textrm{\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}}; \\
&\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}; \\
&\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}; \\
\fi
&(\bbb,n_C)\leftarrow\adv(\ifint M\else \PKT,k\fi);\\
&({\bf X},P) \leftarrow \Tally[\SKT, \bbb,\ifint\electoralroll,\fi n_C,k]:\\
&|\bbb| \leq \mB \wedge n_C\leq \mC \Rightarrow\\
&\quad\Verify[\PKT,\bbb,\ifint\electoralroll,\fi n_C,{\bf X},P,k] = 1] > 1 - \mu(k).
\end{split}
\end{equation*}
\end{definition}
\ifonce
\noindent
Without Completeness, election schemes might
be vulnerable to biasing attacks, as we show in Section~\ref{sec:rejection}.
\fi
%\subsubsection{\ifonce Eligibility verifiability \else Strong eligibility verifiability\fi}
\subsubsection{Eligibility verifiability}
\ifint
\label{sec:def:evv}
\else
\label{sec:def:ev}
\fi
\ifonce
For an election to satisfy eligibility verifiability, anyone must be able to check that every tallied vote was cast by an authorized voter---hence, it must be possible to authenticate ballots.
\else
Recall (from~\S\ref{sec:def:ev}) that for an election scheme to satisfy eligibility verifiability, anyone must be able to check that every tallied vote was cast by an authorized voter---hence, it must be possible to authenticate ballots.
\fi
\ifint
Because voters are issued credential pairs that can be used to authenticate ballots,
it suffices to ensure that knowledge of a private credential is necessary to construct an authentic ballot.
\else
In election schemes with external authentication, a trusted third party authenticates ballots.
That third party might convince itself that all tallied ballots have been authenticated, but it cannot convince all other parties.
Eligibility verifiability, therefore, is not achievable in election schemes with external authentication.
%We can formalize an experiment $\ExpEVSymb$ capturing that fact (see Appendix~\ref{sec:ev-extern}).
%But the only way a voting scheme can fail to satisfy the experiment is if the third party fails to correctly implement authentication.
%So analyzing voting schemes with the experiment is uninteresting.
%When we turn to election verifiability with internal authentication (Section~\ref{sec:ev2}), eligibility verifiability will become interesting.
%Until then, we elide further details about eligibility verifiability.
%\review{\sout{Under this trust assumption, eligibility verifiability is trivially satisfied,
%since trusted third parties do not authenticate ballots from unauthorized voters.}}
%So analyzing eligibility verifiability with external authentication is uninteresting.
%\review{So until} we turn to election verifiability with internal authentication (\S\ref{sec:ev2}), we elide further details about eligibility verifiability.
\fi
\ifint
Eligibility verifiability experiment $\ExpEVVSymb$ therefore challenges $\adv$ to produce a ballot under a private credential that $\adv$ does not know:
\weakeligfalse
% !TEX root = main-jcj-ev.tex
\begin{inlineexperiment}{\ifweakelig$\ExpEVVWeak$\else$\ExpEVV$\fi}
\ifweakelig
$(\PKT,\SKT,\mB,\mC) \leftarrow \Setup[k]$\;
$n_V \leftarrow \adv(\PKT,k)$\;
\else
$(\PKT,n_V) \leftarrow \adv(k)$\;
\fi
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge \sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\begin{comment}
\begin{inlineexperiment}{$\ExpEVV$}
$(\PKT,n_V) \leftarrow \adv(k)$\;
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\end{comment}
\noindent
\ifonceA
\ifweakelig
In line 1 of $\ExpEVVWeakSymb$, keys are generated by the experiment. In line 2, $\adv$ is given the public key but not the private key.
\else
In line 1, $\adv$ chooses the tallier's public key and the number of voters.
\fi
Line \ifweakelig3\else2\fi\ registers voters. %\footnote{\review{$\ExpEVVSymb$ can be equivalently formulated as an experiment with one registered voter. See \refappendix{\ref{sec:evalt}} for details.}}
$\adv$ is not permitted to influence registration while it is in progress.
%\footnote{K\"usters and Truderung~\cite{Kusters09:CoercionResistance} explore some consequences of permitting adversarial influence during registration.} %%%MOVE EARLIER
In particular, $\adv$ is not permitted to choose credential pairs, because by doing so $\adv$ could trivially win the experiment.
Line \ifweakelig5\else4\fi\ initializes two sets: $\mathit{Crpt}$ is a set of voters who have been corrupted, meaning that $\adv$ has learned their private credential, and $\mathit{Rvld}$ is a set of ballots that have been revealed to $\adv$.
The former set models $\adv$ coercing voters to reveal their private credentials.
The latter set models $\adv$ observing ballots on the bulletin board.
Line \ifweakelig6\else5\fi\ challenges $\adv$ to produce a ballot $b$ with the help of two oracles.
Oracle $\corruptOracle$ is the same oracle as in $\ExpIVVSymb$ (cf.~\S\ref{sec:def:ivv});
it leaks the private credentials of corrupted voters to $\adv$.
Oracle $\revealOracle$ reveals ballots.
On invocation $\revealOracle(i,\beta, \allowbreak n_C)$, where $1\leq i \leq n_V$,
oracle $\revealOracle$ does the following:
\begin{itemize}
\setlength{\itemsep}{0pt}
\item Computes a ballot $b$ that represents a vote for candidate $\beta$ by a voter with private credential $\sk_i$, that is, computes $b \leftarrow \Vote[\sk_i,\PKT,n_C,\beta,k]$.
\item Records $b$ as being revealed by updating $\mathit{Rvld}$ to be $\mathit{Rvld} \cup \{b\}$.
\item Outputs $b$.
\end{itemize}
In line \ifweakelig7\else6\fi, $\adv$ wins if (i) the ballot is \emph{authentic}, meaning that it is the output of $\VoteSymb$ on an authorized credential, and (ii) that credential belongs to a voter that $\adv$ did not corrupt, %
%\footnote{$\ExpEVVSymb$ can equivalently be formulated as an experiment that challenges $\adv$ to produce a ballot for a specified voter, rather than permitting $\adv$ to choose from among all the registered voters; see \refappendix{\ref{sec:intEV1}} for details.}
and (iii) that ballot was not revealed.
%Furthermore, $n_C$ must be bounded by a polynomial $q$.
If $\adv$ cannot succeed in this experiment, then only authorized votes are tallied.
\else
Line 1 of $\ExpEVVSymb$ has been refactored into lines 1 and 2 of $\ExpEVVWeakSymb$. In line 1 of $\ExpEVVWeakSymb$, keys are generated by the experiment. In line 2, $\adv$ is given the public key but not the private key.\footnote{$\ExpEVVWeakSymb$ can be equivalently formulated as an experiment with one registered voter. See \refappendix{\ref{sec:evalt}} for details.}
\fi
%\footnote{Similarly to $\ExpEVVSymb$, $\ExpEVVWeakSymb$ can equivalently be formulated as an experiment that challenges $\adv$ to produce a ballot for a specified voter. See \refappendix{\ref{sec:intEV1}} for details.
%\mrc{That appendix seems to have gone away. What should happen with this footnote?}
%\steven{I suggest removing the footnote. The variant of $\ExpEVVSymb$ is gone, and the variant of $\ExpEVVWeakSymb$ is only used in the JCJ proof. We also aren't sure whether they are equivalent in the general case anymore.}}
%\noindent\review{
%$\ExpEVV=$
%\begin{algorithmic}[1]
% \STATE $(\PKT,Q,n_V) \leftarrow \adv(k)$\;
% \FORALL{$1 \leq i \leq n_V$}
% \STATE $(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$\;
% \ENDFOR
% \STATE $\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
% \STATE $\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
% \STATE $(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
% \IF{$\exists r \mathrel :
% b=\Vote[\sk_i,\PKT,Q,n_C,\beta,k; r]
% \mathrel\wedge b \not= \perp
% \mathrel\wedge b\not\in \mathit{Rvld}
% \mathrel\wedge sk_i \not\in \mathit{Crpt}$}
% \STATE \Return 1
% \ELSE
% \STATE \Return 0
% \ENDIF
%\end{algorithmic}
%}
%\steven{This experiment does not capture the following sort of attack: $\adv$ outputs a $\sk_i\not\in\mathit{Crpt}$ and a $b\in\mathit{Rvld}$ such that $b$ was added to $\mathit{Rvld}$ on a query for a different secret key $\sk_j$. To fix this we could instead have sets $\mathit{Rvld}_i$ where a ballot $b$ is added to $\mathit{Rvld}_i$ on query $R(i,\beta,n_C)$. Then the if statement would check that
%$b\not\in\mathit{Rvld}_i$.}
%\mrc{BEGIN Ben's experiment:}
%
%\begin{inlineexperiment}{$\ExpEVV$}
% $(PK_T, \SKT, Q)\leftarrow \SetupSymb(k)$;\\
% $(pk,sk) \leftarrow \Register[\PKT,Q,k]$\\
% $B\leftarrow\emptyset;$\\
% $b\leftarrow \adv^{\oracleSymb^*}(pk,\PKT, Q, k)$;\\
% \eIf{$\exists n_C,\beta,r \mathrel .
% b=\Vote[\sk,\PKT,Q,n_C,\beta,k; r]
% \wedge 1 \leq \beta \leq n_C
% \wedge b\not\in B \cup \{\perp\}$} {
% \Return 1
% }{
% \Return 0
% }
%\end{inlineexperiment}
%\noindent The experiment uses oracle $\oracleSymb^*$ such
%that: $\oracleSymb^*(n_C,\beta)$ computes
%$b\leftarrow\Vote[\sk,\PKT,Q,n_C,\beta,k]; B\leftarrow B \cup \{b\}$
%and outputs $b$, where $1\leq\beta\leq n_C$.
%
%\mrc{END Ben's experiment.}
\fi
%%%%%%%%%%%%%%%%%%%
%%%%TO DO
%\subsubsection{\ifonce Election verifiability \else Strong election verifiability\fi}
\subsubsection{Election verifiability}
\ifint
With $\ExpIVVSymb$, $\ExpUVVSymb$, and \ifweakelig$\ExpEVVWeakSymb$\else$\ExpEVVSymb$\fi, we define
election verifiability with internal authentication.
\else
With $\ExpIVSymb$ and $\ExpUVSymb$, we define election verifiability with external authentication.
\fi
\ifonce
Let a PPT adversary's \emph{success} $\Succ(\Exp(\cdot))$ in an experiment $\Exp(\cdot)$ be the probability that the adversary wins---that is, $\Succ(\Exp(\cdot)) =\mathrm{Pr}[b\leftarrow\Exp(\cdot): b = 1]$.\fi
\begin{definition}[\ifint\ifweakelig$\EVIAWeak$\else$\EVIA$\fi\else$\EVEA$\fi]
\ifint
\label{exp:ev}
\else
\label{exp:ivuv}
\fi
An election scheme $\Pi$ satisfies
\ifint
\ifweakelig
\emph{weak election verifiability with internal authentication} $($\EVIAWeak$)$
\else
\emph{election verifiability with internal authentication} $($\EVIA$)$
\fi
\else
\emph{election verifiability with external authentication} $($\EVEA$)$
\fi
if Completeness and Injectivity are satisfied and
for all PPT adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$, it holds that
\ifint
$\SuccIVV + \SuccUVV + \ifweakelig\SuccEVVWeak\else\SuccEVV\fi \leq \mu(k)$.
\else
$\SuccIV + \SuccUV \leq \mu(k)$.
\fi
\end{definition}
%\steven{Should we just call this election verifiability instead of weak election verifiability, unless we mention that we have a different version in the technical report? Similarly for $\ExpEVVWeakSymb$.}
%\ben{We should keep weak election verifiability (see earlier remark) and add a footnote that explains there is a stronger definition. We could perhaps also explain why JCJ doesn't satisfy it. There's some material in the intro that can be recycled.}
\noindent
\ifonce
An election scheme satisfies individual verifiability if $\ifint\SuccIVV\else\SuccIV\fi\leq \mu(k)$\ifint, and similarly for eligibility verifiability\fi. \ifint{}U\else{}And u\fi{}niversal verifiability is satisfied if the election scheme satisfies
Completeness and Injectivity, and
$\ifint\SuccUVV\else\SuccUV\fi\leq \mu(k)$.
\else
An election scheme satisfies eligibility verifiability if $\ifweakelig\SuccEVVWeak\else\SuccEVV\fi\leq \mu(k)$, and similarly for individual verifiability. Universal verifiability is satisfied if the election scheme satisfies
Completeness and Injectivity, and
$\ifint\SuccUVV\else\SuccUV\fi\leq \mu(k)$.
\fi
\begin{comment}
\review{We also give a stronger version of $\ExpEVVWeak$, called $\ExpEVV$.}
\begin{inlineexperiment}{$\ExpEVV$}
$(\PKT,n_V) \leftarrow \adv(k)$\;
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\review{In this experiment, the tallier's public key is not honestly generated, but instead chosen by the adversary. Using this definition, we can define a variant of $\EVIAWeak$.}\steven{Does it make more sense to introduce these variants here or just before the Helios-C section? An extra benefit of having it here is that we can state that the signature scheme satisfies the strong version.}
\begin{definition}[$\EVIA$]
An election scheme $\Pi$ satisfies
\emph{election verifiability with internal authentication} $($\EVIA$)$
if for all probabilistic polynomial-time adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$, we have
$\SuccIVV + \SuccUVV + \SuccEVV \leq \mu(k)$.
\end{definition}
\end{comment}
\subsection{Example---Toy scheme from nonces}
\label{sec:simpleNonceScheme}
A toy election scheme satisfying $\EVEA$ can be based on nonces.
Each voter publishes a nonce paired with their choice of candidate to the bulletin board.
This scheme illustrates the essence of election verifiability, even though it does not offer any privacy.
\begin{definition}\label{def:nonce}
Election scheme $\Nonce$ is defined as follows:
\begin{itemize}
\item $\Setup[k]$ outputs $({\perp},{\perp},p_1(k),p_2(k))$, where $p_1$ and $p_2$ may be any polynomial functions.
\item $\Vote[\PKT,n_C,\beta,k]$ selects a nonce $r$ uniformly at random from $\mathbb Z_{2^k}$
and outputs $(r,\beta)$.
\item $\Tally[\SKT,\bbb,n_C,k]$ computes a vector ${\bf X}$ of length $n_C$, such that
${\bf X}$ is a tally of the votes on $\bbb$
for which the nonce is in $\mathbb Z_{2^k}$,
% MRC: this feels like gratuitous formalism to me:
%$\langle {\bf X} \rangle = [\beta \mid (r,\beta)\in\bbb \wedge r\in\mathbb Z_{2^k} \wedge 1 \leq \beta \leq n_C ]$
and outputs $({\bf X},\perp)$.
\item $\Verify[\PKT,\bbb,n_C,{\bf X},P,k]$ outputs $1$ if $({\bf X},P) =\Tally[{\perp},\bbb,n_C,k]$, and
$0$ otherwise.
\end{itemize}
\end{definition}
\iftr
\later{\ben{I think it is worth adding:}
\begin{lemma}
$\Nonce$ is an election scheme.
\end{lemma}
\begin{proof}[Proof sketch]
\review{TO DO}
\end{proof}
}
\fi
\begin{proposition}\label{prop:simpleNonceScheme}
$\Nonce$ satisfies $\EVEA$.
\end{proposition}
\begin{proof}[Proof sketch]
\noindent $\Nonce$ satisfies individual verifiability, because voters can use their nonce to check that their own ballot appears on the bulletin board.
With overwhelming probability, $\VoteSymb$ will select unique nonces for each voter, hence generate distinct ballots.
$\Nonce$ also satisfies universal verifiability, because plaintext candidate choices are posted on the bulletin board.
\end{proof}
%In section~\ref{sec:helios}, we give an example of a real-world voting system that satisfies $\EVEA$.
\subsection{Orthogonality}
\label{sec:orthogonal:ext}
$\ExpIVSymb$ and $\ExpUVSymb$ capture orthogonal security properties.
A scheme that satisfies individual verifiability but violates universal verifiability can be constructed from $\Nonce$ by modifying $\VerifySymb$ to always output $1$.
Voters can still check that their own ballot appears.
But an adversary can easily win $\ExpUVSymb$, because $\VerifySymb$ will accept any tally.
A scheme that satisfies universal verifiability but violates individual verifiability can be constructed from $\Nonce$ by removing the nonces, leaving just the voter's choice in the ballots.
Call that scheme $\Choice$.
Anyone can still verify the tally of the election, but an adversary can easily win $\ExpIVSymb$, because two votes for the same candidate will collide.
\iffalse
\mrc{I don't think the rest of this material is all that worthy of including in the conference version of the paper.}
\begin{definition}\label{elec:clashAttackScheme}
Election scheme $\Choice$ is the same as $\Nonce$, except as follows:
\begin{itemize}
\item $\Vote[\PKT,n_C,\beta,k]$ outputs $\beta$.
\item $\Tally[\SKT,\bbb,n_C,k]$ computes a vector ${\bf X}$ of length $n_C$, such that
${\bf X}$ is a tally of the votes on $\bbb$, and outputs $({\bf X},\perp)$.
\end{itemize}
\end{definition}
\noindent
$\Choice$ admits clash attacks that violate individual verifiability,
nonetheless, universal verifiability is preserved.
\begin{proposition}\label{prop:clashAttackScheme}
$\Succ(\ExpUVSymb(\Choice,\adv,k))$ is non-negligible for some
security parameter $k$ and PPT adversary $\adv$.
\end{proposition}
\begin{proof}[Proof sketch]
$\Choice$ does not ensure distinct ballots, because two voters that vote for the same candidate will generate the same ballot.
Indeed, since $\bbb$ is a set, at most one ballot for each candidate choice can appear on $\bbb$.
% MRC: here is the original formal proof:
%Suppose $\Pi$ is our non-distinct ballot election scheme and $k$ is a security parameter.
%Let $\adv$ be an adversary that outputs $({\perp},{\perp},n_c,\beta,\beta)$,
%where $n_C$ and $\beta$ are integers.
%We have $(\PKT,Q,n_C,\beta,b) \leftarrow \adv(k);b'\leftarrow\Vote[\PKT,Q,n_C,\beta,k]$ such that $b=\beta = b'$ and $b\not={\perp}$. It follows immediately that $\SuccIV$ is non-negligible, hence, $\Pi$ does not satisfy individual and universal verifiability.
\end{proof}
\begin{proposition}
$\Succ(\ExpUVSymb(\Choice,\adv,k))$ is negligible for all
security parameters $k$ and PPT adversaries $\adv$.
\end{proposition}
\fi
%\InputIfFileExists{weeding}{}{}
%\input{helios-old}
% !TEX root = main-jcj-ev.tex
```
# Case Study: Helios
Helios (**AdidaPereiraMarneffeQuisquater?**; **Olivier16:Helios?**) is an open-source, web-based electronic voting system,[^2] which has been deployed in the real-world. The International Association of Cryptologic Research (IACR) has used Helios annually since 2010 to elect board members (**IACRHelios10b?**; **IACRHelios10?**), the ACM used Helios in an ACM general election (**ACM14:Helios?**), the Catholic University of Louvain used Helios to elect the university president (**AdidaPereiraMarneffeQuisquater?**), and Princeton University has used Helios to elect several student governments (**Adida09:HeliosPrinceton?**; **Adida12:HeliosPrinceton?**).
Helios is intended to satisfy verifiability whilst maintaining *ballot secrecy*—i.e., without revealing voters’ votes. For ballot secrecy, voters encrypt candidate choices using a homomorphic encryption scheme, these encrypted choices are homomorphically combined, and the tallier decrypts the homomorphic combination to reveal the tally. [^3] For verifiability, encryption and decryption steps are accompanied by zero-knowledge proofs.
Informally, Helios works as follows:
- **Setup.** The tallier generates a key pair for a homomorphic encryption scheme and publishes the public key.
- **Voting.** A voter encrypts their candidate choice with the tallier’s public key, and proves in zero-knowledge that the ciphertext contains a well-formed choice. The voter posts their ballot (i.e., ciphertext and proof) on the bulletin board. (The bulletin board is assumed to correctly authenticate voters during posting.)
- **Tallying.** The tallier discards any ballots from the bulletin board for which proofs do not hold. The tallier homomorphically combines the ciphertexts in the remaining ballots, decrypts the homomorphic combination, and proves in zero-knowledge that decryption was performed correctly. Finally, the tallier publishes the winning candidate and proof of correct decryption.
- **Verification.** A verifier recomputes the homomorphic combination and checks all the zero-knowledge proofs.
Helios was first implemented as Helios 2.0.[^4],[^5]
Chang-Fong & Essex (**Essex16:HeliosVerifiability?**) have shown that Helios 2.0 does not satisfy universal verifiability. Thus, we would not expect $\EVEA$ to hold for Helios 2.0. Indeed, we formalize a generic construction for Helios-like election schemes (), which we use to derive a formal description of Helios 2.0 (). And using that description, we can prove that Helios 2.0 is not verifiable:
**Proposition 1**. *Helios 2.0 does not satisfy $\EVEA$.*
Our proof formalizes the attack by Chang-Fong & Essex in the context of our Completeness definition.
A proof of Proposition 1 appears in . Vulnerabilities can be attributed Helios 2.0 not checking the suitability of cryptographic parameters nor checking that all elements of ballots are constructed using the correct parameters, and the current version of Helios (Helios 3.1.4) is intended to mitigate against those vulnerabilities by performing the necessary checks.[^6]
Bernhard *et al.* (**Bernhard12:Helios?**) have shown that Helios 3.1.4 does not satisfy universal verifiability. Thus, we would not expect $\EVEA$ to hold for Helios 3.1.4 either. Indeed, we use our generic construction to derive a formal description of Helios 3.1.4 (). And using that description, we can prove that Helios 3.1.4 is not verifiable:
**Proposition 2**. *Helios 3.1.4 does not satisfy $\EVEA$.*
Our proof formalizes the attack by Bernhard et al. in the context of our universal verifiability experiment.
A proof of Proposition 2 appears in . Bernhard *et al.* attribute vulnerabilities to application of the Fiat–Shamir transformation without inclusion of statements in hashes (i.e., the weak Fiat–Shamir transformation), and including statements in hashes (i.e., applying the Fiat–Shamir transformation) is postulated as a defense.
Beyond verifiability, Helios 3.1.4 has been shown not to satisfy ballot secrecy,[^7] due to tallying meaningfully related ballots,[^8] and omitting such ballots from the tally (i.e., ballot weeding) is postulated as a defense (**Smyth11:Helios?**; **Smyth11:ReplayAttacks?**; **Smyth12:HeliosFurtherReplays?**; **Smyth12:Helios?**; **Smyth13:BallotIndependence?**; **2014-ballot-independence-for-election-schemes?**; **Bernhard14:voting-tutorial?**; **BCGPW15?**; **BCGPW15:eprint?**).[^9]
One candidate ballot weeding mechanism would omit any ballot containing a previously observed hash from the tallying procedure. Although ballot weeding can be sufficient for ballot secrecy (cf. (**Smyth13:BallotIndependence?**) & (**Smyth16:ballotSecrecy?**)), we have found that it violates universal verifiability. In particular, an adversary can observe a voter’s ballot and cast a related ballot (for a candidate other than the voter’s choice), such that the voter’s ballot is omitted from tallying. (This could be achieved, for example, by manipulating the bulletin board to ensure that the adversary’s ballot is processed before the voter’s ballot, since this causes the voter’s ballot to be weeded.) Our definition of universal verifiability requires all ballots on the bulletin board to be tallied, thus it is violated by ballot weeding. It follows that ballot weeding variants of Helios 3.1.4 do not satisfy $\EVEA$, because that scheme relies upon ballot weeding to defend against ballot secrecy violations.
**Remark 3**. *Variants of Helios 3.1.4 with the Fiat-Shamir transformation (rather than weak Fiat-Shamir) and ballot weeding do not satisfy $\EVEA$.*
An informal proof of Remark 3 follows immediately from our discourse. A proof would require a formal description of ballot weeding. Such a formal description can be derived as a straightforward variant of Helios 3.1.4 that applies the Fiat–Shamir transformation (rather than the weak Fiat–Shamir transformation) and uses ballot weeding. These details provide little value, so we do not pursue them further.
To ensure universal verifiability, we propose variants of Helios 3.1.4. Our variants defend against ballot secrecy violations by incorporating proposals by Smyth et al. (**2015-ciphertext-plus-proof-of-knowledge-is-NM-CPA?**; **2018-ballot-secrecy-from-NM-CPA?**) and Smyth (**Smyth16:ballotSecrecy?**) for non-malleable ballots, rather than proposals for ballot weeding. We formalize those variants as a set () of election schemes (). Using that formalization, we can prove that is verifiable:[^10]
**Theorem 4**. * satisfies $\EVEA$.*
satisfies individual verifiability, because the probabilistic encryption scheme ensures that ballots are unique, with overwhelming probability. And satisfies universal verifiability, because the zero-knowledge proofs can be publicly verified.
A formal proof of Theorem 4 appears in . The proof assumes the random oracle model (**Bellare93:RandomOracles?**). This proof, coupled with the proof of ballot secrecy by Smyth (**Smyth16:ballotSecrecy?**), provides strong motivation for future Helios releases being based upon , since it is the only variant of Helios which is known be secure.
# Internal Authentication
**\[tex2md\] this section could not be converted; its LaTeX follows verbatim:** `Error at (line 736, column 13): expecting \end{document} & ~\qquad\qquad \mathrel\wedge b'=\Vote[\sk,\PKT,n_C,\beta',k; r']\}. ^`
``` latex
\section{Internal Authentication}
\label{sec:ev2}
Some election schemes implement their own authentication mechanisms.
JCJ~\cite{JCJ02,JCJ05,JCJ10} and
Civitas~\cite{CCM08}, for example, authenticate ballots based on \emph{credentials} issued to voters by a registration authority.
Schemes with this kind of internal authentication enable verification of whether tallied ballots were cast by authorized voters.
\subsection{Election scheme syntax}
\label{sec:def:internalscheme}
A \emph{registrar} is
responsible for issuing authentication \emph{credentials} to voters.\footnote{%
Some election schemes (e.g.,\ifheliosc\ Helios-C and\fi\ JCJ) permit the registrar's role
to be distributed among several registrars. For simplicity, we consider only a single registrar in this paper.}
Each voter is associated with a credential pair $(\pk,\sk)$. \never{alpha rename $\pk,\sk$ to $pd,d$. Updating the macro should be sufficient. BEN: I attempted this conversion (I only found a couple of instances of $pk$ instead of $\backslash{pk}$), but, $\pk$ and $\sk$ are also used for various setup algorithms (see Appendix~\ref{sec:crypto}, for instance), which will make a translation more problematic. MRC: I'm okay with not making this conversion.}
The voter uses private credential $\sk$ to construct a ballot.
Public credential $\pk$ is used during tallying and verification.
Let $\electoralroll$ denote the \emph{electoral roll}, which is the set of all public credentials.
We revise our syntax to capture an election scheme with internal authentication, which henceforth in this section we abbreviate as ``election scheme.''
\begin{definition}[Election scheme with internal authentication]
An \emph{election scheme with internal authentication} is a tuple $(\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$ of PPT algorithms:
\begin{itemize}
\item $(\PKT,\SKT,\mB,\mC) \leftarrow \Setup[k]$
\item $(\pk,\sk) \leftarrow \Register[\PKT,k]$
\item $b \leftarrow \Vote[\sk,\PKT,n_C,\beta,k]$
\item $({\bf X},P) \leftarrow \Tally[\SKT,\bbb,\electoralroll,n_C,k]$
\item $v \leftarrow \Verify[\PKT,\bbb,\electoralroll,n_C,{\bf X},P,k]$
\end{itemize}
\noindent
Election schemes must satisfy \emph{Correctness}:
% !TEX root = main-jcj-ev.tex
%
%
there exists a negligible function $\mu$,
such that for all security parameters $k$,
integers $n_B$ and $n_C$, and
choices $\beta_1,\dots,\beta_{n_B}\in\{1,\dots,n_C\}$, it holds that
if ${\bf Y}$ is a vector of length $n_C$ whose components are all $0$, then\\
%\begin{equation*}
%\begin{split}
%\Pr [&(\PKT,\SKT,Q) \leftarrow \Setup[k]; \\
%%% Ugly \hskip hack
% &\textrm{\lFor{$1 \leq i \leq n_B$}{${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$}}; \\
% &\textrm{\lFor{$1 \leq i \leq n_B$}{$b_i \leftarrow \Vote[\PKT,Q,n_C,\beta_i,k]$}}; \\
% &\bbb \leftarrow \{b_1,\dots,b_{n_B}\};\\
% &({\bf X},P) \leftarrow \Tally[\PKT,\SKT, \bbb,n_C,k]:\\
% &{\bf X} = {\bf Y} ] > 1 - \mu(k).
%\end{split}
%\end{equation*}
{\upshape
\noindent $\Pr[(\PKT,\SKT,\mB, \mC) \leftarrow \Setup[k]$;\\
\begin{algorithm}[H]
\For{$1 \leq i \leq n_B$}{
\ifint$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$;\\\fi
$b_i \leftarrow \Vote[\ifint\sk_i,\fi\PKT,n_C,\beta_i,k]$;\\
${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$;
}
\ifint$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_B}\}$; \\\fi
$\bbb \leftarrow \{b_1,\dots,b_{n_B}\}$;\\
$({\bf X},P) \leftarrow \Tally[\SKT, \bbb,\ifint\electoralroll,\fi n_C,k]:$
$n_B \leq \mB \wedge n_C\leq \mC \Rightarrow {\bf X} = {\bf Y}] > 1 - \mu(k)$.
\end{algorithm}
}
%\steven{Does correctness imply injectivity? If ballots collide, then the set $\bbb$ above will be missing a ballot and the resulting tally
%will not be correct.}
%\ben{I'm not immediately convinced that this is true, because I could design a Tally algorithm that considers the size of the bulletin board when computing ${\bf X}$ such that ${\bf X}$ does not contain votes arising from collisions.}
%\steven{I don't understand your example. Consider a scheme where a ballot for candidate $\beta$ is just $\beta$, and the simple case where $n_C=1$, $n_V=2$, and both voters submit votes for $\beta=1$. Then $\bbb=\{1\}$. How can the Tally algorithm know that it should count 2 votes for candidate 1 and not just 1 vote?}
%\begin{algorithmic}
%\FORALL{$1 \leq i \leq n_V$}
% \STATE $b_i \leftarrow \Vote[\PKT,Q,n_C,\beta_i,k]$;
% \STATE ${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$;
%\ENDFOR
%\STATE $\bbb \leftarrow \{b_1,\dots,b_{n_V}\}$;\\
%\STATE $({\bf X},P) \leftarrow \Tally[\PKT,\SKT, \bbb,n_C,k]:$
%\STATE ${\bf X} = {\bf Y}] > 1 - \mu(k)$.
%\end{algorithmic}
%\begin{equation*}
%\begin{split}
%\Pr [&(\PKT,\SKT,Q) \leftarrow \Setup[k];\\
% &\FORALL{$1 \leq i \leq n_V$}
% &\STATE $b_i \leftarrow \Vote[\PKT,Q,n_C,\beta_i,k]$;
% &\STATE ${\bf Y}[\beta_i] \leftarrow{\bf Y}[\beta_i] + 1$;
% &\ENDFOR
% &b\neq b' \wedge b\neq \bot \wedge b'\neq \bot] > 1 - \mu(k).
%\end{split}
%\end{equation*}
%\end{definition}
%%%Terminology: Correctness vs. completeness
%
%\ben{I advocate Completeness $\rightarrow$ Correctness. We need to change terminology throughout if we agree.}
%\mrc{I disagree. ``Correctness'' intuitively means that Verify is correct---but what it means for Verify to be correct is exactly what IV, UV, EV are trying to pin down.
%The current property is not about correctness.
%OTOH, ``completeness'' is exactly the right word from logic to be using: a proof system
%is complete w.r.t.\ a model theory if the proof system has no false negatives,
%i.e., it never rejects a statement deemed true by the model theory.
%Here, Verify is the analogue of the proof system, and we want that it never rejects
%an output produced by Tally. So Verify is complete w.r.t.\ Tally.}
\end{definition}
%%%Appears earlier.
%%%
%We also introduce a new notation: an election outcome ${\bf X}$ can be translated into a multiset $\langle {\bf X} \rangle$
%representing the election outcome, that is, $\langle {\bf X} \rangle = \bigcup_{1\leq j \leq |{\bf X}|} [ \underbrace{j,\dots,j}_{{\bf X}[j]\textrm{ times}} ]$.
\noindent
$\SetupSymb$ is unchanged from election schemes with external authentication (cf.~\S\ref{sec:def:externalscheme}).
The only change to $\VoteSymb$ is that it now accepts private credential $\sk$ as input.
Similarly, the only change to $\TallySymb$ and $\VerifySymb$ is that they now accept electoral roll $\electoralroll$ as input.
$\RegisterSymb$ is executed by the registrar.
It takes as input the public key $\PKT$ of the tallier %, the proof $Q$ of correct key pair construction,
and security parameter $k$, and it outputs a \emph{credential pair} $(\pk,\sk)$.
After all voters have been registered, the registrar certifies the electoral roll, perhaps by digitally signing and publishing it.%
\footnote{It might seem surprising that $\RegisterSymb$ does not require the registrar to provide any private keys as input.
But in constructions of election schemes with internal authentication, e.g.,~\cite{CCM08,JCJ10}, the registrar does not sign credential pairs with its own private key.
Rather, the registrar signs the electoral roll.
%\mrc{We talked about adding the next sentence. Having written it, I think it's unnecessary here. Ben, if you agree, please just delete it.} %\ben{I agree -- I've left the sentence and remark here for reference.}
%Juels et al.~\cite{JCJ10} define $\RegisterSymb$ to accept the registrars' private key as input, but their election scheme does not use the key.
}
%\review{
%\sout{
%While it may seem that Injectivity prevents us from analyzing schemes satisfying information-theoretic ballot secrecy, this is actually not the case. For example, schemes like Moran-Naor, in which ballots contain perfectly-hiding commitments to candidates, may have collisions between ballots, but only with negligible probability over the choice of random coins.
%}
%}
%\mrc{I recall reviewers complaining that we couldn't handle forward secrecy or something
%like that because of Injectivity. We should head off the criticism somehow...}
%\ben{This was probably everlasting ballot secrecy. Jeremy Clark (23 July) wrote ``[2.1] Injectivity: I think saying election schemes *must* satisfy this property is way too strong. For example, any voting scheme with everlasting privacy does not satisfy this condition (e.g., Moran-Naor's or Demirel's) and I would consider them secure voting systems." and David (30 June) wrote ``4. p2 - injectivity: in my own thoughts on verifiability, I've always distinguished two cases: (a) ballots do uniquely determine votes and (b) they do not. Injectivity seems to imply (a), which is the simpler case (see also comment 3). What we lose by excluding (b) is the "everlasting privacy" variant where ballots are I.T.-hiding commitments, however that can always be material for a later paper." }
% !TEX root = main-jcj-ev.tex
\subsection{Election verifiability}
\ifint
\else
\label{sec:def:ivuv}
\fi
\ifint
Secure construction of electoral rolls is not a topic that electronic
voting systems usually address---though it seems an important part of
any real-world deployment. Indeed, voting systems typically assume
the registrar is honest. In our experiments, below,
we model an adversary who cannot corrupt the registration
process that issues credentials to voters.
Hence our definitions will not detect attacks against verifiabilities
that result solely from weaknesses in the registration process.%
\footnote{K\"usters and Truderung~\cite{Kusters09:CoercionResistance} explore some consequences of permitting adversarial influence during registration.}
\fi
\ifonce
Election verifiability comprises three aspects: individual, universal, and eligibility verifiability.
We express each as an \emph{experiment}, which is an algorithm that outputs 0 or 1.
The adversary \emph{wins} an experiment by causing it to output 1.
\else
Recall (from \S\ref{sec:def:ivuv}) that election verifiability is expressed with experiments, and that an adversary wins by causing an experiment to output 1.
\fi
\ifint
We \ifonce\else henceforth \fi
assume that the adversary is \emph{stateful}---that is,
information persists across invocations of the adversary in a single experiment.
\fi
\ifonce\else
Our experiments in Section~\ref{sec:ev} did not need this assumption, because they never invoked the adversary more than once.
\fi
\subsubsection{Individual verifiability}
\ifint
\label{sec:def:ivv}
\else
\label{sec:def:iv}
\fi
\ifonce
In our model of election schemes, all recorded ballots are posted on the bulletin board.
So for a voter to verify that their ballot has been recorded, it suffices to enable them to uniquely identify their ballot on the bulletin board.%
\footnote{Section~\ref{sec:conclusion} addresses the complementary issue of whether a recorded ballot corresponds to the candidate choice a voter intended to make.}
\else
The individual verifiability experiment again challenges adversary $\adv$ to generate a scenario in which the voter could not uniquely identify their ballot:%
\ifint
\footnote{Unlike $\ExpIVSymb$,
%experiment $\ExpIVVSymb$ cannot equivalently be formulated as an experiment that challenges $\adv$ to predict the output of $\VoteSymb$.
a variant of $\ExpIVVSymb$ that challenges $\adv$ to predict the output of $\VoteSymb$ is strictly stronger.
See \refappendix{\ref{sec:ivaltII}} for details.}
\fi
\fi
\ifonce
Individual verifiability experiment \ifint$\ExpIVV$\else$\ExpIV$\fi, where $\Pi$ denotes an election scheme, $\adv$ denotes the adversary, and $k$ denotes a security parameter, therefore challenges $\adv$ to generate a scenario in which the voter cannot uniquely identify their ballot.
In essence, \ifint$\ExpIVVSymb$\else$\ExpIVSymb$\fi\ challenges $\adv$ to generate a collision from $\VoteSymb$.%
\ifint\else
\footnote{$\ExpIVSymb$ can be equivalently formulated as an experiment that challenges $\adv$ to predict the output of $\VoteSymb$. See \refappendix{\ref{sec:ivalt}} for details.}
\fi\
If $\adv$ cannot win, then voters can uniquely identify their ballots on the bulletin board:
\fi
\begin{inlineexperiment}{\ifint$\ExpIVV$\else$\ExpIV$\fi}
$(\PKT,\ifint n_V\else n_C,\beta,\beta'\fi) \leftarrow \adv(k)$\; \ifint\else\label{alg:iv:candidates}\fi
\ifint
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\; \ifint\label{alg:ivv:register}\else\fi
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\;
$\mathit{Crpt}\leftarrow\emptyset;$\\
$(n_C,\beta,\beta',i,j) \leftarrow \adv^{\corruptOracle}(\electoralroll)$\; \ifint\label{alg:ivv:candidates}\else\fi
\fi
$b\leftarrow\Vote[\ifint \sk_i,\fi\PKT,n_C,\beta,k]$\; \ifint\label{alg:ivv:ballot}\else\label{alg:iv:ballot}\fi
$b'\leftarrow\Vote[\ifint \sk_j,\fi\PKT,n_C,\beta',k]$\; \ifint\label{alg:ivv:ballot2}\else\label{alg:iv:ballot2}\fi
\eIf{
$b = b'
\wedge b \not= {\perp}
\wedge b' \not= {\perp}
\ifint
\wedge i \not= j
\wedge \sk_i \not\in \mathit{Crpt}
\wedge \sk_j\not\in \mathit{Crpt}
\fi
$\ifint\label{alg:ivv:conditional}\fi}{
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
%\steven{May not need the $\wedge n_C\leq|\mathfrak m|$ here, since it will presumably map to $\bot$ otherwise.}
%\steven{Does $\adv$ need to output $m_C$ as well? There's no administrator to perform the proper checks here.}
%\ben{Vote can perform any necessary checks and outputs $\perp$ on error}
\ifonce
\begin{comment}
\later{{\bf Ben}'s wild speculation: ballot secrecy implies IV.
{\bf Michael}'s thoughts: Yeah, that seems right. Use the alternative
definition of IV from the Appendix. Suppose you have an adversary against
it. Use that adversary to get a candidate $\beta$ for which there's
a non-negligible chance that the output of $\VoteSymb$ is $b$.
Now give that $\beta$ along with some $\beta'$ to the
ballot secrecy experiment, which I'm assuming looks like
a CPA kind of game. It gives you back a challenge. If
that challenge is not $b$, guess with advantage 1/2. If it
is $b$, output $\beta$. Since the output must be $b$ with non-negligible
probability, the overall advantage is 1/2 + non-neg.
{\bf Ben}: I'll revisit this at some stage, perhaps later in the year.
{\bf Steven}: I took a look at a definition of ballot secrecy from one of Ben's papers
from 2 years ago and tried to prove this, but since in our experiment the
adversary picks the keys and in the ballot secrecy (and in the usual CPA experiment, I think)
the public key is provided to the adversary, I couldn't get the reduction to go through.
I didn't spend too much time on it though, so there may be another way to prove this.
{\bf Ben}: Steven is right, in particular, an adversary against IV might rely on a
maliciously generated key to cause a collision, but that adversary cannot cause a collision
in the ballot secrecy game, because keys are honestly generated.
}
\end{comment}
\fi
\noindent
\ifonce
\ifint
The adversary is given access to an oracle $\corruptOracle$ in line~5.
\fi
\else
The main differences from the corresponding experiment for external authentication (\S\ref{sec:def:iv}) are that voters are registered in line~2, and that $\adv$ is given access to an oracle $\corruptOracle$ in line~5.
\fi
\ifint
The oracle is used to model $\adv$ corrupting voters and learning their private credentials:
on invocation $\corruptOracle(\ell)$, where $1\leq \ell \leq n_V$, the oracle records that voter $\ell$ is corrupted by updating $\mathit{Crpt}$ to be $\mathit{Crpt} \cup \{\sk_\ell\}$ and outputs $\sk_\ell$.
In line~5, the voter indices output by $\adv$ must be legal with respect to $n_V$, but we elide that detail from the experiment for simplicity.
Line~8 ensures that $\adv$ cannot trivially win by corrupting voters.
%% MRC: preserving the following discussion so that we can add the lines to the experiment more easily one day, if it becomes important to do so.
%\mrc{This reads a bit oddly, as though we're trying to hide something. It's only one more line in the experiment, right? Maybe we should add it.}
%\ben{We want lines 6 \& 7 to be well-defined. We can achieve this by adding}
%
%\If{$i\not\in\{1,\dots,n_C\} \vee j\not\in\{1,\dots,n_C\}$}{
% \Return 0
%}
%
%\noindent
%\ben{between lines 5 and 6. But this seems like an ugly detail which detracts the reader's attention from more important aspects of the experiment. Cryptographers tend to brush such details aside in a similar fashion, e.g., messages are usually assumed to be in the message space, but this detail appears in the text, rather than the experiment.}
%\review{\sout{As in Section~\ref{sec:def:iv}, if $\adv$ does win $\ExpIVSymb$, then Injectivity implies $\beta=\beta'$.}}
%, hence $\adv$ has managed to generate a collision on a particular candidate.
%\steven{In $\ExpIVSymb$, the random coins in $\VoteSymb$ need to be enough to avoid collisions. Why is that not the case
%here, i.e., why can't the adversary know the secret keys for the voters he is making a collision for? It's certainly a reasonable
%assumption, but is it necessary?}
%\ben{I think the definition can be strengthened and simplified in this way:}
%\begin{inlineexperiment}{$\ExpIVV$}
% $(\PKT,Q, n_V) \leftarrow \adv(k)$\;
% \lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$}\\ %\tcp{register voters}
% $\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}$\; %\tcp{set of voters' private keys}
% $(n_C,\beta,\beta',i,j) \leftarrow \adv(M)$\; %\tcp{$\adv$ selects a key, number of candidates, vote, voter, and ballot}
% $b\leftarrow\Vote[\sk_i,\PKT,Q,n_C,\beta,k]$\;
% $b'\leftarrow\Vote[\sk_j,\PKT,Q,n_C,\beta',k]$\; %\tcp{generate a ballot for $\adv$'s vote}
% \eIf{%$\exists n_C\mathrel :
% $b = b'
% \wedge b\neq{\perp}
% \wedge i \not= j $}{
% \Return 1 %\tcp{$\adv$ wins}
% }{
% \Return 0 %\tcp{$\adv$ loses}
% }
%\end{inlineexperiment}
%\noindent\review{
%$\ExpIVV=$
%\begin{algorithmic}[1]
% \STATE $(\PKT,Q, n_V) \leftarrow \adv(k)$\;
% \FORALL{$1 \leq i \leq n_V$}
% \STATE $(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$\\ %\tcp{register voters}
% \ENDFOR
% \STATE $\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V}\}$\; %\tcp{set of voters' public keys}
% \STATE $(n_C,\beta,\beta',i,j) \leftarrow \adv(\electoralrollprivate)$\; %\tcp{$\adv$ selects a key, number of candidates, vote, voter, and ballot}
% \STATE $b\leftarrow\Vote[\sk_i,\PKT,Q,n_C,\beta,k]$\;
% \STATE $b'\leftarrow\Vote[\sk_j,\PKT,Q,n_C,\beta',k]$\; %\tcp{generate a ballot for $\adv$'s vote}
% \IF{%$\exists n_C\mathrel :
% $b = b'
% \wedge b\neq{\perp}
% \wedge i \not= j
% \wedge \sk_i \not\in \mathit{Crpt}
% \wedge \sk_j\not\in \mathit{Crpt}$}
% \STATE \Return 1 %\tcp{$\adv$ wins}
% \ELSE
% \STATE \Return 0 %\tcp{$\adv$ loses}
% \ENDIF
%\end{algorithmic}
%}
%\steven{After giving this some more thought, I'm not sure we should give the adversary the secret keys. The reason is that signature schemes can have randomized key generation algorithms, but deterministic signing algorithms. Thus it's unclear that IV still holds for our toy scheme from digital signatures. The variant in which the adversary has to predict the output of Vote is easily breakable for such signature schemes as well.}
%\steven{For now we'll stick with the original IV definition. We may need to look into the MU-EU-CMA definition for signatures.}
\fi
\ifonce
Line~1 asks $\adv$ to compute two candidate choices $\beta$ and $\beta'$, such that ballots $b$ and $b'$ for those choices, as computed by $\VoteSymb$ in lines~2 and~3, are equal.
One way to achieve individual verifiability is to base the election scheme on a probabilistic encryption scheme, such as El Gamal~\cite{ElGamal85}.
Intuitively, if $\VoteSymb$ encrypts the choice using coins chosen uniformly at random, then it is overwhelmingly unlikely that two votes will result in the same ballot. %; formal details are given in \refappendix{\ref{sec:randomizedBallots}}.
Our proofs that Helios\ifheliosc, Helios-C\fi\ and JCJ satisfy individual verifiability are based on this idea.
\fi
\ifonce
\paragraph*{Clash attacks}
In a \emph{clash attack} \cite{Kusters12:ClashAttacks}, the adversary
convinces some voters that a single ballot belongs to all of them.
Some clash attacks are possible because of vulnerabilities in the design of $\VoteSymb$.
For example, if $\VoteSymb$ simply outputs candidate choice $\beta$, then a voter has no way to distinguish their vote for $\beta$ from another voter's vote for $\beta$.
\ifint$\ExpIVVSymb$\else$\ExpIVSymb$\fi\ detects clash attacks resulting from vulnerabilities in $\VoteSymb$.
Some clash attacks, however, are possible because the adversary subverts
the implementation of $\VoteSymb$.
For example, the adversary might replace some hardware or software, or compromise the random number generator.
If any one of these aspects is compromised, then $\VoteSymb$ has effectively been changed to a different algorithm $\VoteSymb'$.
The conclusions drawn by a security analyst who uses our definition of individual verifiability to analyze $\VoteSymb$ would not necessarily be applicable
to $\VoteSymb'$.
In short, a voter can verify that their ballot has been recorded if and only if they run the correct $\VoteSymb$ algorithm.
We make no guarantees to voters that do not run the correct $\VoteSymb$ algorithm.
One way to make stronger guarantees is to use cut-and-choose
protocols to audit ballots~\cite{Benaloh06:BallotAudit,Benaloh07:BallotAudit}.
This would require modeling voting as an interactive protocol with the adversary, rather than as an algorithm.
We leave this extension as future work.
%Notes on clash attacks:
%
%\ben{Do existing definitions defend against clash attacks? If so, then we can mention this, otherwise, I think we can drop the sentence and define clash attacks in \S\ref{sec:def:iv}.}
%\ben{ (UPDATE) I have revisited JCJ's definition. Given that $BB$ is modelled as a set (in our paper---it is unclear what JCJ intended), I believe clash attacks are detected, in particular, if two ballots collide, then only one ballot will appear in $BB$ and this can be detected, since an honest vote will be missing from $X'$. (On the other hand, I think we can interpret JCJ in a way such that clash attacks are not detected---I'm not in favour of this.)}
\fi
\subsubsection{Universal verifiability}
\ifint
\label{sec:def:uvv}
\else
\label{sec:def:uv}
\fi
\ifonce
For an election to be universally verifiable, anyone must be able to check that a tally is correct with respect to recorded ballots---that is, the tally represents the choices used to construct the recorded ballots.
Because anyone can execute $\VerifySymb$, it suffices that $\VerifySymb$ accepts if and only if that property holds.
\fi
\ifonce
Universal verifiability experiment \ifint$\ExpUVV$\else$\ExpUV$\fi\ therefore challenges adversary $\adv$
\else
The universal verifiability experiment again challenges $\adv$
\fi
to concoct a scenario in which $\VerifySymb$ incorrectly accepts\ifonce, thereby capturing the \emph{only if} requirement\fi:
\ifonce\iftr\relax\else\ifanon\newpage\fi\fi\fi
\begin{inlineexperiment}{\ifint$\ExpUVV$\else$\ExpUV$\fi}
$(\PKT,\ifint n_V\else\bbb,n_C,{\bf X}, P\fi) \leftarrow \adv(k)$\;
\ifint
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\;
$\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}$\;
$(\bbb,n_C,{\bf X}, P) \leftarrow \adv(\electoralrollprivate)$\;
\fi
${\bf Y}\leftarrow \correcttally(\PKT,\bbb,\ifint\electoralrollprivate, \fi n_C,k)$\;
\eIf{${\bf X} \not= {\bf Y} \mathrel\wedge \Verify[\PKT,\bbb,\ifint\electoralroll, \fi n_C,{\bf X},P,k] = 1 $}{
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\noindent
\ifonce
In line~\ifint5\else1\fi, $\adv$ is challenged to create a bulletin board $\bbb$ and purported tally ${\bf X}$ of that bulletin board.
Line~\ifint6\else2\fi\ constructs the correct tally ${\bf Y}$ of $\bbb$
(using function $\correcttally$, which we define below), and line~\ifint7\else3\fi\ checks whether $\VerifySymb$ accepts an incorrect tally.
If $\adv$ cannot win \ifint$\ExpUVVSymb$\else$\ExpUVSymb$\fi, then $\VerifySymb$ will not accept incorrect tallies.
In particular, no ballots can be omitted from the tally, and at most one candidate choice can be included in the tally for each ballot.
\else
The main differences from the corresponding experiment for external authentication (\S\ref{sec:def:uv}) are that voters are registered in line 2, and their credential pairs are used in the rest of the experiment.
The tally of recorded ballots should contain at most one vote per voter. Hence,
election schemes must handle \emph{revotes}---i.e., multiple ballots submitted
by the same voter. Election schemes with external authentication implicitly
handle revoting, by assuming a third party ensures that the recorded
ballots contain at most one ballot per voter. Election schemes
with internal authentication must explicitly handle revoting by tallying
only authorized ballots.
A ballot is \emph{authorized} if it is constructed with a private credential from $\electoralrollprivate$, and that private credential was not used to construct any other ballot on $\bbb$.%
%
\footnote{Helios-C is claimed to support an alternative definition of authorized, whereby only
the last ballot cast by a voter is authorized. We found that Helios-C does not
support this definition. In particular, an adversary can observe the
ballots cast by a voter and replay one of those ballots. The replayed ballot will overwrite the
last ballot cast by the voter and will be authorized instead of it.}\textsuperscript{,}%
\footnote{JCJ is claimed to support alternative definitions of authorized---e.g., only
the last ballot cast by a voter is authorized---using a policy~\cite[\S4.1]{JCJ10}.
We found that the policy proposed by Juels et al. (namely, ``order of postings to [the bulletin board]")
does not support this definition of authorized. In particular, an adversary can intercept a voter's ballot and replay that ballot after observing the voter's
revote, thus the policy incorrectly defines the first ballot as authorized. This could be
prevented by proving knowledge of previously constructed ballots (cf. Clarkson et al.~\cite{CCM08}).}
\fi
\ifint
\ifonce
Let function $\correcttally$
\else
Function $\correcttally$ is now modified to tally only authorized ballots:
let function $\correcttally$ now
\fi
be defined such that
for all $\PKT$, $\bbb$, $\electoralrollprivate$, $n_C$, $k$, $\ell$, and $\beta \in \{1,\ldots,n_C\}$,
\begin{align*}
&\hspace{0ex}\correcttally(\PKT,\bbb,\electoralrollprivate,n_C,k)[\beta] = \ell \\
&\iff \exists^{=\ell} b\in\authorized(\PKT,(\bbb \setminus \{\bot\}),\electoralrollprivate, n_C,k) : \\
& ~\qquad\qquad \exists \sk, r : b=\Vote[\sk,\PKT,n_C,\beta,k; r].
\end{align*}
By comparison, the original $\correcttally$ function (\S\ref{sec:def:uv}) tallies all the ballots on $\bbb$.
\else
Let function $\correcttally$ be defined such that for all
$\PKT$, $\bbb$, $n_C$, $k$, $\ell$, and $\beta \in \{1,\ldots,n_C\}$,
\begin{align*}
&\correcttally(\PKT,\bbb,n_C,k)[\beta] = \ell \\
&\iff \exists^{=\ell} b\in (\bbb \setminus \{\bot\}) : \\
&\qquad\qquad\exists r : b=\Vote[\PKT,n_C,\beta,k; r].
%[\beta \mid \Vote[\PKT,n_C,\beta,k; r] \in \bbb$\\
% $\quad\mathrel\wedge 1\leq\beta\leq n_C]$\; %\tcp{votes corresponding to ballots on $\bbb$}
\end{align*}
%\steven{How does $m_C$ come into play here?}
%\ben{It doesn't come into play.}
\fi
\ifonce
\noindent
The vector produced by $\correcttally$ must be of length $n_C$.
Component $\beta$ of vector
%
$\correcttally(\PKT,\allowbreak\bbb,\allowbreak\ifint\electoralrollprivate,\allowbreak\fi n_C,\allowbreak k)$
%
equals $\ell$ iff there exist%
\footnote{The definition of $\correcttally$ employs a
\emph{counting quantifier}~\cite{Schweikardt05} denoted $\exists^{=}$.
Predicate $(\exists^{=\ell} x : P(x))$ holds exactly when there are
$\ell$ distinct values for $x$ such that $P(x)$ is satisfied.
Variable $x$ is bound by the quantifier, whereas $\ell$ is free.}
$\ell$ ballots on the bulletin board that are votes for candidate $\beta$.
It follows that the output of $\correcttally$ represents the choices used to construct the recorded ballots.
%Note that, without Injectivity, the existential quantification in $\correcttally$ could permit a ballot to be tallied for more than one candidate.
Of course, $\correcttally$ cannot be computed by a PPT algorithm for typical cryptographic election schemes.
But that does not matter, because $\correcttally$ is never actually computed as part of an election scheme---its use is solely in the definition of
\ifint$\ExpUVVSymb$\else$\ExpUVSymb$\fi.\footnote{%
Kiayias et al.~\cite{Kiayias15} use a similar super-polynomial \emph{vote extractor} to recover choices from ballots in an experiment defining verifiability.}
\fi
\ifonce
\fi
Function $\correcttally$ requires that ballots can only be interpreted
for one candidate, which can\ifonce\else\ again\fi\ be ensured by \ifonce\emph{Injectivity}\else{}Injectivity\fi\ifonce\else, which we update to include private credentials\fi:
\begin{definition}[Injectivity]\ifint\label{def:injectivity}\fi
An election scheme $(\SetupSymb\ifint,\allowbreak \RegisterSymb\fi,\allowbreak \VoteSymb, \allowbreak \TallySymb,\allowbreak \VerifySymb)$
satisfies \emph{Injectivity}, if for all security parameters $k$, public keys $\PKT$,
integers $n_C$, and
choices $\beta$ and $\beta'$, such that $\beta\not=\beta'$, we have
\begin{equation*}
\begin{split}
\Pr [%&(\PKT,\SKT,Q) \leftarrow \Setup[k];\\
&\ifint(\pk,\sk)\leftarrow\Register[\PKT,k];\\
&(\pk',\sk')\leftarrow\Register[\PKT,k];\\
&\fi b\leftarrow \Vote[\ifint\sk,\fi\PKT,n_C,\beta,k];\\
&b'\leftarrow \Vote[\ifint\sk',\fi\PKT,n_C,\beta',k]:\\
&b\neq \bot \wedge b'\neq \bot \Rightarrow b\neq b'] = 1. %> 1 - \mu(k).
\end{split}
\end{equation*}
\end{definition}
%%%DISCUSSION: IV doesn't imply IV
%
%
%\ben{There's a relation between Injectivity and IV. I suspect that IV implies Injectivity, if we accept Injectivity WOP.}\steven{I'm not entirely sure. In Injectivity, $n_C$, $\beta$, and $\beta'$ are all universally quantified, while in the IV game $n_C$ is chosen by the adversary and therefore $n_C$ and the $\beta$'s must be bounded. For example, suppose that for some $\VoteSymb$ function, there exists some exponentially large $n_C$ such that there is a collision between a particular $\beta$, $\beta'$ pair for every choice of randomness. Then no PPT adversary should be able to win the IV game. However, I don't think such a scheme would satisfy Injectivity.}\ben{Steven is right.}
\ifonce
\noindent
Injectivity ensures that distinct choices are not map\-ped by $\VoteSymb$ to the same ballot.\footnote{Individual verifiability resembles Injectivity,
but individual verifiability allows choices to be equal and allows adversary $\adv$ to choose election parameters.}
Without Injectivity, an election scheme might produce ballots whose meaning is ambiguous.
For example, if $\Vote[\ifint\sk,\fi\PKT, \allowbreak n_C, \beta, k; r]$ were defined to be $\beta+r$, then a ballot $b$ could be tallied as any well-formed choice $\beta'$ such that $\beta' = b-r'$ for some $r'$.
But that definition of $\VoteSymb$ is prohibited by Injectivity.
Thus, Injectivity helps to ensure that the choices used to construct ballots can be uniquely tallied.
\fi
\ifint
\ifonce
A ballot is \emph{authorized} if it is constructed with a private credential from $\electoralrollprivate$, and that private credential was not used to construct any other ballot on $\bbb$.
\fi
Let $\authorized$ be defined as follows:
%
\begin{align*}
&\hspace{0ex}\authorized(\PKT,\bbb,\electoralrollprivate,n_C,k) =\\
& \{ b \mathrel{:}\; b \in \bbb \\
& ~\mathrel\wedge \exists \pk,\sk, \beta, r \mathrel : b=\Vote[\sk,\PKT,n_C,\beta,k; r] \\
& \qquad~\mathrel\wedge (\pk,\sk)\in\electoralrollprivate\wedge \neg \exists b',\beta',r' : b' \in (\bbb \setminus \{b\}) \\
& ~\qquad\qquad \mathrel\wedge b'=\Vote[\sk,\PKT,n_C,\beta',k; r']\}.
\end{align*}
%
\noindent
Function $\authorized$ discards ballots submitted under the same credential---that is, if there is more than one ballot submitted with a private credential $\sk$, then all ballots submitted under that credential are discarded.
Therefore, election schemes that permit revoting cannot by analyzed with this definition of $\authorized$. But
alternative definitions of $\authorized$ are possible---for example, if ballots were timestamped, $\authorized$ could discard all but the most recent ballot submitted under a particular credential. Smyth presents such a formalization~\cite[Appendix~C]{2019-Athena-voting-system}.
%We leave such definitions as future work.
\fi
%%% MRC: I'm preserving this discussion in case I ever forget why we have to rule out \bot.
%\ben{The definition of $\correcttally$ still looks wrong. Ballot $\perp$ seems to be counted. I think we ensure that $\beta\in\{1,\dots,n_C\}$, because \emph{``the vector produced by $\correcttally$ must be of length $n_C$"}, but I'm concerned that this point is hidden. \sout{I wonder if adding the condition $1 \leq \beta \leq n_C$ on both sides helps; probably not, because then $\correcttally$ can produce a longer vector containing items which are ignored}}
%\mrc{I don't see how $\beta$ could be counted. It's not an integer, so it's not a legal component of the vector.} \ben{Do you mean ``I don't see how \emph{[$\perp$]} could be counted"? Suppose $\PKT$ and $Q$ are such that for all $n_C$, $\beta$, $k$ and $r$ we have
%${\perp} = \Vote[\PKT,Q,n_C,\beta,k; r]$. (This could occur when $Q$ is an invalid proof, for example.)
%We have for all $1 \leq \beta \leq n_C$ that $\exists^{=1} b\in\{\perp\} : \exists r : b=\Vote[\PKT,Q,n_C,\beta,k; r]$, hence, $\correcttally(\PKT,Q,\{\perp\},n_C,k)[\beta] = 1$. It follows that the vector produced by $\correcttally$ contains $n_C$ votes, but the bulletin board contains one ballot.
%}
\ifonce
%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% Start commentary
%%%%%%%%%%%%%%%%%%%%%%%%%
\iffalse
%%%%The following commentary might be useful.
\ben{this isn't immediately obvious from the definition, in particular, suppose $b =\Vote[\PKT,Q,n_C,\beta,k;r] = \Vote[\PKT,Q,n_C,\beta',k;r']$ such that $\beta\not=\beta'$, hence, $\{b\}$ can be tallied as two votes!
%However, this situation cannot arise if the IV experiment is satisfied.
Any thoughts on how to address this?
%Perhaps adding ``\emph{in the absence of clash attacks}" is sufficient.
Worryingly, this casts doubt over my claim (below) that verifying function $\correcttally$ is trivial.}
\mrc{I have two ideas: (i) Add a kind of soundness condition on Vote (as we have for Completeness) that says there's only one candidate a ballot could possibly represent. That's entirely reasonable, and it rules out the issue you've identified. (ii) Introduce a Vote$^{-1}$ that permits ``decrypting'' of ballots into choices, and use it to iterate over all the ballots on $\bbb$ to construct the correct tally. That's also reasonable, and arguably the easiest way to convince oneself that $\correcttally$ is indeed correct.}
\ben{If we assume Vote is injective, then we get (i) and, moreover, there exists an inverse function Vote$^{-1}$, hence, we get (ii) for free (i.e., no need to ``\emph{Introduce a Vote$^{-1}$ that [...]}").
%I favour (ii) over (i), because (i) seems to hide an important detail which could be overlooked, whereas (ii) makes it clear exactly what is happening.
}
%\mrc{I don't appreciate the reason why (i) hides an important detail. Which detail would that be?}
%\ben{The detail that ``\emph{there's only one candidate a ballot could possibly represent}" appears as a soundness condition, rather than a condition of the UV experiment. IMO, this buries an important detail. This could be overcome in the text, however, I favour a solution which makes the details more obvious and I believe (ii) manages this. Having said that, I have now looked into how (ii) would be formalised and it looks somewhat ugly, so I'm now in favour of (i) and discussing the issue in the text.}
%\ben{As a further alternative, we could redefine $\correcttally$, see above. Which is the most intuitive solution? Which is easier to work with---that is, is it easier to work with $\correcttally$ or prove that Vote is injective?}
%\mrc{I favour a separation of concerns.
%Let's impose a new constraint on $\VoteSymb$, either (i) or (ii) above, to ensure that there's a unique way to interpret votes. Let's not let this issue get mixed up with how to define $\correcttally$. Indeed, to make the argument that Ben set out to make here, we need $\correcttally$ to be as simple as possible. See also my changes to $\correcttally$ in section 4.}
\ben{%As noted above,
I'm in favor of (i). In terms of implantation, can we simply say that $\VoteSymb$ is injective in
$\EVEA$, as I suggested above? I've added an alternative solution to the Completeness definition.}
\mrc{A further thought: when Ben visited GW, we came up with an Add scheme that added the credential to the choice. We never did add a requirement to prevent such (unreasonable) schemes, though we talked about doing so. Idea (i) above would prevent it. Idea (ii) presumably would, too, because Vote$^{-1}$ isn't implementable for Add.}
\ben{I don't recall exactly what the Add scheme was. Does it satisfy our definitions as they currently stand?}
\mrc{iirc, the Vote function in Add simply added together $\sk_i$ and $\beta$ and output that as $b$. So $b = \sk_i + \beta$. Add is not IV, but it is UV. Moreover, there are (infinitely) many tallies that are UV with Add. But insisting on (i) or (ii) above would fix this.}
\ben{I remember. It certainly makes sense to rule out this scheme! I have a variant of Add which doesn't need a secret key, see \S\ref{sec:bias} (NB: the variant would satisfy our IV experiment). I don't think other definitions will accept Add, in particular, the JCJ definition specifies the set of honest votes.}
\fi
%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%% End commentary
%%%%%%%%%%%%%%%%%%%%%%%%%
Security analysts must convince themselves that $\correcttally$ is indeed correct.
Because of the function's simplicity, this should be relatively straightforward.
By comparison, $\TallySymb$ algorithms for real voting schemes tend to be complicated.
For example, compare the complexity of $\correcttally$ to %JCJ's
Helios's $\TallySymb$
algorithm, which appears in
\iftr
%Figure~\ref{elec:gjcj} of \refappendix{\ref{sec:jcj-construction}}.
Definition~\ref{def:elec:helios} of \refappendix{\ref{sec:helios-construction}}.
\else
\refappendix{}.
\fi
\ifint\else
By design, $\ExpUVSymb$ assumes the ballots on bulletin board $\bbb$ are exactly the ballots that should be tallied.
The external authentication mechanism is assumed to prohibit unauthorized ballots from being posted on $\bbb$. Helios makes such an assumption about its external authentication mechanism.
%\footnote{An alternative formulation of \ifint$\ExpUVVSymb$\else$\ExpUVSymb$\fi\
%could assume that the ballots on $\bbb$ include authorized and unauthorized ballots, and the external authentication mechanism could filter out any unauthorized ballots.}
\fi
%%%BEN: This footnote possibly contains too much detail. If you want to cut, then please comment out, rather than delete (so that I have the text for reference).
%%%MRC: Yes, I was just about to strike it out when I discovered your comment. I will instead comment out the footnote.
%\footnotetext{Revoting allows voters to cast arbitrarily many ballots,
%%MRC: I have, at least in discussions, hears of schemes that don't allow arbitrarily many revotes, but instead some finite number.
%with the last ballot being the one that is tallied. Motivation for revoting includes: allowing voters to ``vote, verify [that their ballot has been recorded], and revote until verification succeeds"~\cite[\S1]{AdidaN06} and to ``ask the help of anyone for submitting a random ballot, and
%then re-voting privately afterwards"~\cite[\S3.3]{AdidaPereiraMarneffeQuisquater}.
%}
\fi
Election schemes must
\ifonce
also satisfy Completeness, which stipulates that tallies produced
by $\TallySymb$ will actually be accepted by $\VerifySymb$, capturing the \emph{if} requirement:
\else
continue to satisfy Completeness, which we update to include credentials and the electoral roll:
\fi
\begin{definition}[Completeness]
An election scheme $(\SetupSymb\ifint,\allowbreak \RegisterSymb\fi,\allowbreak \VoteSymb, \allowbreak \TallySymb,\allowbreak \VerifySymb)$
satisfies \emph{Completeness}, if for all PPT adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$,
it holds that
\begin{equation*}
\begin{split}
\Pr [&(\PKT,\SKT,\mB, \mC) \leftarrow \Setup[k]; \\
\ifint
&n_V \leftarrow \adv(\PKT,k); \\
%%% Ugly \hskip hack
&\textrm{\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}}; \\
&\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}; \\
&\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}; \\
\fi
&(\bbb,n_C)\leftarrow\adv(\ifint M\else \PKT,k\fi);\\
&({\bf X},P) \leftarrow \Tally[\SKT, \bbb,\ifint\electoralroll,\fi n_C,k]:\\
&|\bbb| \leq \mB \wedge n_C\leq \mC \Rightarrow\\
&\quad\Verify[\PKT,\bbb,\ifint\electoralroll,\fi n_C,{\bf X},P,k] = 1] > 1 - \mu(k).
\end{split}
\end{equation*}
\end{definition}
\ifonce
\noindent
Without Completeness, election schemes might
be vulnerable to biasing attacks, as we show in Section~\ref{sec:rejection}.
\fi
%\subsubsection{\ifonce Eligibility verifiability \else Strong eligibility verifiability\fi}
\subsubsection{Eligibility verifiability}
\ifint
\label{sec:def:evv}
\else
\label{sec:def:ev}
\fi
\ifonce
For an election to satisfy eligibility verifiability, anyone must be able to check that every tallied vote was cast by an authorized voter---hence, it must be possible to authenticate ballots.
\else
Recall (from~\S\ref{sec:def:ev}) that for an election scheme to satisfy eligibility verifiability, anyone must be able to check that every tallied vote was cast by an authorized voter---hence, it must be possible to authenticate ballots.
\fi
\ifint
Because voters are issued credential pairs that can be used to authenticate ballots,
it suffices to ensure that knowledge of a private credential is necessary to construct an authentic ballot.
\else
In election schemes with external authentication, a trusted third party authenticates ballots.
That third party might convince itself that all tallied ballots have been authenticated, but it cannot convince all other parties.
Eligibility verifiability, therefore, is not achievable in election schemes with external authentication.
%We can formalize an experiment $\ExpEVSymb$ capturing that fact (see Appendix~\ref{sec:ev-extern}).
%But the only way a voting scheme can fail to satisfy the experiment is if the third party fails to correctly implement authentication.
%So analyzing voting schemes with the experiment is uninteresting.
%When we turn to election verifiability with internal authentication (Section~\ref{sec:ev2}), eligibility verifiability will become interesting.
%Until then, we elide further details about eligibility verifiability.
%\review{\sout{Under this trust assumption, eligibility verifiability is trivially satisfied,
%since trusted third parties do not authenticate ballots from unauthorized voters.}}
%So analyzing eligibility verifiability with external authentication is uninteresting.
%\review{So until} we turn to election verifiability with internal authentication (\S\ref{sec:ev2}), we elide further details about eligibility verifiability.
\fi
\ifint
Eligibility verifiability experiment $\ExpEVVSymb$ therefore challenges $\adv$ to produce a ballot under a private credential that $\adv$ does not know:
\weakeligfalse
% !TEX root = main-jcj-ev.tex
\begin{inlineexperiment}{\ifweakelig$\ExpEVVWeak$\else$\ExpEVV$\fi}
\ifweakelig
$(\PKT,\SKT,\mB,\mC) \leftarrow \Setup[k]$\;
$n_V \leftarrow \adv(\PKT,k)$\;
\else
$(\PKT,n_V) \leftarrow \adv(k)$\;
\fi
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge \sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\begin{comment}
\begin{inlineexperiment}{$\ExpEVV$}
$(\PKT,n_V) \leftarrow \adv(k)$\;
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\end{comment}
\noindent
\ifonceA
\ifweakelig
In line 1 of $\ExpEVVWeakSymb$, keys are generated by the experiment. In line 2, $\adv$ is given the public key but not the private key.
\else
In line 1, $\adv$ chooses the tallier's public key and the number of voters.
\fi
Line \ifweakelig3\else2\fi\ registers voters. %\footnote{\review{$\ExpEVVSymb$ can be equivalently formulated as an experiment with one registered voter. See \refappendix{\ref{sec:evalt}} for details.}}
$\adv$ is not permitted to influence registration while it is in progress.
%\footnote{K\"usters and Truderung~\cite{Kusters09:CoercionResistance} explore some consequences of permitting adversarial influence during registration.} %%%MOVE EARLIER
In particular, $\adv$ is not permitted to choose credential pairs, because by doing so $\adv$ could trivially win the experiment.
Line \ifweakelig5\else4\fi\ initializes two sets: $\mathit{Crpt}$ is a set of voters who have been corrupted, meaning that $\adv$ has learned their private credential, and $\mathit{Rvld}$ is a set of ballots that have been revealed to $\adv$.
The former set models $\adv$ coercing voters to reveal their private credentials.
The latter set models $\adv$ observing ballots on the bulletin board.
Line \ifweakelig6\else5\fi\ challenges $\adv$ to produce a ballot $b$ with the help of two oracles.
Oracle $\corruptOracle$ is the same oracle as in $\ExpIVVSymb$ (cf.~\S\ref{sec:def:ivv});
it leaks the private credentials of corrupted voters to $\adv$.
Oracle $\revealOracle$ reveals ballots.
On invocation $\revealOracle(i,\beta, \allowbreak n_C)$, where $1\leq i \leq n_V$,
oracle $\revealOracle$ does the following:
\begin{itemize}
\setlength{\itemsep}{0pt}
\item Computes a ballot $b$ that represents a vote for candidate $\beta$ by a voter with private credential $\sk_i$, that is, computes $b \leftarrow \Vote[\sk_i,\PKT,n_C,\beta,k]$.
\item Records $b$ as being revealed by updating $\mathit{Rvld}$ to be $\mathit{Rvld} \cup \{b\}$.
\item Outputs $b$.
\end{itemize}
In line \ifweakelig7\else6\fi, $\adv$ wins if (i) the ballot is \emph{authentic}, meaning that it is the output of $\VoteSymb$ on an authorized credential, and (ii) that credential belongs to a voter that $\adv$ did not corrupt, %
%\footnote{$\ExpEVVSymb$ can equivalently be formulated as an experiment that challenges $\adv$ to produce a ballot for a specified voter, rather than permitting $\adv$ to choose from among all the registered voters; see \refappendix{\ref{sec:intEV1}} for details.}
and (iii) that ballot was not revealed.
%Furthermore, $n_C$ must be bounded by a polynomial $q$.
If $\adv$ cannot succeed in this experiment, then only authorized votes are tallied.
\else
Line 1 of $\ExpEVVSymb$ has been refactored into lines 1 and 2 of $\ExpEVVWeakSymb$. In line 1 of $\ExpEVVWeakSymb$, keys are generated by the experiment. In line 2, $\adv$ is given the public key but not the private key.\footnote{$\ExpEVVWeakSymb$ can be equivalently formulated as an experiment with one registered voter. See \refappendix{\ref{sec:evalt}} for details.}
\fi
%\footnote{Similarly to $\ExpEVVSymb$, $\ExpEVVWeakSymb$ can equivalently be formulated as an experiment that challenges $\adv$ to produce a ballot for a specified voter. See \refappendix{\ref{sec:intEV1}} for details.
%\mrc{That appendix seems to have gone away. What should happen with this footnote?}
%\steven{I suggest removing the footnote. The variant of $\ExpEVVSymb$ is gone, and the variant of $\ExpEVVWeakSymb$ is only used in the JCJ proof. We also aren't sure whether they are equivalent in the general case anymore.}}
%\noindent\review{
%$\ExpEVV=$
%\begin{algorithmic}[1]
% \STATE $(\PKT,Q,n_V) \leftarrow \adv(k)$\;
% \FORALL{$1 \leq i \leq n_V$}
% \STATE $(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$\;
% \ENDFOR
% \STATE $\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
% \STATE $\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
% \STATE $(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
% \IF{$\exists r \mathrel :
% b=\Vote[\sk_i,\PKT,Q,n_C,\beta,k; r]
% \mathrel\wedge b \not= \perp
% \mathrel\wedge b\not\in \mathit{Rvld}
% \mathrel\wedge sk_i \not\in \mathit{Crpt}$}
% \STATE \Return 1
% \ELSE
% \STATE \Return 0
% \ENDIF
%\end{algorithmic}
%}
%\steven{This experiment does not capture the following sort of attack: $\adv$ outputs a $\sk_i\not\in\mathit{Crpt}$ and a $b\in\mathit{Rvld}$ such that $b$ was added to $\mathit{Rvld}$ on a query for a different secret key $\sk_j$. To fix this we could instead have sets $\mathit{Rvld}_i$ where a ballot $b$ is added to $\mathit{Rvld}_i$ on query $R(i,\beta,n_C)$. Then the if statement would check that
%$b\not\in\mathit{Rvld}_i$.}
%\mrc{BEGIN Ben's experiment:}
%
%\begin{inlineexperiment}{$\ExpEVV$}
% $(PK_T, \SKT, Q)\leftarrow \SetupSymb(k)$;\\
% $(pk,sk) \leftarrow \Register[\PKT,Q,k]$\\
% $B\leftarrow\emptyset;$\\
% $b\leftarrow \adv^{\oracleSymb^*}(pk,\PKT, Q, k)$;\\
% \eIf{$\exists n_C,\beta,r \mathrel .
% b=\Vote[\sk,\PKT,Q,n_C,\beta,k; r]
% \wedge 1 \leq \beta \leq n_C
% \wedge b\not\in B \cup \{\perp\}$} {
% \Return 1
% }{
% \Return 0
% }
%\end{inlineexperiment}
%\noindent The experiment uses oracle $\oracleSymb^*$ such
%that: $\oracleSymb^*(n_C,\beta)$ computes
%$b\leftarrow\Vote[\sk,\PKT,Q,n_C,\beta,k]; B\leftarrow B \cup \{b\}$
%and outputs $b$, where $1\leq\beta\leq n_C$.
%
%\mrc{END Ben's experiment.}
\fi
%%%%%%%%%%%%%%%%%%%
%%%%TO DO
%\subsubsection{\ifonce Election verifiability \else Strong election verifiability\fi}
\subsubsection{Election verifiability}
\ifint
With $\ExpIVVSymb$, $\ExpUVVSymb$, and \ifweakelig$\ExpEVVWeakSymb$\else$\ExpEVVSymb$\fi, we define
election verifiability with internal authentication.
\else
With $\ExpIVSymb$ and $\ExpUVSymb$, we define election verifiability with external authentication.
\fi
\ifonce
Let a PPT adversary's \emph{success} $\Succ(\Exp(\cdot))$ in an experiment $\Exp(\cdot)$ be the probability that the adversary wins---that is, $\Succ(\Exp(\cdot)) =\mathrm{Pr}[b\leftarrow\Exp(\cdot): b = 1]$.\fi
\begin{definition}[\ifint\ifweakelig$\EVIAWeak$\else$\EVIA$\fi\else$\EVEA$\fi]
\ifint
\label{exp:ev}
\else
\label{exp:ivuv}
\fi
An election scheme $\Pi$ satisfies
\ifint
\ifweakelig
\emph{weak election verifiability with internal authentication} $($\EVIAWeak$)$
\else
\emph{election verifiability with internal authentication} $($\EVIA$)$
\fi
\else
\emph{election verifiability with external authentication} $($\EVEA$)$
\fi
if Completeness and Injectivity are satisfied and
for all PPT adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$, it holds that
\ifint
$\SuccIVV + \SuccUVV + \ifweakelig\SuccEVVWeak\else\SuccEVV\fi \leq \mu(k)$.
\else
$\SuccIV + \SuccUV \leq \mu(k)$.
\fi
\end{definition}
%\steven{Should we just call this election verifiability instead of weak election verifiability, unless we mention that we have a different version in the technical report? Similarly for $\ExpEVVWeakSymb$.}
%\ben{We should keep weak election verifiability (see earlier remark) and add a footnote that explains there is a stronger definition. We could perhaps also explain why JCJ doesn't satisfy it. There's some material in the intro that can be recycled.}
\noindent
\ifonce
An election scheme satisfies individual verifiability if $\ifint\SuccIVV\else\SuccIV\fi\leq \mu(k)$\ifint, and similarly for eligibility verifiability\fi. \ifint{}U\else{}And u\fi{}niversal verifiability is satisfied if the election scheme satisfies
Completeness and Injectivity, and
$\ifint\SuccUVV\else\SuccUV\fi\leq \mu(k)$.
\else
An election scheme satisfies eligibility verifiability if $\ifweakelig\SuccEVVWeak\else\SuccEVV\fi\leq \mu(k)$, and similarly for individual verifiability. Universal verifiability is satisfied if the election scheme satisfies
Completeness and Injectivity, and
$\ifint\SuccUVV\else\SuccUV\fi\leq \mu(k)$.
\fi
\begin{comment}
\review{We also give a stronger version of $\ExpEVVWeak$, called $\ExpEVV$.}
\begin{inlineexperiment}{$\ExpEVV$}
$(\PKT,n_V) \leftarrow \adv(k)$\;
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\review{In this experiment, the tallier's public key is not honestly generated, but instead chosen by the adversary. Using this definition, we can define a variant of $\EVIAWeak$.}\steven{Does it make more sense to introduce these variants here or just before the Helios-C section? An extra benefit of having it here is that we can state that the signature scheme satisfies the strong version.}
\begin{definition}[$\EVIA$]
An election scheme $\Pi$ satisfies
\emph{election verifiability with internal authentication} $($\EVIA$)$
if for all probabilistic polynomial-time adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$, we have
$\SuccIVV + \SuccUVV + \SuccEVV \leq \mu(k)$.
\end{definition}
\end{comment}
%\ifsigconstruction
%\input{sig}
%\else
%\input{sig-choice}
%\fi
\subsection{Example---Toy schemes from digital signatures}
A toy election scheme satisfying $\EVIA$ can be based on a digital signature scheme.%
\trcryptofootnote{Digital signature schemes are}
%\mrc{The previous sentence cited~\cite[\S3.1]{Smyth10:thesis}, but Ben's dissertation can't have shown exactly that fact, since $\EVIA$ is a new definition. I suggest clarifying exactly what the dissertation showed, or removing the citation.}
%\ben{the toy election scheme is from \cite[\S3.1]{Smyth10:thesis}, but I don't think it is worth mentioning.}
Each voter publishes their signed candidate choice on the bulletin board.
\begin{definition}
\label{elec:simpleSignedBallotScheme}
Suppose $\Gamma = (\GGenSymb,\SgnSymb,\VrfySymb)$ is a digital signature scheme.
Let election scheme $\Sign(\Gamma)$ be defined as follows:
\begin{itemize}
\item $\Setup[k]$ outputs $({\perp},{\perp},p_1(k),p_2(k))$, where $p_1$ and $p_2$ may be any polynomial functions.
%\steven{Do we need $m_B\leq p(k)$? If $m_B$ is exponential, we the probability
%that $\RegisterSymb$ outputs the same secret key twice gets to be non-negligible. JCJ has the same issue - I changed $m_B$ to be $p(k)$ there.} \ben{Yes, it does. Does any polynomial in $k$ suffice? We also need to patch our nonce scheme to avoid collisions in $\mathbb Z_{2^k}$, can you fix?}\steven{Any polynomial should work. I've patched the nonce scheme.}
\begin{comment}
\ben{Since $\TallySymb$ is less formal, I've tried to make $\RegisterSymb$ and $\VoteSymb$ slightly less formal too.}
\end{comment}
\item $\Register[\PKT,k]$
\begin{comment}\sout{computes $(\pk,\sk)\leftarrow \GGen[k]$ and outputs $(\pk,\sk)$.}\end{comment}
outputs a key pair produced by $\GGen[k]$.
\item $\Vote[\sk,\PKT,n_C,\beta,k]$
\begin{comment}\sout{computes $\sigma \leftarrow \Sgn[\sk,\beta]$ and outputs $(\beta,\sigma)$.}\end{comment}
% We don't need to output $\beta$, since it can be derived by brute force.
%%outputs a signature produced by $\Sgn[\sk,\beta]$
%%It seems we do need \beta to ensure injectivity (plus efficiency)
%%couple with the choice $\beta$.
computes $\sigma \leftarrow \Sgn[\sk,\beta]$ and outputs $(\beta,\sigma)$.
\item $\Tally[\SKT,\bbb,\electoralroll,n_C,k]$ computes a vector ${\bf X}$ of length $n_C$, such that
${\bf X}$ is a tally of all the ballots (choice-signature pairs)
on $\bbb$ that are signed by distinct private keys whose corresponding public keys appear in $\electoralroll$ (formally, signatures can be checked using algorithm $\VrfySymb$),
% MRC: I felt like the following formalism was just obscuring the
% relatively obvious intuition:
%$\langle {\bf X} \rangle =
% [\beta \mid \Vrfy[\pk,\beta,\sigma] = 1 \wedge \pk\in\electoralroll \wedge
% 1 \leq \beta \leq n_C \wedge \sigma\in\bbb \wedge
% \bigwedge_{\tau\in\bbb\backslash\{\sigma\} \wedge 1 \leq \alpha \leq n_C} \Vrfy[\pk,\alpha,\tau] \not= 1]$
and outputs $({\bf X},\perp)$.
\item $\Verify[\PKT,\bbb,\electoralroll,n_C,{\bf X},P,k]$ outputs $1$ if $({\bf X},P) =\allowbreak\Tally[\perp,\perp,\bbb,\electoralroll, n_C, \allowbreak \perp]$ and $0$ otherwise.
\end{itemize}
%
\end{definition}
\iftr
\later{\ben{I think it is worth adding:}
\begin{lemma}
$\Sign$ is an election scheme.
\end{lemma}
\begin{proof}[Proof sketch]
\review{TO DO}
\end{proof}
}
\fi
Let $\Sign$ denote $\Sign(\Gamma)$ for an unspecified digital signature scheme $\Gamma$ satisfying strong unforgeablility~\cite{Dodis02,Boneh06}.\trcryptofootnote{Strong unforgeability is} % under adaptive chosen-message attack.\trcryptofootnote{Existential unforgeablility under adaptive chosen-message attack is}
The verifiability of $\Sign$ follows from the security of the underlying signature scheme:
\begin{proposition}\label{prop:simpleSignScheme}
$\Sign$ satisfies $\EVIA$.
\end{proposition}
%\steven{Should we add a footnote to mention that Sign also satisfies $\EVIA$?} \mrc{Do we need that fact in the conference version?} \ben{I think we can omit that detail from the conference version}
\begin{proof}[Proof sketch]
\noindent $\Sign$ satisfies individual verifiability, because voters can verify that their signed choices appear on the bulletin board.
$\Sign$ satisfies universal verifiability, because signed plaintext choices are posted on $\bbb$.
Finally, $\Sign$ satisfies
eligibility verifiability, because anyone can check that the signed choices belong to registered voters.
%\ben{A problem was raised with an earlier proof sketch. Does the issue apply here?}\steven{It doesn't look like the issue of malleable ballots was dealt with. An adversary can query the oracle $\revealOracle$ to obtain a signature on some $\beta$, and then change it to a new signature on $\beta$, winning the EV game. EU-CMA only prevents the adversary from generating a signature on a new message $\beta'\neq\beta$.}\ben{The malleability issue is the one raised by the reviewer. I did not attempt to address this. It probably sufficies to use a strong property on signatures. Perhaps you can look into this?}
\end{proof}
\subsection{Orthogonality}
\label{sec:orthogonal:int}
%\ben{The theorem hasn't been proved for weak election verifiability}
$\ExpIVVSymb$, $\ExpUVVSymb$, and $\ExpEVVSymb$ capture mostly orthogonal security properties, as shown in Table~\ref{tab:evia-orthogonal}.
Individual and universal verifiability are orthogonal, and
eligibility verifiability implies individual verifiability.
\begin{theorem}\label{thm:EVImpliesIV}
If an election scheme $\Pi$ satisfies $\ExpEVVSymb$, then $\Pi$ also satisfies $\ExpIVVSymb$.
\end{theorem}
\begin{proof}[Proof sketch]
If $\Pi$ satisfies $\ExpEVVSymb$, then no one can construct a ballot that appears to be associated with public credential $\pk$ unless they know private credential $\sk$.
That means that a voter can uniquely identify their ballot, because no one else knows their private credential. Therefore $\Pi$ satisfies $\ExpIVVSymb$.
\end{proof}
\noindent A proof of Theorem~\ref{thm:EVImpliesIV} appears in \refappendix{\ref{app:EVIVproof}}.
\begin{table}
\begin{center}
\begin{tabular}{c|ccc|l}
Line & IV & UV & EV & Scheme \\ \hline
1 & \xmark & \xmark & \xmark & $\AlwaysVerify(\IgnoreCreds(\Choice))$\\
2 & \xmark & \xmark & \cmark & ---\\
3 & \xmark & \cmark & \xmark & $\IgnoreCreds(\Choice)$\\
4 & \xmark & \cmark & \cmark & ---\\
5 & \cmark & \xmark & \xmark & $\AlwaysVerify(\IgnoreCreds(\Nonce))$\\
6 & \cmark & \xmark & \cmark & $\AlwaysVerify(\Sign\ifsigconstruction(\Choice)\fi)$\\
7 & \cmark & \cmark & \xmark & Malleable $\Sign\ifsigconstruction(\Choice)\fi$\\
8 & \cmark & \cmark & \cmark & $\Sign\ifsigconstruction(\Choice)\fi$
\end{tabular}
\end{center}
\caption{Election schemes that satisfy each combination of individual, universal and eligibility verifiability\label{tab:evia-orthogonal}}
\end{table}
In Table~\ref{tab:evia-orthogonal}, $\AlwaysVerify(\cdot)$ is a function that transforms an election scheme by compromising $\VerifySymb$ to always return 1.
Thus, $\AlwaysVerify(\Pi)$ is guaranteed not to satisfy $\ExpUVVSymb$.
Similarly, $\IgnoreCreds(\cdot)$ is a function that accepts as input an election scheme with external authentication and returns as output an election scheme with internal authentication.
The resulting scheme, however, simply ignores credentials altogether:
$\RegisterSymb$ returns $(\bot,\bot)$, $\VoteSymb$ ignores $\sk$, and $\TallySymb$ and $\VerifySymb$ ignore $\electoralroll$.
Thus, $\IgnoreCreds(\Pi)$ is guaranteed not to satisfy $\ExpEVVSymb$.
Using those functions, we briefly explain each line of the table:
\begin{enumerate}
\item
Recall (from~\S\ref{sec:orthogonal:ext}) that $\Choice$ is the election scheme in which ballots contain only the plaintext candidate choice.
By compromising $\VerifySymb$ and ignoring credentials, we obtain a scheme that satisfies no properties.
\item
By Theorem~\ref{thm:EVImpliesIV}, this situation is impossible.
\item
Compared to line 1 of Table~\ref{tab:evia-orthogonal}, this scheme satisfies $\ExpUVVSymb$, because $\VerifySymb$ is not compromised.
\item
By Theorem~\ref{thm:EVImpliesIV}, this situation is impossible.
\item
$\Nonce$ satisfies $\ExpIVSymb$ and $\ExpUVSymb$.
Moreover, $\IgnoreCreds(\Nonce)$ satisfies $\ExpIVVSymb$ and $\ExpUVVSymb$.
By compromising $\VerifySymb$, we obtain a scheme that satisfies only $\ExpIVVSymb$.
\item
$\Sign\ifsigconstruction(\Choice)\fi$ satisfies all three properties. By compromising $\VerifySymb$, we obtain a scheme that satisfies only $\ExpIVVSymb$ and $\ExpEVVSymb$.
\item
By making $\Sign\ifsigconstruction(\Choice)\fi$'s underlying signature scheme malleable,\footnote{Given a message $m$ and signature $\sigma$,
a \emph{malleable} signature scheme
permits computation of a signature $\sigma'$ on a related message $m'$~\cite{Chase14:MalleableSign}.
The malleable signature scheme $\Sign\ifsigconstruction(\Choice)\fi$ used in line 7 of Table~\ref{tab:evia-orthogonal} would need to enable an adversary to transform a signature on a well-formed candidate $\beta$ into a signature on a distinct, well-formed candidate $\beta'$.}
we could obtain a scheme that does not satisfy $\ExpEVVSymb$, because the adversary could construct a valid ballot out of a revealed ballot.
But the scheme would continue to satisfy $\ExpIVVSymb$ and $\ExpUVVSymb$.
\item
$\Sign\ifsigconstruction(\Choice)\fi$ satisfies all three properties.
\end{enumerate}
\onceAfalse
%%%\input{sig}
\ifheliosc
% !TEX root = main-jcj-ev.tex
```
# Case Study: Helios-C
Helios-C (**Cortier14:verifiability?**; **Cortier14:verifiabilityTech?**) is a variant of Helios (cf. §[sec:helios]) for two-candidate elections in which ballots are digitally signed. Informally, Helios-C works as follows (**Cortier14:verifiability?**):
- **Setup.** As in Section [sec:helios].
- **Registration.** To register a voter, the registrar generates a key pair for a signature scheme and sends the private key to the voter. After all voters are registered, the registrar publishes electoral roll $\electoralroll$.
- **Voting.** A voter generates a ciphertext and proof as in Section [sec:helios], signs the ciphertext and proof with their private key, and posts their public key, ciphertext, proof, and signature on the bulletin board.
- **Tallying.** The tallier aborts if any ballots on the bulletin board are not signed by distinct private keys whose corresponding public keys appear in $\electoralroll$. The tallier also aborts if there exists a proof on the bulletin board that does not hold. The ciphertexts and proofs are processed as in Section [sec:helios].
- **Verification.** If the tallier aborted, then a verifier immediately accepts. Otherwise, the tallier recomputes the homomorphic combination and checks all the zero-knowledge proofs, as in Section [sec:helios].
Whilst analyzing Helios-C, we discovered that aborting violates our definition of universal verifiability. In particular, an adversary could post an ill-formed ballot on the bulletin board. (For example, a malicious tallier could secretly tally the recorded ballots while the election is in progress and, if that tally is unfavorable to the tallier’s preferred candidate, then the tallier could post an ill-formed ballot on the bulletin board.) That ballot will cause tallying to abort. And verifiers will accept that abort. Yet, our definition of universal verifiability demands that verifiers only accept outcomes representing all the choices used to construct the recorded ballots, which aborting violates. Thus, Helios-C does not satisfy our definition of universal verifiability.[^11]
**Remark 1**. *Helioc-C does not satisfy $\EVIA$.*
Helios-C aborts on errors in a manner that violates universal verifiability, as described above.
An informal proof of Remark 1 follows immediately from our discourse and we do not pursue a formal proof. A variant of Helios-C that disregards ill-formed ballots should satisfy our definition of universal verifiability.
Cortier et al. (**Cortier14:verifiability?**) analyzed Helios-C using a different definition of universal verifiability. That definition can be satisfied by schemes in which tallying aborts in a manner that anyone will accept. In particular, the experiment used by that definition cannot be won by an adversary that causes an abort. (As discussed above, this is undesirable, because an adversary might cause an abort when an election is unfavorable for the adversary.) Thus, verifiers accept outcomes that do not include the choices used to construct voters’ ballots. By comparison, our definition demands that verifiers reject such outcomes.
Beyond verifiability, Quaglia & Smyth (**2018-voting-authentication?**) discovered that Helios-C does not satisfy ballot secrecy (in the presence of an adversary that controls the bulletin board or communication channel). They realised that proving correct signature construction suffices for ballot secrecy and proposed a generic construction for election schemes with internal authentication from schemes with external authentication. Moreover, they proved that their construction produces schemes satisfying ballot secrecy and verifiability.
# Case Study: JCJ
**\[tex2md\] this section could not be converted; its LaTeX follows verbatim:** `Error at (line 539, column 15): unexpected end of input \end{document} ^`
``` latex
\section{Case Study: JCJ}
\label{sec:civitas}
\weakeligfalse
JCJ (named for its designers, Juels, Catalano, and Jakobsson)~\cite{JCJ02,JCJ05,JCJ10} is a \emph{coercion-resistant} election scheme,
meaning voters cannot prove whether or how they voted, even if they can interact with the adversary while voting, which protects elections from improper influence by adversaries.
JCJ was the first scheme to achieve coercion resistance and has been influential in the design of many subsequent schemes.
%Civitas~\cite{CCM08,CCM08b} is an open-source electronic voting system.\footnote{\url{https://www.cs.cornell.edu/projects/civitas/}}
%It is the first implementation of a \emph{coercion-resistant}\cite{DKR08,JCJ10,Kusters12:CoercionResistance} remote electronic voting system,
%meaning voters cannot prove whether or how they voted, even if they can interact with the adversary while voting.
%Coercion resistance protects elections from improper influence by adversaries.
%Civitas refines and implements an election scheme developed by Juels, Catalano, and Jakobsson~\cite{JCJ02,JCJ05,JCJ10}.
%We refer to that scheme as \emph{JCJ}.
To achieve verifiability and coercion resistance, JCJ uses verifiable \emph{mixnets}, which anonymize a set of messages.%
\footnote{Chaum~\cite{Chaum81:Mixnets} introduced mixnets. Adida~\cite{BenAdidaThesis} surveys verifiable mixnets.}
During tallying, all encrypted choices are anonymized by a mixnet, then all choices are decrypted.
The tally is computed from the decrypted choices.
Informally, JCJ works as follows:
\begin{itemize}
\item \textbf{Setup.}
The tallier generates a key pair %$(\PKT,\SKT)$
for an encryption scheme and
publishes the public key.%\footnote{JCJ permits the tallier's role to be distributed amongst several talliers. For simplicity, we consider only a single tallier in this paper.}
\item \textbf{Registration.}
To register a voter, the registrar generates a nonce,
which is sent to the voter and serves as the private credential.
The public credential is computed as an encryption of the private credential with %$\PKT$.
the tallier's public key.
After all voters are registered, the registrar publishes the electoral roll.
\item \textbf{Voting.}
A voter encrypts their candidate choice with %$\PKT$.
the tallier's public key.
They also encrypts their private credential with %$\PKT$.
the tallier's public key.
The voter proves in zero-knowledge that they simultaneously knows both plaintexts, and that their choice is well-formed.
The voter posts their ballot (i.e., both ciphertexts and the proof) on the bulletin board.
\item \textbf{Tallying.}
The tallier discards any ballots from the bulletin board for which the zero-knowledge proofs do not verify.
All unauthorized ballots are then discarded through a combination of protocols that includes verifiable mixnets and \emph{plaintext equivalence tests} (PETs)~\cite{Jakobsson00}.
(A PET enables a proof that two ciphertexts contain the same plaintext without revealing that plaintext.)
In particular, the tallier mixes the ciphertexts in the ballots (i.e.,
the encrypted choices and the encrypted credentials), using the same secret permutation
for both mixes, hence, the mixes preserve the relation between encrypted choices and
encrypted credentials. The tallier also mixes the public credentials published by the registrar.
And discards any mixed encrypted choice if a PET does not hold
between the corresponding encrypted credential and a mixed
public credential---i.e.,
ballots cast using ineligible credentials are discarded.
Finally, the tallier decrypts the remaining encrypted choices
and publishes the corresponding tally, along with a proof that decryption was performed correctly.
\begin{comment} %%%% The following is too long-winded.
\review{
First, the tallier discards any ballots from the bulletin board for which the zero-knowledge proofs do not verify.
Secondly, the tallier performs pairwise \emph{plaintext equivalence tests}%
\footnote{PETs enable proof that two ciphertexts contain the same plaintext without revealing that plaintext.}
(PETs)~\cite{Jakobsson00} on the encrypted credentials and discard any
ballots for which a test holds---i.e., ballots using the same credential are discarded.%
\footnote{JCJ defines discarding ballots in accordance with a revoting
policy~\cite[\S4.1]{JCJ10}. However, we have shown that JCJ fails to satisfy universal verifiability when the policy proposed by Juels et al. is adopted
(\S\ref{sec:def:uvv}). So, we consider a policy that discards ballots using
the same credential---i.e., choices by voters that cast multiple ballots will be
discarded.}
Thirdly, the tallier mixes the ciphertexts in the ballots (i.e.,
the encrypted choices and the encrypted credentials),
using the same secret permutation for both mixes, hence, the mix
preserves the relation between encrypted choices and credentials.
The tallier also mixes the public credentials published by the registrar.
Fourthly,
the tallier discards any encrypted choice if a PET does not hold
between the corresponding encrypted credential and a mixed
public credential---i.e.,
ballots cast using ineligible credentials are discarded.
Finally, the tallier decrypts and publishes the remaining encrypted choices,
along with a proof that decryption was performed correctly.
}
\end{comment}
% MRC: The level of detail in what follows is unnecessary for readers of the main body of the paper.
%\begin{enumerate}
% \item{\it Remove invalid ballots:} The talliers discard any ballots from the bulletin board
% for which proofs do not hold.
%
% \item{\it Eliminating duplicates:} The talliers perform pairwise plaintext equality
% tests\footnotemark\ (PETs) on the encrypted credentials and discard any
% ballots for which a test holds, that is, ballots using the same credential are discarded.
%
%\footnotetext{A plaintext equality test is a cryptographic predicate which allows a key holder to provide a proof that two ciphertexts contain the same plaintext, without revealing that plaintext to anyone.}
%
% \item{\it Mixing:} The talliers mix the ciphertexts in the ballots (i.e.,
% the encrypted choices and the encrypted credentials),
% using the same secret permutation for both mixes, hence, the mix
% preserves the relation between encrypted choices and credentials. Let $\bf C_1$ and $\bf C_2$ be the vectors output by these mixes.
% The talliers also mix the public credentials published by the registrars. Let $\bf C_3$ be the vector output by this mix.
%
% \item{\it Remove ineligible ballots:}
% The talliers discard ciphertexts ${\bf C_1}[i]$ from ${\bf C_1}$ if there is no ciphertext $c$
% in ${\bf C_3}$ such that a PET holds for $c$ and ${\bf C_2}[i]$,
% that is, ballots cast using ineligible credentials are discarded.
%
% \item{\it Decrypting:} The talliers decrypt the remaining encrypted choices in ${\bf C_1}$ and prove that
% decryption was performed correctly.
% The talliers identify the winning candidate from the decrypted choices.
%\end{enumerate}
\item \textbf{Verification.}
A verifier checks all the proofs included in ballots, and all the proofs published during tallying.
\end{itemize}
We formalize a generic construction for JCJ-like election schemes (\refappendix{\ref{sec:jcj-construction}}),
which we instantiate to derive a formal description of JCJ (\refappendix{\ref{app:JCJ}}).
Whilst analyzing \JCJ, we discovered that the mixes are insufficient for universal
verifiability, because a verifier cannot distinguish between mixes that preserve
the relation between encrypted choices and encrypted credentials, and mixes that
do not. In particular, the proofs associated with mixes only prove a mapping between
the ciphertexts input and those output. Thus, there is no proof that the relation
between encrypted choices and encrypted credentials is maintained during mixing.
As such, authorized ballots
might be discarded in favour of unauthorized ballots, and the tally will include
choices from those unauthorized ballots. Hence, universal verifiability is not satisfied.
%\Refappendix{\ref{sec:jcj-construction}} gives a formal description of JCJ.
%That formalization satisfies individual and universal verifiability, assuming that the cryptographic primitives satisfy certain properties that we identify.
%But the formalization fails to satisfy eligibility verifiability,
\JCJ\ does not satisfy eligibility verifiability either,
because knowledge of the tallier's private key %$\SKT$
suffices to construct ballots that appear authentic: with %$\SKT$,
the private key, any public credential can be decrypted to discover the corresponding private credential.
(Note that experiment $\ExpEVVSymb$ permits an adversary %$\adv$
to choose the tallier's key pair, so %$\adv$ does know $\SKT$
the adversary knows the private key,
hence can construct a ballot that suffices to win $\ExpEVVSymb$.)
\begin{proposition}\label{prop:jcj}
\JCJ\ does not satisfy $\EVIA$.
\end{proposition}
\begin{proof}[Proof sketch]
As described above,
\JCJ\ accepts tallies which exclude authorized ballots in
favour of unauthorized ballots.
Thus, universal verifiability is not satisfied.
Moreover, an adversary can cast unauhorized ballots.
Thus, eligibility verifiability is not satisfied.
\end{proof}
\noindent
A formal proof of Proposition~\ref{prop:jcj} appears in \refappendix{\ref{app:JCJattack}}.
That proof shows that universal verifiability is not satisfied.
We have reported these findings to the original authors.\footnote{Dario Catalano, email communication, 30 November 2016.}
%\section{Generalized JCJ Scheme II}
%\label{sec:jcj-construction-B}
%\Refappendix{\ref{sec:jcj-construction}} gives a formal description of JCJ
%\review{a variant of JCJ that proves mixing preserves the relation between encrypted
%choices and credentials}.
%That formalization satisfies individual and universal verifiability, assuming that the cryptographic primitives satisfy certain properties that we identify.
%But the formalization fails to satisfy eligibility verifiability,
%\JCJ\ fails to satisfy eligibility verifiability too,
%because knowledge of the tallier's private key $\SKT$ suffices to construct ballots that appear authentic: with $\SKT$, any public credential can be decrypted to discover the corresponding private credential.
%Note that $\ExpEVVSymb$ permits an adversary $\adv$ to choose the tallier's key pair, so $\adv$ does know $\SKT$ hence can construct a ballot that suffices to win $\ExpEVVSymb$.
We can nonetheless prove that \JCJ\ satisfies a variant of eligibility verifiability. Consider the following experiment, which does not permit the adversary to choose the tallier's key pair:
\weakeligtrue
% !TEX root = main-jcj-ev.tex
\begin{inlineexperiment}{\ifweakelig$\ExpEVVWeak$\else$\ExpEVV$\fi}
\ifweakelig
$(\PKT,\SKT,\mB,\mC) \leftarrow \Setup[k]$\;
$n_V \leftarrow \adv(\PKT,k)$\;
\else
$(\PKT,n_V) \leftarrow \adv(k)$\;
\fi
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge \sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\begin{comment}
\begin{inlineexperiment}{$\ExpEVV$}
$(\PKT,n_V) \leftarrow \adv(k)$\;
\lFor{$1 \leq i \leq n_V$}{$(\pk_i,\sk_i) \leftarrow \Register[\PKT,k]$}\;
$\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
$\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
$(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
\eIf{$\exists r \mathrel :
b=\Vote[\sk_i,\PKT,n_C,\beta,k; r]
\mathrel\wedge b \not= {\perp}
\mathrel\wedge b\not\in \mathit{Rvld}
\mathrel\wedge sk_i \not\in \mathit{Crpt}$
} {
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
\end{comment}
\noindent
\ifonceA
\ifweakelig
In line 1 of $\ExpEVVWeakSymb$, keys are generated by the experiment. In line 2, $\adv$ is given the public key but not the private key.
\else
In line 1, $\adv$ chooses the tallier's public key and the number of voters.
\fi
Line \ifweakelig3\else2\fi\ registers voters. %\footnote{\review{$\ExpEVVSymb$ can be equivalently formulated as an experiment with one registered voter. See \refappendix{\ref{sec:evalt}} for details.}}
$\adv$ is not permitted to influence registration while it is in progress.
%\footnote{K\"usters and Truderung~\cite{Kusters09:CoercionResistance} explore some consequences of permitting adversarial influence during registration.} %%%MOVE EARLIER
In particular, $\adv$ is not permitted to choose credential pairs, because by doing so $\adv$ could trivially win the experiment.
Line \ifweakelig5\else4\fi\ initializes two sets: $\mathit{Crpt}$ is a set of voters who have been corrupted, meaning that $\adv$ has learned their private credential, and $\mathit{Rvld}$ is a set of ballots that have been revealed to $\adv$.
The former set models $\adv$ coercing voters to reveal their private credentials.
The latter set models $\adv$ observing ballots on the bulletin board.
Line \ifweakelig6\else5\fi\ challenges $\adv$ to produce a ballot $b$ with the help of two oracles.
Oracle $\corruptOracle$ is the same oracle as in $\ExpIVVSymb$ (cf.~\S\ref{sec:def:ivv});
it leaks the private credentials of corrupted voters to $\adv$.
Oracle $\revealOracle$ reveals ballots.
On invocation $\revealOracle(i,\beta, \allowbreak n_C)$, where $1\leq i \leq n_V$,
oracle $\revealOracle$ does the following:
\begin{itemize}
\setlength{\itemsep}{0pt}
\item Computes a ballot $b$ that represents a vote for candidate $\beta$ by a voter with private credential $\sk_i$, that is, computes $b \leftarrow \Vote[\sk_i,\PKT,n_C,\beta,k]$.
\item Records $b$ as being revealed by updating $\mathit{Rvld}$ to be $\mathit{Rvld} \cup \{b\}$.
\item Outputs $b$.
\end{itemize}
In line \ifweakelig7\else6\fi, $\adv$ wins if (i) the ballot is \emph{authentic}, meaning that it is the output of $\VoteSymb$ on an authorized credential, and (ii) that credential belongs to a voter that $\adv$ did not corrupt, %
%\footnote{$\ExpEVVSymb$ can equivalently be formulated as an experiment that challenges $\adv$ to produce a ballot for a specified voter, rather than permitting $\adv$ to choose from among all the registered voters; see \refappendix{\ref{sec:intEV1}} for details.}
and (iii) that ballot was not revealed.
%Furthermore, $n_C$ must be bounded by a polynomial $q$.
If $\adv$ cannot succeed in this experiment, then only authorized votes are tallied.
\else
Line 1 of $\ExpEVVSymb$ has been refactored into lines 1 and 2 of $\ExpEVVWeakSymb$. In line 1 of $\ExpEVVWeakSymb$, keys are generated by the experiment. In line 2, $\adv$ is given the public key but not the private key.\footnote{$\ExpEVVWeakSymb$ can be equivalently formulated as an experiment with one registered voter. See \refappendix{\ref{sec:evalt}} for details.}
\fi
%\footnote{Similarly to $\ExpEVVSymb$, $\ExpEVVWeakSymb$ can equivalently be formulated as an experiment that challenges $\adv$ to produce a ballot for a specified voter. See \refappendix{\ref{sec:intEV1}} for details.
%\mrc{That appendix seems to have gone away. What should happen with this footnote?}
%\steven{I suggest removing the footnote. The variant of $\ExpEVVSymb$ is gone, and the variant of $\ExpEVVWeakSymb$ is only used in the JCJ proof. We also aren't sure whether they are equivalent in the general case anymore.}}
%\noindent\review{
%$\ExpEVV=$
%\begin{algorithmic}[1]
% \STATE $(\PKT,Q,n_V) \leftarrow \adv(k)$\;
% \FORALL{$1 \leq i \leq n_V$}
% \STATE $(\pk_i,\sk_i) \leftarrow \Register[\PKT,Q,k]$\;
% \ENDFOR
% \STATE $\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$\; %\tcp{set of voters' public keys}
% \STATE $\mathit{Crpt}\leftarrow\emptyset;~\mathit{Rvld}\leftarrow\emptyset$\;
% \STATE $(n_C,\beta,i,b)\leftarrow \adv^{\corruptOracle,\revealOracle}(\electoralroll)$\;
% \IF{$\exists r \mathrel :
% b=\Vote[\sk_i,\PKT,Q,n_C,\beta,k; r]
% \mathrel\wedge b \not= \perp
% \mathrel\wedge b\not\in \mathit{Rvld}
% \mathrel\wedge sk_i \not\in \mathit{Crpt}$}
% \STATE \Return 1
% \ELSE
% \STATE \Return 0
% \ENDIF
%\end{algorithmic}
%}
%\steven{This experiment does not capture the following sort of attack: $\adv$ outputs a $\sk_i\not\in\mathit{Crpt}$ and a $b\in\mathit{Rvld}$ such that $b$ was added to $\mathit{Rvld}$ on a query for a different secret key $\sk_j$. To fix this we could instead have sets $\mathit{Rvld}_i$ where a ballot $b$ is added to $\mathit{Rvld}_i$ on query $R(i,\beta,n_C)$. Then the if statement would check that
%$b\not\in\mathit{Rvld}_i$.}
%\mrc{BEGIN Ben's experiment:}
%
%\begin{inlineexperiment}{$\ExpEVV$}
% $(PK_T, \SKT, Q)\leftarrow \SetupSymb(k)$;\\
% $(pk,sk) \leftarrow \Register[\PKT,Q,k]$\\
% $B\leftarrow\emptyset;$\\
% $b\leftarrow \adv^{\oracleSymb^*}(pk,\PKT, Q, k)$;\\
% \eIf{$\exists n_C,\beta,r \mathrel .
% b=\Vote[\sk,\PKT,Q,n_C,\beta,k; r]
% \wedge 1 \leq \beta \leq n_C
% \wedge b\not\in B \cup \{\perp\}$} {
% \Return 1
% }{
% \Return 0
% }
%\end{inlineexperiment}
%\noindent The experiment uses oracle $\oracleSymb^*$ such
%that: $\oracleSymb^*(n_C,\beta)$ computes
%$b\leftarrow\Vote[\sk,\PKT,Q,n_C,\beta,k]; B\leftarrow B \cup \{b\}$
%and outputs $b$, where $1\leq\beta\leq n_C$.
%
%\mrc{END Ben's experiment.}
We propose a variant of our generic construction for JCJ-like schemes (\refappendix{\ref{sec:jcj-construction-B}}).
That variant proves the mixes preserve the relation between encrypted choices and encrypted credentials.
Using $\ExpEVVWeakSymb$, we define a weaker variant of $\EVIA$ and prove that
instantiations of our construction satisfy it.
\begin{definition}[$\EVIAWeak$]\label{exp:evweak}
An election scheme $\Pi$ satisfies \emph{weak election verifiability with internal authentication} $($\EVIAWeak$)$ if
Completeness and Injectivity are satisfied and
for all PPT adversaries $\adv$,
there exists a negligible function $\mu$, such that for all security parameters $k$, we have
$\SuccIVV + \SuccUVV + \SuccEVVWeak \leq \mu(k)$.
\end{definition}
\noindent
An election scheme satisfies \emph{weak eligibility verifiability} if
$\SuccEVVWeak\leq \mu(k)$.
Let \JCJnext\ be the set of election schemes derived from the variant of our
generic construction, assuming cryptographic primitives satisfy certain
properties that we identify.\footnote{A set of election schemes satisfies $\EVIAWeak$, if every scheme in the set satisfies $\EVIAWeak$.}
\begin{theorem}\label{thm:jcj}
\JCJnext\ satisfies $\EVIAWeak$.
\end{theorem}
\begin{proof}[Proof sketch]
\JCJnext\ satisfies individual verifiability, because the probabilistic encryption scheme ensures that ballots are unique, with overwhelming probability.
\JCJnext\ satisfies universal verifiability, because the proofs produced throughout tallying can be publicly verified.
And \JCJnext\ satisfies eligibility verifiability, because $\adv$ cannot construct new ballots without knowing a voter's private credential or the tallier's private key.
\end{proof}
\noindent A formal proof of Theorem~\ref{thm:jcj} appears in \refappendix{\ref{sec:jcj-proof}}.
The proof assumes the random oracle model.
The Civitas~\cite{CCM08} scheme refines the JCJ scheme.
Some refinements relevant to election verifiability are an implementation of a distributed registration protocol, and a mixnet based on randomized partial checking (RPC)~\cite{Jakobsson02}.
%\footnote{Civitas differs from JCJ in one other way: Civitas places voters into virtual precincts called \emph{blocks}. Blocking is insignificant for our analysis of election verifiability.}
%Other than those three refinements, the election verifiability of Civitas follows directly from the election verifiability of JCJ.
We leave a proof that Civitas satisfies $\EVIAWeak$ as future work.
\iftr
In that proof, it would be necessary to assume the RPC construction satisfies the definition of mixnets given in the appendix. Work by Khazaei and Wikstr\"om~\cite{Khazaei13} suggests that actually proving satisfaction is unlikely to be possible. Alternatively, the mixnet could be replaced by one based on zero-knowledge proofs~\cite{Furukawa01:Mixnet,Neff01:Mixnet}.
\fi
%It follows from our proof of Theorem~\ref{thm:jcj} that Civitas also satisfies election verifiability:
%\begin{theorem}\label{thm:civitas}
%Civitas without distributed registration satisfies $\EVIAWeak$.
%\end{theorem}
%\noindent A formal proof of Theorem~\ref{thm:civitas} appears in \refappendix{\ref{sec:jcj-proof}}.
%\input{ev3}
\ifincludegv\IfFileExists{gv.tex}{
%\section{Election and global verifiability coincide}
%\ben{The section header needs work, given that they don't coincide}
```
# Comparison with global verifiability
**\[tex2md\] this section could not be converted; its LaTeX follows verbatim:** `Error at (line 583, column 1): unexpected } expecting \end{document} ^`
``` latex
\section{Comparison with global verifiability}
\label{sec:global-verifiability}
\ben{Do K\"usters et al. capture cast as intended? I'm not convinced.
Clearly the goal we formalise does not.}
K\"usters et al.~\cite{Kusters10,Kusters11:UniversalVerifiability,Kusters12:ClashAttacks}
present a definition of global verifiability
that can be used with any kind
of protocol, not just electronic voting protocols.
To analyze the verifiability of a protocol,
analysts must define \emph{goals}, which are properties required to hold in
%\sout{every run of the protocol, when auditing succeeds}
runs of the protocol.
For example, a goal
$\gamma_\ell$ is presented in a case study~\cite[\S5.2]{Kusters11:UniversalVerifiability} of global verifiability applied
to voting:
\begin{quote}
$\gamma_\ell$ contains all runs for which there exist choices
of the dishonest voters (where a choice is either to abstain or to vote for one of the candidates)
such that the result obtained together with the choices made by the honest voters in this run differs
only by $\ell$ votes from the published result (i.e.\ the result that can be computed from the simple
ballots on the bulletin board).
\end{quote}
Another goal $\gamma$ is presented in a case study~\cite[\S6.2]{Kusters12:ClashAttacks} of Helios:
\begin{quote}
$\gamma$ is satisfied in a run if the published result exactly reflects the
actual votes of the honest voters in this run and
votes of dishonest voters are distributed in some
way on the candidates, possibly in a different way
than how the dishonest voters actually voted.
\end{quote}
\noindent
These informal statements of goals are appealing, but they do not constitute rigorous mathematical definitions.
As Kiayias et al.\ write, ``[global verifiability] has the disadvantage that the set $\gamma$ remains undetermined and thus the level of verifiability that is offered by the definition hinges on the proper definition of $\gamma$ which may not be simple''~\cite[p.~476]{Kiayias15}.
In our own work, we found that formal definitions were quite tricky to get right---for example, which ballots should be counted, how to count them, and how to determine whether that count differed from the published tally.
%\ben{The following justifies why we can't use the goal formalized by Ralf. Strictly speaking, it could be excluded. As could Appendices~\ref{app:def:goal:gv} \&~\ref{sec:gv-unsatisfiable-goals}. Albeit, we open ourselves up to criticism for not using his definition of a goal.}
So we shared\footnote{Ralf K{\"u}sters, email communication, 24 June 2014.} and discussed\footnote{Ralf K{\"u}sters, email communication, October/November 2014.} our results with
K\"usters. In response, K\"usters et al. updated their technical report to
propose a
formal goal~\cite[\S5.2]{Kusters10b}.
In essence, that goal is satisfied in a run
if choices $\beta_1,\dots,\beta_{n_h}$ of honest voters are included in
the tally and the tally contains at most $n_h + n_d$ choices, where $n_d$
is the number of dishonest voters.
We found that \heliosnext\ and $\mathsf{Nonce}$
do not satisfy global verifiability with that goal,
because the goal requires: 1) participation of all voters,
2) ballot posting to always succeed, and
3) bulletin boards not to drop, inject nor modify ballots.
The first and second requirements define availability properties,
which an adversary can disrupt. And the third can be disrupted
by an adversary that controls the bulletin board.
Thus, there exist runs of both \heliosnext\ and $\mathsf{Nonce}$
that cannot satisfy this goal.
We defer definitions of global verifiability and the goal by
K\"usters et al. to Appendix~\ref{sec:gv}, and formal results
to~\refappendix{\ref{app:def:goal:gv}}, because
the above discussion can be appreciated without the burden of
%further definitions.
technical details.
Cortier et al.~\cite[\S10.2]{Cortier16:VerifiabilitySoK} propose a variant
of the goal by K\"usters et al.~\cite[\S5.2]{Kusters10b}. Their goal is
informally claimed to permit some honest voters'
choices to be dropped from the tally, which would intuitively address
problems associated with the third requirement. However, this claim
is not supported by their formally stated goal, because the goal requires the tally to
include $n_h + n_d$ choices, where $n_h$, respectively $n_d$, is the
number of honest, respectively dishonest, voters. Thus, the goals
by Cortier et al. and K\"usters et al. have similar drawbacks.
We omit recalling further details, because the ideas remain the same.
We reported our findings to Cortier et al. and
K\"usters et al.,%
\footnote{Veronique Cortier, David Galindo, Ralf K\"usters, Johannes M\"uller,
Tomasz Truderung, \& Andreas Vogt, email communication, 18 Oct 2016.}
but they did not respond.
We reported our findings again,%
\footnote{Ralf K\"usters \& Johannes M\"uller, email communication, 25 Apr 2018.}
which resulted in confirmation of the error,%
\footnote{Johannes M\"uller, email communication, 22 May 2018.}
but no fix is yet public.
\begin{comment}
We summarise those details below. Formal results
are deferred to~\refappendix{\ref{sec:gv}}, because
the following discussion can be appreciated without the burden of
further definitions.
\begin{enumerate}
\item The goal requires the tally to
contain a choice for each voter, but a voter may decide not to cast a ballot,
%%NB: There are several types of abstention (e.g., not voting and voting for an
%%abstention candidate a la Helios), so don't mention abstention here.
hence, a choice for each voter should not be expected.
\item The goal requires the tally to include all the
choices of honest voters that cast ballots, but an honest voter's choice
need be included only if their ballot is recorded on the bulletin board,
hence, the inclusion of all honest voters' choices should not be expected.
(Our definitions
require the tally to include all the choices of honest voters whose
ballots were recorded.)
\mrc{I'm not following that paragraph. How can votes fall in limbo in
between being cast and being recorded? Is there some inbetween stage we've failed to model?}
\ben{Casting a ballot gives no assurance of that ballot being recorded.
To get assurance, you simply need to check that the ballot is recorded.
Thus, requiring ``the tally to include all the choices of honest voters that cast ballots"
is too strong, this only holds if those voters check that the bulletin board
contains their ballot. This aspect is captured in our goal $\gv$, because
we consider all the ballots $b_1,\dots,b_{n}$ in the run that
are included on the bulletin board.}
\ben{Recorded-as-cast doesn't help. As I have written elsewhere
(\url{ia.cr/2015/942}), it is worth noting that recorded-as-cast
appears to be unsatisfiable:
``an adversary that can intercept ballots can always prevent the collection of
ballots. Nevertheless, the definition of recorded-as-cast is informal,
thus ambiguity should be expected and some interpretation of the definition
should be satisfiable."}
\ben{Michael and I discussed the issue of \emph{availability}. We could
revise the discussion to include something on availability.}
\end{enumerate}
\noindent
By assuming all voters must vote
\ben{This is unrealistic, because dishonest voters---i.e., those controlled
by the adversary---won't vote. Albeit, perhaps an Australian dishonest voter would
vote, for fear of being fined.}
and cast ballots are recorded,
\heliosnext\ and $\mathsf{Nonce}$ probably
do satisfy global verifiability with the goal
by K{\"u}sters et al.~\cite[\S5.2]{Kusters10b}.
Nevertheless, these assumptions are undesirable.
And an alternative goal for which global verifiability
can be satisfied, without such assumptions, would be useful.
\end{comment}
\begin{comment}
\ben{I've added the following paragraph in response to Michael's request,
but I suspect it is too premature to include at this stage. In particular,
I don't think Michael nor Steven have had sufficient time to study the
underlying theory.}
\review{
We shared\footnote{Ralf K{\"u}sters, email communication, 24 June 2014.} and discussed\footnote{Ralf K{\"u}sters, email communication, October/November 2014.} our results with
K\"usters. In response, K\"usters et al.\ updated their technical report to propose a
formalization of goals~\cite[\S5.2]{Kusters10b}. This formalization contains properties
which are not necessary for verifiability:}
\begin{enumerate}
\item \review{The tally \sout{published in a run} must
contain a choice for each voter, but a voter may decide not to cast a ballot,
%%NB: There are several types of abstention (e.g., not voting and voting for an
%%abstention candidate a la Helios), so don't mention abstention here.
hence, we should not expect a choice for each voter.}
\item \review{The tally must include all the
choices of honest voters that cast ballots, but an honest voter's choice
need only be included if their ballot is recorded on the bulletin board,
hence, we should not expect the inclusion of all honest voters' choices.
\review{
(Our definitions
require the tally to include all the choices of honest voters whose
ballots were recorded.)}
}
\end{enumerate}
\steven{I'm having trouble understanding point 2. That sounds like individual verifiability to me - if an honest, participating voter makes a choice and that choice isn't included in the tally because the ballot doesn't appear on the bulletin board, IV shouldn't be satisfied, and therefore neither should GV.}
\ben{If you don't understand, then nor will the reader; some rewriting is necessary.
The point is rather subtle: the statement that \emph{IV shouldn't be satisfied} is true in the sense that voters should be able to detect this attack, but the IV experiment should still be satisfiable. Indeed, this is precisely what IV is intended to handle: voters can determine \emph{whether} their vote has been included. Any experiment representing IV should allow for the case that a ballot is not present, as long as the voter is aware. Goal GV does not. Thus, it is unsatisfiable.}
\mrc{I don't feel like I understand either point very well. I'm also concerned
about critiquing an unpublished, non-peer-reviewed TR---it's a moving target.}
\noindent \review{Consequently, their definition is not satisfied by
voting systems that are intuitively verifiable.} \ben{Perhaps advertise that this
further demonstrates that getting the definitions right is tricky.}
\end{comment}
It is natural to ask whether individual, universal and eligibility verifiability can
each be expressed in terms of global verifiability. We believe they can.
For instance, they could be expressed, in the informal style of the goals quoted above, as the following goals:
\begin{itemize}
\item $G_{\mathit{IV}}$ is satisfied in a run if voters can uniquely identify their ballots on the bulletin board in this run.
\item $G_{\mathit{UV}}$ is satisfied in a run if the correct tally of votes cast by authorized voters in this run is the same as the tally %\sout{produced by algorithm $\TallySymb$}
that algorithm $\VerifySymb$ successfully verifies.
%\steven{Our UV definition doesn't ever use the $\TallySymb$ algorithm, so this doesn't seem right. Maybe we should say ``the reported tally" instead
%of the one ``produced by algorithm $\TallySymb$". The goal should also be satisfied in a run in which the reported tally is not the same as the correct
%tally, but $\VerifySymb$ returns 0.}\ben{Is the revision sufficient?}
\item $G_{\mathit{EV}}$ is satisfied in a run if every ballot tallied in this run was created by a voter in possession of a private credential.
\end{itemize}
%
Cortier et al.~\cite{Cortier16:VerifiabilitySoK,Cortier16:VerifiabilitySoKb} have also expressed goals intended to capture
our definitions of individual and universal verifiability. We discuss their work in
Section~\ref{sec:related}.
\newcommand{\gvProse}{that is satisfied in a run if
ballots $b_1,\dots,b_{n}$ for choices $\beta_1,\dots,\beta_{n}$
appear in the run, such that $b_1,\dots,b_{n}$ are included on the bulletin board
and no further ballots are included, and the run produces a
tally for choices $\beta_1,\dots,\beta_{n}$}
It is also natural to ask whether election verifiability can be
expressed in terms of global verifiability using a single, holistic goal.
Indeed, roughly speaking, it can. We introduce a goal $\gv$ \gvProse.
We show
election verifiability implies global verifiability with that goal.
(Hence, \heliosnext\ and $\Nonce$ satisfy global verifiability
using goal $\gv$.)
We also show that global verifiability implies universal verifiability,
but not individual verifiability, with that goal.
It might seem surprising that individual verifiability is not implied,
\begin{comment}
But global verifiability does not capture attacks against individual
verifiability when the tally is incorrect.
\mrc{That's a claim that is missing evidence.}
Yet, this does not matter, because
anyone can detect when the tally is incorrect.
\mrc{That's not obvious---I can't detect when the tally is incorrect at my local precinct IRL.}
\ben{IRL you can surely just run algorithm $\VerifySymb$, assuming you have a copy of the bulletin board (at your local precinct).}
(Albeit, no one can detect collisions
when the tally is incorrect. \mrc{Even less obvious.})
%\review{However, our definition of individual verifiability guarantees that the voter herself can
%determine whether her ballot was added to the bulletin board. Global verifiability, on the other
%hand, only tells a voter that, in the end, the reported tally was not honestly computed according
%to the choices of all the voters.}
Hence, to summarise,
\begin{itemize}
\item Election and global verifiability both
permit anyone to check whether the tally %of recorded ballots
is properly computed; and
\item Election verifiability permits voters to check whether their ballots are
recorded, whereas global verifiability only permits such checks
when the tally is correct.
\end{itemize}
\end{comment}
but this is a consequence of a technical detail.
In particular, given a goal defining some properties,
global verifiability only requires those properties
to hold on runs in which an auditor (or judge) accepts.\footnote{%
In the context of universal verifiability, an auditor accepts when they are satisfied that
the tally of recorded ballots is computed
properly.
}\
Thus, such properties need not hold on runs in which
an auditor rejects. Yet, this does not matter, because
auditing suffices to detect problems.
To summarise:
\begin{itemize}
\item Election verifiability and global verifiability, using goal $\gv$, both
guarantee that anyone can check whether the tally %of recorded ballots
is properly computed.
\item Election verifiability guarantees that collisions
can be detected on every run of a protocol, whereas
global verifiability using goal $\gv$ only guarantees that collisions
can be detected on runs in which an auditor accepts.
\end{itemize}
Thus, election verifiability is strictly stronger than
global verifiability using goal $\gv$.
\begin{comment}
\steven{I don't understand this sentence.}\ben{I divided the sentence into two. Which bit don't you understand?}
\steven{I understand the first sentence now. The second is still a bit unclear. When you say ``such attacks", do
you mean attacks against IV or UV? Or specifically attacks against IV when the tally is incorrect?}
\ben{In the first sentence I wrote ``global verifiability does not capture attacks against individual verifiability when the tally is incorrect," and use of ``such attacks" in the second sentence is intended to refer to the attacks not captured as per the first sentence. So, I mean ``attacks against IV when the tally is incorrect." If this isn't clear, then we should revise the sentence.}
\steven{Perhaps my confusion is coming from the bit in parentheses - we say that those IV attacks can be detected, because
global verifiability implies UV. The connection between GV implying UV and being able to detect IV attacks is unclear.}
Thus, election verifiability is strictly stronger than
global verifiability using goal $\gv$.
\end{comment}
We defer formal results to~\refappendix{\ref{app:def:goal:new}}.
It is an open problem as to whether election verifiability coincides with
global verifiability for some other goal.
%\review{Independently of our work,
%Cortier et al.~\cite{Cortier16:VerifiabilitySoK,Cortier16:VerifiabilitySoKb}
%propose a goal that is satisfied in a run if .....}
\begin{comment}
In the other direction, it is also natural to ask how global verifiability of
$\gamma_\ell$ or $\gamma$ would compare with election verifiability.
Answering this question seems to require formalizing those goals.
\mrc{Which Kuesters has now done...} \ben{he did badly... see above}
It would likely be possible to refine the informal statements of the goals into formal
statements that are weaker, stronger, or even incomparable to our formal definition
of election verifiability.
\review{Indeed, the formalism in~\cite[\S5.2]{Kusters10b} seem stronger,
because they cannot be satisfied by many voting systems.}
\mrc{That cop out no longer works. We could delete this paragraph. Or,
Ben, do you have any insight about other things we could write, based on
your appendix?} \ben{A revision is perhaps now possible.}
\ben{NB: We haven't mentioned a comparison with the definition of global verifiability
by Kiayias et al.}
\end{comment}
%The question is particularly interesting for $\gamma$, since it was used to analyze Helios.
%In \refappendix{\ref{app:global}}, we formalize $\gamma$ as a cryptographic game (which requires resolving the ambiguity of its English description), and we prove that individual and universal verifiability together imply that formalized goal.
%Therefore, election verifiability is at least as strong as our formalization of $\gamma$.
%\later{
%\review{We shared\footnote{Ralf K{\"u}sters, email communication, 24 June 2014.} and discussed\footnote{Ralf K{\"u}sters, email communication, October/November 2014.} our results with
%K\"usters. In response, K\"usters et al.~\cite[\S5.2]{Kusters10b} propose a formalization of goals.
%These goals cannot be satisfied by \heliosnext\ nor $\Nonce$, so it is unclear whether global
%verifiability can be used to analyze verifiability in practical electronic voting protocols.
%}
%}
\begin{comment}
K\"usters et al.~\cite{Kusters11:UniversalVerifiability} argue that deconstructing verifiability into individual and universal verifiability is insufficient to detect certain attacks involving ill-formed ballots.
But those attacks leave open the possibility that there do exist notions of individual and universal verifiability that would be sufficient.
Indeed, our own definition of universal verifiability rules out attacks based on ill-formed ballots, because $\correcttally$ ensures that tallied ballots are well-formed.
And Cortier et al. claim that their definitions of individual and universal
verifiability also rule out such attacks~\cite[\S1]{cortier2015type}.
\end{comment}
One concern that might be raised is whether there still lurk any ``gaps'' in our
decomposition into individual and universal (and eligibility) verifiability.
Indeed, there might be. But the definition of global verifiability does not rule
out the possibility of gaps, either: any gap in the formal statement of a goal
will lead to a vulnerability.
That is, if the analyst forgets to include some
necessary facet of verifiability when stating the formal goal, then global
verifiability will not detect any attacks against that facet.
Indeed, Cortier et al.~\cite[\S1]{Cortier16:VerifiabilitySoK} state
that some goals have ``severe limitations and weaknesses."
Global verifiability does not guarantee a lack of gaps. Although
we cannot guarantee the absence of gaps either,
we have proved a relationship between election and
global verifiability.
So, any gap in our definition implies the existence of a gap in
the definition of global verifiability using goal $\gv$.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Below is the short comparison to Kuesters
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%K\"usters et al.~\cite{Kusters10,Kusters11:UniversalVerifiability,Kusters12:ClashAttacks}
%present a definition of \emph{global verifiability}
%that can be used with any kind
%of protocol, not just electronic voting protocols.
%To analyze the verifiability of a protocol,
%users of this definition must themselves formalize
%\emph{goals}, which are properties required to hold in
%every run of the protocol.
%We leave a formal comparison between global verifiability and our own
%election verifiability as future work, though we report some preliminary
%results in the companion technical report~\cite{tr}.
\begin{comment}
Goal $\gv$ lacks formality, as do goals presented by
K\"usters et al.~\cite{Kusters11:UniversalVerifiability,Kusters12:ClashAttacks,Kusters10b}
and Cortier et al.~\cite{Cortier16:VerifiabilitySoK}. This informality prohibits
rigorous mathematical analysis and seems to be an inherent weakness of
global verifability. To overcome this limitation, we recommend the use
of election verifiability.
\end{comment}
\begin{comment}
To overcome this limitation, we propose an experiment
that captures global verifiability.
\begin{inlineexperiment}{$\ExpGV$}
$(....) \leftarrow \adv(k)$\;
...\textcolor{red}{SOMETHING}...\;
\eIf{...}{
\Return 1
}{
\Return 0
}
\end{inlineexperiment}
...\textcolor{red}{TO DO}...
\begin{definition}
An election scheme $\Pi$ satisfies
\emph{global verifiability with external authentication} $($\EVGV$)$
if for all PPT adversaries $\adv$,
there exists a negligible function $\mu$, such that
for all security parameters $k$, it holds that
$\SuccGV \leq \mu(k)$.
\end{definition}
...\textcolor{red}{TO DO}...
\begin{theorem}\label{thm:gv}
Let $\Pi$ be an election scheme.
We have $\Pi$ satisfies \EVEA\ iff $\Pi$ satisfies \EVGV.
\end{theorem}
\noindent
The proof of Theorem~\ref{thm:gv} appears in \refappendix{\ref{app:gv:proof}}.
\end{comment}
}{}\fi
% !TEX root = main-jcj-ev.tex
```
# New classes of attack
Our definitions of election verifiability improve upon existing definitions by detecting three previously unidentified classes of attack:
- *Collusion attacks.* An election scheme’s tallying and verification algorithms might be designed such that they collude to accept incorrect tallies.
- *Biasing attacks.* An election scheme’s verification algorithm might be designed to reject some legitimate tallies.
- *Revelation attacks.* An election scheme’s verification algorithm might be designed to accept incorrect tallies when coins used to construct some ballots are leaked.
Although a well-designed election scheme would hopefully not exhibit vulnerabilities to these attacks, it is the job of verifiability definitions to detect malicious schemes, regardless of whether vulnerabilities are due to malice or errors. So definitions of election verifiability should preclude them.
## Collusion Attacks
Here are two examples of potential collusion attacks:
- **Vote stuffing.** $\TallySymb$ behaves normally, but adds $\kappa$ votes for candidate $\beta$. $\VerifySymb$ subtracts $\kappa$ votes from $\beta$, then proceeds with verification as normal. Elections thus verify as normal, except that candidate $\beta$ receives extra votes.
- **Backdoor tally replacement.** $\TallySymb$ and $\VerifySymb$ behave normally, unless a *backdoor* value is posted on the bulletin board $\bbb$. For example, if $(\SKT,{\bf X^*})$ appears on $\bbb$, then $\TallySymb$ and $\VerifySymb$ both ignore the correct tally and instead replace it with tally ${\bf X^*}$. Value $\SKT$ is the backdoor here; it cannot appear on $\bbb$ (except with negligible probability) unless the tallier is malicious.
Vote stuffing is detected by our definitions of Correctness (§[sec:def:externalscheme] and §[sec:def:internalscheme]), because these definitions require that the tally produced by $\TallySymb$ corresponds to the choices encapsulated in ballots on the bulletin board. Note that vote stuffing is not a failure of eligibility verifiability, because the stuffed votes do not correspond to any ballots on the bulletin board. Backdoor tally replacement is detected by our definitions of universal verifiability (§[sec:def:uv] and §[sec:def:uvv]), because those definitions require $\VerifySymb$ to accept only those tallies that correspond to a correct tally of the bulletin board.
We show, next, that the definition of election verifiability by Juels et al. (**JCJ10?**) fails to detect vote stuffing and backdoor tally replacement, and that the definition by Cortier et al. (**Cortier14:verifiability?**) fails to detect backdoor tally replacement.
Juels et al. (**JCJ10?**) formalize definitions that we name *JCJ-correctness* and *JCJ-verifiability*. JCJ-correctness is intuitively meant to capture that “$\adv$ cannot pre-empt, alter, or cancel the votes of honest voters \[and\] that $\adv$ cannot cause voters to cast ballots resulting in double voting” (**JCJ10?**); it is formalized in terms of whether the adversary can post ballots on the bulletin board that cause the tally to be computed incorrectly. JCJ-verifiability is intuitively “the ability for any player to check whether the tally…has been correctly computed” (**JCJ10?**); it is formalized in terms of whether $\VerifySymb$ will accept a tally that differs from the output of $\TallySymb$. We restate the formal definitions in .
To show that the JCJ definitions fail to detect collusion attacks, we first formalize the vote stuffing attack. An election scheme $\Pi = (\ldots,\TallySymb,\VerifySymb)$ can be modified to derive a vote-stuffing election scheme $\mathsf{Stuff}(\Pi,\beta,\kappa) = (\ldots,\TallySymb_S,\VerifySymb_S)$, which adds $\kappa$ votes to $\beta$, as follows: [^12]
- $\TallySymb_S(\ldots)$ computes $({\bf X},P) \leftarrow \TallySymb(\ldots)$ and outputs $( \Add{{\bf X}},P)$.[^13]
- $\VerifySymb_S(\ldots,{\bf X},P,\ldots)$ computes $v \leftarrow \VerifySymb(\ldots,\Add[\beta,{-\kappa}]{\allowbreak{\bf X}},P,\ldots)$ and outputs $v$.
**Proposition 1**. *Given an election scheme $\Pi$ satisfying JCJ-correctness and JCJ-verifiability, and integers $\beta$ and $\kappa$, it holds that $\mathsf{Stuff}(\Pi, \beta, \kappa)$ satisfies JCJ-correctness and JCJ-verifiability.*
A formal proof appears in .
Second, we formalize the backdoor tally replacement attack. An election scheme $\Pi = (\ldots,\TallySymb,\allowbreak\VerifySymb)$ can be modified to derive an election scheme $\mathsf{Backdoor}(\Pi) = (\ldots,\allowbreak\TallySymb_B,\allowbreak\VerifySymb_B)$, as follows:
- $\TallySymb_B(\ldots,\SKT,\bbb,\ldots)$ checks whether there exists a unique ${\bf X^*}$ such that $(\SKT,{\bf X^*})\in\bbb$. If so, $\TallySymb_B$ outputs $({\bf X^*},\perp)$. Otherwise, $\TallySymb_B$ computes $({\bf X},P) \leftarrow \TallySymb(\ldots,\SKT,\bbb,\ldots)$ and outputs $({\bf X},P)$.
- $\VerifySymb_B(\PKT,\ldots,\bbb,\ldots,{\bf X},P,\ldots)$ checks whether there exists a unique ${\bf X^*}$ such that $(\SKT,\allowbreak{\bf X^*})\in\bbb$. [^14] If so, $\VerifySymb_B$ outputs $1$. Otherwise, $\VerifySymb_B$ computes $v \leftarrow \VerifySymb(\PKT,\ldots,\bbb,\allowbreak\ldots,{\bf X},P,\ldots)$ and outputs $v$.
**Proposition 2**. *Given an election scheme $\Pi$ satisfying JCJ-correctness and JCJ-verifiability that does not leak the tallier’s private key, it holds that $\mathsf{Backdoor}(\Pi)$ satisfies JCJ-correctness and JCJ-verifiability.*
A formal proof appears in , where we also formally define key leakage.
Cortier et al. (**Cortier14:verifiability?**) propose definitions similar to *JCJ-verifiability* and insist that election schemes must satisfy their notions of correctness and partial tallying. Vote stuffing is detected by their correctness property, but backdoor tally replacement is not. The ideas remain the same, so we omit formalized results. We have reported these findings to the original authors.[^15],[^16]
## Biasing attacks
Here are three formalizations of biasing attacks, derived from an election scheme $\Pi = (\dots,\VerifySymb)$.
- **Reject All.** Let $\mathsf{Reject}(\Pi)$ be $(\dots, \VerifySymb_{\subscriptReject})$, where $\VerifySymb_{\subscriptReject}$ always outputs $0$. $\VerifySymb_{\subscriptReject}$ therefore always rejects, hence no election can ever be considered valid.
- **Selective Reject.** Let $\varepsilon$ be a distinguished value that would not be posted on the bulletin board by honest voters. Let $\mathsf{Selective}(\Pi,\varepsilon)$ be $(\dots,\VerifySymb_{\subscriptReject})$, where $\VerifySymb_{\subscriptReject}(\ldots,\allowbreak\bbb,\allowbreak\ldots)$ computes $v\leftarrow\VerifySymb(\ldots,\bbb,\ldots)$ and outputs $1$ if both $v=1$ and $\varepsilon \not\in \bbb$. Otherwise, $\VerifySymb_{\subscriptReject}$ outputs $0$. $\VerifySymb_{\subscriptReject}$ therefore rejects if $\varepsilon$ appears on the bulletin board, hence some elections can be invalidated.
- **Biased Reject.** Suppose $Z$ is a set of tallies. Let $\mathsf{Bias}(\Pi, Z)$ be $(\dots, \allowbreak\VerifySymb_{\subscriptReject})$, where $\VerifySymb_{\subscriptReject}(\ldots,\allowbreak{\bf X},\ldots)$ computes $v \leftarrow \VerifySymb(\ldots,{\bf X},\ldots)$ and outputs $1$ if both $v=1$ and ${\bf X} \in Z$. Otherwise, $\VerifySymb_{\subscriptReject}$ outputs $0$. $\VerifySymb_{\subscriptReject}$ therefore only accepts a subset of the tallies accepted by $\VerifySymb$, hence biases tallies toward $Z$.
These formalizations do not satisfy our definitions of Completeness (§[sec:def:uv] and §[sec:def:uvv]), hence, our definitions of verifiability detect these biasing attacks.
The definition of verifiability by Juels et al. (**JCJ10?**) fails to detect all three of the above attacks, because that definition has no notion of Completeness. For example, it is vulnerable to Biased Reject attacks:
**Proposition 3**. *Given an election scheme $\Pi$ satisfying JCJ-correctness and JCJ-verifiability, and given a multiset $Z$, it holds that $\mathsf{Bias}(\Pi, Z)$ satisfies JCJ-correctness and JCJ-verifiability.*
A formal proof appears in .
The definition of verifiability by Kiayias et al. (**Kiayias15?**) fails to detect Selective Reject attacks, because (like JCJ) the definition has no notion of Completeness. Their notion of Correctness does rule out Reject All and Biased Reject attacks.
Similarly, the definition of verifiability by Cortier et al. (**Cortier14:verifiability?**) detects Biased Reject and Reject All attacks, but fails to detect Selective Reject attacks, because that definition’s notion of Completeness does not quantify over all bulletin boards.
## Revelation attacks
Here are two formalizations of revelation attacks, derived from an election scheme $\Pi = (\dots, \VerifySymb)$ with ballots that do not leak coins.
- **Replace choices.** Let $\mathsf{Replace}(\Pi)$ be $(\dots, \VerifySymb_{\subscriptReject})$, where $\VerifySymb_{\subscriptReject}(\PKT,\allowbreak\bbb,\allowbreak n_C,\allowbreak {\bf X},\allowbreak P,\allowbreak k)$ proceeds as follows. The algorithm checks whether $\bbb =\allowbreak \{b_1,\allowbreak\dots,\allowbreak b_\ell,\allowbreak(\beta_1,\beta'_1,r_1),\allowbreak\dots,\allowbreak(\beta_k,\beta'_k,r_k)\}$ such that $\bigwedge_{1\leq i \leq k} b_i = \Vote[\PKT,n_C,\beta_i,k; r_i]
\wedge 1 \leq \beta_i,\beta'_i \leq n_C$. If so, the algorithm computes $v \leftarrow \VerifySymb(\PKT,\allowbreak\bbb,\allowbreak n_C,\allowbreak {\bf X}^*,\allowbreak P,\allowbreak k)$, where tally ${\bf X}^*$ is derived from ${\bf X}$ by replacing choices $\beta'_1,\allowbreak\dots,\allowbreak\beta'_k$ with $\beta_1,\allowbreak\dots,\allowbreak\beta_k$. Otherwise, the algorithm computes $v \leftarrow \VerifySymb(\PKT,\allowbreak\bbb,\allowbreak n_C,\allowbreak {\bf X},\allowbreak P,\allowbreak k)$. Finally, the algorithm outputs $v$.
- **Drop choices.** Let $\mathsf{Drop}$ be a variant of $\mathsf{Replace}$ that derives tally ${\bf X}^*$ from ${\bf X}$ by adding choices $\beta_1,\dots,\beta_k$.
These revelation attacks do not satisfy our definitions of universal verifiability (§[sec:def:uv] and §[sec:def:uvv]), because the adversary constructs the ballots posted on the bulletin board, hence, can also post the coins used to construct those ballots. Similarly, these attacks do not satisfy global verifiability instantiated with goal $\gv$.
Global verifiability fails to detect the above attacks when instantiated with the goal by Küsters et al. (**Kusters10b?**), because coins are implicitly assumed never to leak, even when the software, hardware, voter, etc., that selected those coins has the ability to leak them. Consequently, voters may verify that their correctly constructed ballot has been recorded, yet their vote can be excluded from the tally. We defer a formal result to Appendix [app:def:goal:gv], where we also formally define coin leakage. Global verifiability fails similarly when instantiated with the goal by Cortier et al. (**Cortier16:VerifiabilitySoK?**).
# Related Work
Kiayias (**Kiayias10?**) & Schoenmakers (**Schoenmakers09:Chapter-on-Voting-Schemes?**) present overviews of security properties for election schemes. Many election schemes in the literature state properties called correctness, accuracy, or (universal) verifiability without formally defining those terms.
In the computational model, Juels et al. (**JCJ02?**; **JCJ05?**; **JCJ10?**) and Cortier et al. (**Cortier14:verifiability?**) give game-based definitions of verifiability. Those definitions fail to detect biasing and collusion attacks (cf. §[sec:newAttacks]). Definitions of universal verifiability (which is just one aspect of election verifiability) in the computational model seem to originate with Benaloh and Tuinstra (**Benaloh94?**), who define a *correctness* property that says every participant is convinced that the tally is accurate with respect to the votes cast, and with Cohen and Fischer (**Benaloh85?**), who define *verifiability* to mean that there exists a *check* function that returns good iff the announced tally of the election corresponds to the cast votes.
Kiayias et al. (**Kiayias15?**) define a property they name *E2E verifiability* (E2E abbreviates “end-to-end”). This property combines our intuitive notions of individual and universal verifiability into a single definition. Their definition fails to detect Selective Reject attacks (cf. §[sec:newAttacks]). Their definitions, like ours, do not address voter intent—that is, verification by humans that ballots correctly encode candidate choices—as we discuss in Section [sec:conclusion].
Cortier et al. (**Cortier16:VerifiabilitySoK?**; **Cortier16:VerifiabilitySoKb?**) survey definitions of verifiability and cast them into the context of global verifiability. In particular, they express goals intended to capture definitions of verifiability by Cohen and Fischer (**Benaloh85?**; **Benaloh96:Thesis?**), Kiayias et al. (**Kiayias15?**), and Cortier et al. (**Cortier14:verifiability?**). They also express goals intended to capture our definitions of individual and universal verifiability. Using these goals, Cortier et al. compare different notions of verifiabilty.
Cortier et al. (**Cortier16:VerifiabilitySoK?** & §10.1) claim that our definition of election verifiability admits an election scheme which it should not: the election scheme in which “$\VoteSymb$ always \[outputs error symbol $\perp$\] for some dishonestly generated public key \[and $\TallySymb$ behaves normally\]." We believe our definition *should* admit this scheme, because it *is* verifiable. Indeed, ballot construction will result in an error, alerting voters to malice. Cortier et al. (**Cortier16:VerifiabilitySoK?**) also claim that we trust the bulletin board and assume all voters will run the correct $\VoteSymb$ algorithm, we do not (cf. §[sec:def:iv] and §[sec:def:uv]).
Küsters & Müller claim “it is often believed that individual \[verifiability\] together with universal verifiability implies \[global\] verifiability...However, \[we\] have demonstrated that individual and universal verifiability are neither sufficient nor necessary for \[global verifiability\]." They state their claim shortly after an explicit reference to our definitions of individual and universal verifiability (**kusters17:misconceptions?**). Yet, those definitions are proven to be strictly stronger than global verifiability, which seemingly contradicts their claim. We contacted Küsters & Müller for clarification. [^17] They stated that their claim only holds for the goal by Küsters et al. (**Kusters10b?**) and the goal they proposed in collaboration with Cortier et al. (**Cortier16:VerifiabilitySoK?**). [^18] But, those goals are uninteresting, since they omit attacks (§[sec:revelation]).
Also in the computational model, Groth (**Groth04?**), and Moran and Naor (**Moran06?**), state definitions of verifiability in terms of *universal composability* (**Canetti01?**). These definitions involve defining an *ideal functionality*; part of that is similar to our $\correcttally$ function. Groth’s definition does not guarantee universal verifiability (**Groth04?**), but Moran and Naor’s does (**Moran06?**).
In the symbolic model, Smyth et al. (**Smyth10:ElectionVerifiabilityA?**) define the first definition of election verifiability. This definition is amenable to automated reasoning, but is stronger than necessary and cannot be satisfied by many election schemes, including Helios and Civitas. Kremer et al. (**Smyth10:ElectionVerifiability?**) overcome this limitation with a weaker definition that sacrifices amenability to automated reasoning, and Smyth (**Smyth10:thesis?**) extends this definition. Additionally, the scope of automated reasoning, using the definition by Smyth et al., is limited by analysis tools (e.g., ProVerif (**Smyth10:ProVerifManual?**)), because the function symbols and equational theory used to model cryptographic primitives might not be suitable for automated analysis (cf. (**DKR11:TPM-Horn-clauses?**; **BlanchetPaiola12:EQ-lists?**; **Bursuc12:EQ-reenc?**; **smyth2013translating?**)). Cortier et al. (**cortier2015type?**) overcome this limitation with an alternative definition based on refinement type systems.
Also in the symbolic model, Kremer and Ryan (**KR05:vote-privacy?**) and Backes et al. (**Backes08:Voting?**) formalize definitions of *eligibility*. These definitions are not intended to provide assurances if the election authorities are dishonest (cf. (**Smyth16:helios-eligibility?**)). For example, the definition of Kremer and Ryan does not detect whether corrupt election authorities insert votes (**KR05:vote-privacy?**). Likewise, the definition of Backes et al. assumes that election authorities are honest (**Backes08:Voting?**).
Our definition of election verifiability has been adapted to auction schemes by Quaglia & Smyth (**Smyth15:Hawk?**). And the definition of election verifiability by Kremer et al. (**Smyth10:ElectionVerifiability?**) has been adapted to auction (**Dreier13:VerifiableAuctions?**) and examination (**Dreier15:VerifiableExams?**; **Dreier14:VerifiableExams?**) schemes. Moreover, McCarthy et al. (**2014-Hawk-and-Aucitas-auction-schemes?**) have shown that auction schemes can be constructed from Helios and JCJ. Thus, our results are applicable beyond voting.
Our definition of election verifiability follows Smyth et al. (**Smyth10:ElectionVerifiabilityA?**; **Smyth10:ElectionVerifiability?**; **Smyth10:thesis?**) by deconstructing it into individual, universal, and eligibility verifiability. Other deconstructions of election verifiability are possible. For example, Adida and Neff (**AdidaN06?**) identify four aspects of verifiability:
- *Cast as intended:* the ballot is cast at the polling station as the voter intended.
- *Recorded as cast:* cast ballots are preserved with integrity through the ballot collection process.
- *Counted as recorded:* recorded ballots are counted correctly.
- *Eligible voter verification:* only eligible voters can cast a ballot in the first place.
Those definitions are not mathematical, so we cannot attempt a precise comparison. Nonetheless, eligibility verifiability and eligible voter verification seem to be addressing similar concerns. Likewise, individual and universal verifiability together seem to be addressing concerns similar to that of recorded as cast and counted as recorded together. We postpone a discussion of cast as intended to Section [sec:conclusion].
Privacy properties (**Moran06?**; **DKR08?**; **JCJ10?**; **Kusters12:CoercionResistance?**; **Kiayias15?**; **Smyth16:ballotSecrecy?**; **Cortier16:BeleniosRF?**)—such as ballot secrecy, receipt freeness, and coercion resistance—complement verifiability.[^19] Chevallier-Mames et al. (**Chevallier-Mames:Wote06?**; **Chevallier-Mames:WoteExt10?**) and Hosp and Vora (**Hosp:Wote06?**; **Hosp:Journal08?**) show an incompatibility result: election schemes cannot unconditionally satisfy privacy and universal verifiability. But weaker versions of these properties can hold simultaneously, as can be witnessed from Theorems [thm:helios] and [thm:jcj] coupled with existing privacy results such as the ballot secrecy proofs Helios variants (**Bernhard12:Helios?**, Theorem 3), (**Bernhard14:thesis?**, Theorem 6.12), and the coercion resistance proof for JCJ (**JCJ10?**).
Cortier & Lallemand claim privacy implies individual verifiability (**Cortier:PrivacyImpliesIV?**). But, they assume a trusted tallier. For privacy, this assumption is necessary to ensure ballots cannot be tallied individually, which would reveal votes. By comparison, the assumption is counter-intuitive for individual verifiability, because attacks by malicious talliers must be detected. Our definition of individual verifiability detects such attacks and Smyth proves it is not implied by privacy (**2018-verifiability-Helios-mixnet?**, Appendix C).
In an analysis of Helios, Küsters et al. (**Kusters12:ClashAttacks?**) use goal $\gamma$ to conclude that global verifiability is satisfied. Yet Bernhard et al. (**Bernhard12:Helios?**) and Chang-Fong & Essex (**Essex16:HeliosVerifiability?**) demonstrate vulnerabilities against verifiability, and in we show that $\EVEA$ detects these vulnerabilities. This seeming discrepancy arises because the analysis in (**Kusters12:ClashAttacks?**) does not formalize all the cryptographic primitives used by Helios, hence the vulnerabilities go unnoticed. So another contribution of our own work is to correctly distinguish between unverifiable and verifiable variants of Helios by rigorously analyzing the cryptography used in Helios.
# Concluding Remarks
When we began this work, we were studying the Juels et al. (**JCJ10?**) definition of election verifiability. We discovered that the definition fails to detect biasing and collusion attacks. While attempting to improve the Juels et al. definition to rule out those attacks, we discovered that factoring it into individual, universal, and eligibility verifiability led to an elegant decomposition of (mostly) orthogonal properties. We later sought to apply our new definitions to existing electronic voting systems, and Helios (**AdidaPereiraMarneffeQuisquater?**) and JCJ (**JCJ10?**) were natural choices. But they treat authentication differently—Helios outsources authentication, whereas JCJ does not—so we were led to separate our definitions into variants for external and internal authentication. We were at first surprised to discover that JCJ does not satisfy the strong definition of eligibility verifiability. But upon reflection, it became apparent that an adversary who knows the tallier’s private key can easily forge ballots that appear to be from eligible voters.
Helios-C (**Cortier14:verifiability?**), however, avoids this problem by employing digital signatures.
Our definitions of verifiability have not addressed the issue of voter intent—that is, verification by a human that the ballot submitted by a voter corresponds to the candidate choice the voter intended to make. Adida and Neff call this property “cast as intended” (**AdidaN06?**). Many election schemes (e.g., (**FOO?**; **HS00?**; **JCJ10?**; **Kiayias15?**)) do not satisfy cast as intended, because the schemes implicitly or explicitly assume that voters can themselves verify the cryptographic operations required to construct ballots. Nevertheless, schemes by Chaum (**Chaum04:PunchScan?**), Neff (**Neff04:MarkPledge?**), and Benaloh (**Benaloh06:BallotAudit?**; **Benaloh07:BallotAudit?**) introduce cryptographic mechanisms to verify voter intent. It would be natural to explore strengthening our definitions to address voter intent.
The goal of this research is to enable verifiability of the voting systems we use in real-life, rather than merely trusting them. Research on verifiability can generalize beyond voting to other systems that must guarantee strong forms of integrity. Verifiable voting systems thus have the potential to contribute to the science of security, to democracy, and to broader society.
# Acknowledgments
We thank David Bernhard, Dario Catalano, Jeremy Clark, Véronique Cortier, Aleksander Essex, David Galindo, Stéphane Glondu, Markus Jakobsson, Steve Kremer, Ralf Küsters, Elizabeth Quaglia, Mark Ryan, Susan Thomson, and Poorvi Vora for insightful discussions that have influenced this paper. This work is partly supported by the European Research Council under the European Union’s Seventh Framework Programme (FP7/2007-2013) / ERC project *CRYSP* (259639), by AFOSR grants FA9550-12-1-0334 and FA9550-14-1-0334, by NSF grant 1421373, by the National Security Agency, and the Luxembourg National Research Fund (FNR) under the FNR-INTER-VoteVerif project (10415467). This work was performed in part at George Washington University and at INRIA.
# Dedication[^20]
# Dedication
Ben Smyth dedicates his contribution to the loving memory of Anne Konishi, 1971 – 2015. What matters most of all is the dash. We had a great time.
He writes for Christina Mai Konishi. Smile like your mother, for good fortune seeks those who smile (*warau kado niwa fuku kitaru*, says the Japanese proverb).
# Cryptographic primitives
## Basic definitions
**Definition 1** (Negligible function (**Goldreich01:vol1?**)). *A function $\mu : \mathbb{N} \rightarrow \mathbb{R}$ is *negligible* if for every positive polynomial function $p(\cdot)$, there exists an $N$, such that for all $n > N$, $$\mu(n) < \frac{1}{p(n)}.$$*
An event $E(k)$, where $k$ is a security parameter, occurs with *negligible probability* if $\Pr[E(k)] \leq \mu(k)$ for some negligible function $\mu$. The event occurs with *overwhelming probability* if the complement of the event occurs with negligible probability.
**Definition 2** (Asymmetric encryption scheme (**Katz07?**)). *An *asymmetric encryption scheme* is a tuple of PPT algorithms $(\GGenSymb,\EEncSymb,\allowbreak\DDecSymb)$ such that:*
- ****Gen***, denoted $(\pk,\sk,\mathfrak{m})\leftarrow \GGen[k]$, takes a security parameter $k$ as input and outputs a key pair $(\pk,\sk)$ and message space $\mathfrak{m}$.*
- ****Enc***, denoted $c\leftarrow \EEnc[\pk]{m}$, takes a public key $\pk$ and message $m \in \mathfrak{m}$ as input, and outputs a ciphertext $c$.*
- ****Dec***, denoted $m\leftarrow \DDec[\sk]{c}$, takes a private key $\sk$, and ciphertext $c$ as input, and outputs a message $m$ or error symbol $\perp$. We assume ${\perp}\not\in\mathfrak m$ and $\DDecSymb$ is deterministic.*
*Moreover, the scheme must be *correct*: there exists a negligible function $\mu$, such that for all security parameters $k$ and messages $m$, we have $\Pr [
(\pk,\sk,\mathfrak{m}) \leftarrow\GGen;
c\leftarrow \EEnc[\pk]{m}:
m\in\mathfrak{m} \Rightarrow \DDec[\sk]{c} = {m}] > 1-\mu(k)$.*
Our definition of asymmetric encryption schemes differs from Katz and Lindell’s definition (**Katz07?**, Definition 10.1) in that we formally state the plaintext space.
**Definition 3** (Homomorphic encryption). *An asymmetric encryption scheme $\Gamma =
(\GGenSymb,\EEncSymb,\allowbreak\DDecSymb)$ is *homomorphic*, with respect to ternary operators $\odot$, $\oplus$, and $\otimes$,[^21] if there exists a negligible function $\mu$, such that for all security parameters $k$, we have the following. First, for all messages $m_1$ and $m_2$ we have $\Pr [
(\pk,\sk,\mathfrak{m}) \leftarrow\GGen;\allowbreak c_1\leftarrow\EEnc[\pk]{m_1};\allowbreak
c_2\leftarrow\EEnc[\pk]{m_2}\allowbreak : m_1,m_2\in\mathfrak{m}\allowbreak \Rightarrow\allowbreak \DDec[\sk]{c_1 \otimes_{\pk} c_2}\allowbreak \mathrel=\allowbreak \DDec[\sk]{\allowbreak c_1}\allowbreak \mathrel{\odot_{{\pk}}} \allowbreak\DDec[\sk]{c_2}
]\allowbreak > 1-\mu(k)$. Secondly, for all messages $m_1$ and $m_2$, and coins $r_1$ and $r_2$, we have $\Pr [
(\pk,\sk,\mathfrak{m}) \leftarrow\GGen\allowbreak:
m_1,m_2\in\mathfrak{m}\allowbreak \Rightarrow\allowbreak
\EEnc[\pk]{m_1;r_1}\allowbreak \mathrel{\otimes_{{\pk}}}\allowbreak \EEnc[\pk]{m_2;r_2}\allowbreak \mathrel=\allowbreak \EEnc[\pk]{m_1\odot_{{\pk}} m_2;r_1 \oplus_{{\pk}} r_2}
]\allowbreak > 1-\mu(k)$.*
*We say $\Gamma$ is *additively homomorphic*, respectively *multiplicatively homomorphic*, if for all security parameters $k$, key pairs $\pk,\sk$, and message spaces $\mathfrak{m}$, such that there exists coins $r$ and $(\pk,\sk,\mathfrak{m}) = \GGen[k;r]$, we have $\odot_{\pk}$ is the addition operator, respectively multiplication operator, in group $(\mathfrak m, \odot_{\pk})$.*
*Indistinguishability under chosen-plaintext attack* ($\gameShort$) (**Goldwasser82:IND-CPA?**; **Goldwasser84:IND-CPA?**; **Bellare98:RelationsCryptoDefs?**; **Bellare99:IND-k-CPA?**; **Bellare06:IND-k-CPA?**) is a standard definition of security for encryption schemes. Intuitively, if an encryption scheme satisfies $\gameShort$, then an adversary without access to a decryption oracle is unable to distinguish ciphertexts.
A variant ($\gameShortINDPA$) allows the adversary a *parallel decryption query*—i.e., it requests the decryption of a vector of ciphertexts.
**Definition 4** ($\gameShortINDPA$ (**Bellare99:IND-k-CPA?**)). *An asymmetric encryption scheme satisfies $\gameShortINDPA$, if for all probabilistic polynomial-time adversaries $\adv$, there exists a negligible function $\mu$, such that for all security parameters $k$, we have $\Succ(\gameINDPA) \leq 1/2 + \mu(k)$, where experiment $\gameShortINDPA$ is defined as follows:[^22]*
* $\;=$
$(\pk,\sk,\mathfrak m) \leftarrow \GGen[k]$ $(m_0,m_1) \leftarrow \adv(\pk,\mathfrak m,k)$ $\beta \leftarrow_R \{0,1\}$ $c \leftarrow \EEnc[\pk]{m_\beta}$ ${\bf c} \leftarrow \adv(c)$ ${\bf m} \leftarrow (\DDec[\sk]{{\bf c}[1]},\dots,\DDec[\sk]{{\bf c}[|{\bf c}|]}$ $g\leftarrow\adv({\bf m})$ $g = \beta \mathrel\wedge\allowbreak \bigwedge_{1\leq i \leq |{\bf c}|} c \not={\bf c}[i] \wedge\allowbreak m_0,m_1\in\mathfrak m \wedge\allowbreak |m_0| = |m_1|$ *
**Definition 5** (Signature scheme (**Katz07?**)). *A *signature scheme* is a tuple $(\GGenSymb,\allowbreak\SgnSymb,\VrfySymb)$ of PPT algorithms such that:*
- ****Gen***, denoted $(\pk,\sk) \leftarrow \GGen$, takes a security parameter $k$ as input and outputs a key pair $(\pk,\sk)$.*
- ****Sign***, denoted $\sigma \leftarrow \Sgn$, takes a private key $\sk$ and message $m$ as input, and outputs a signature $\sigma$.*
- ****Verify***, denoted $v \leftarrow \Vrfy$, takes a public key $\pk$, message $m$, and signature $\sigma$ as input, and outputs a bit $v$, which is $1$ if the signature successfully verifies and $0$ otherwise. We assume $\VrfySymb$ is deterministic.*
*Moreover, the scheme must be *correct*: there exists a negligible function $\mu$, such that for all security parameters $k$ and messages $m$, we have $\Pr [(\pk,\sk) \leftarrow \GGen;\sigma \leftarrow \Sgn;\Vrfy[\allowbreak \pk,\allowbreak m,\allowbreak \sigma] = 1] > 1-\mu(k)$.*
**Definition 6**. *A signature scheme $\Gamma = (\GGenSymb,\SgnSymb,\VrfySymb)$ satisfies *strong unforgeability* if for all PPT adversaries $\adv$, there exists a negligible function $\mu$, such that for all security parameters $k$, we have $\Succ(\Exp\text{-}\mathsf{StrongSign}(\Gamma,\allowbreak\adv,k)) \leq \mu(k)$, where experiment $\Exp\text{-}\mathsf{StrongSign}$ is defined as follows:*
* $\;=$
$(\pk,\sk) \leftarrow \GGen[k]$ $\mathit{Msg}\leftarrow\emptyset$ $(m,\sigma) \leftarrow A^{\oracleSymb}(\pk,k)$ *
*The experiment defines an oracle $\oracleSymb$.[^23] On invocation $\oracleSymb(m)$, oracle $\oracleSymb$ computes a signature $\sigma \leftarrow \Sgn[\sk,m]$, records the request and response $(m,\sigma)$ by updating $\mathit{Msg}$ to be $\mathit{Msg} \cup \{(m,\sigma)\}$, and outputs $\sigma$.*
## Proof systems
A *proof system* (originally known as an *interactive proof system* (**Goldwasser89?**)) is a two-party protocol between a prover and a verifier. The prover convinces the verifier that a string $x$ is in a language $L$. Here, we assume that there is a *witness relation* $R$, such that $s \in L$ iff there exists a witness $w$, such that $(s,w) \in R$. For any $(s,w) \in R$, it must also hold that the length of $w$ is at most polynomial in the length of $s$. Proof systems ensure that a prover can convince a verifier of any valid claim (*completeness*), and that a verifier cannot be fooled into accepting a false claim (*soundness*).
A *sigma protocol* (**Damgard10?**; **Hazay10?**; **Bootle16:NIZKtutorial?**; **Schoenmaker16:lectureNotes?**) is a proof system with a particular three-move structure: commit, challenge, respond.
**Definition 7** (Sigma protocol). *A *sigma protocol* for a relation $R$ is a tuple $(\CommSymb,\ChallSymb,\allowbreak\RespSymb,\VerSymb)$ of PPT algorithms such that:*
- ****Comm***, denoted $(\comm,t) \leftarrow \CommSymb(s,w,k)$, is executed by a *prover*. $\CommSymb$ takes a statement $s$, witness $w$ and security parameter $k$ as input, and outputs a commitment $\comm$ and some state information $t$.*
- ****Chal***, denoted $\chal \leftarrow \ChallSymb(s,\comm,k)$, is executed by a *verifier*. $\ChallSymb$ takes a statement $s$, a commitment $\comm$ and a security parameter $k$ as input, and outputs a string $\chal$.*
- ****Resp***, denoted $\resp\leftarrow \RespSymb(\chal,t,k)$, is executed by a prover. $\RespSymb$ takes a challenge $\chal$, state information $t$ and security parameter $k$ as input, and outputs a response $\resp$.*
- ****Verify***, denoted $v \leftarrow \VerSymb(s,(\comm,\chal,
\resp),k)$ is executed by a verifier. $\VerSymb$ takes a statement $s$, a transcript $(\comm,\allowbreak\chal,\resp)$ and a security parameter $k$ as input, and outputs a bit $v$, which is $1$ if the transcript successfully verifies and $0$ otherwise. We assume $\VerSymb$ is deterministic.*
*Moreover, the sigma protocol must be *complete*: there exists a negligible function $\mu$, such that for all statements and witnesses $(s,w) \in R$ and security parameters $k$, we have $\Pr[(\comm,t)\leftarrow\CommSymb(s,w,k);\chal\leftarrow\ChallSymb(s,\comm,k);\resp \leftarrow \Resp{\chal}{t,k}:\VerSymb(s,(\comm,\allowbreak\chal,\resp),k)= 1] > 1 - \mu(k)$.*
Some sigma protocols ensure *special soundness* and *special honest-verifier zero-knowledge*. We will make use of a result by Bernhard et al. that requires these properties, but we will not need the details of those definitions in our proofs, so we omit them here; see Bernhard et al. (**Bernhard12:Helios?**) for a formalization.
## Non-interactive proof systems
A proof system is *non-interactive* if a single message is sent from the prover to the verifier.
**Definition 8** (Non-interactive proof system). *A *non-interactive proof system* for a relation $R$ is a tuple of PPT algorithms $(\ProveSymb, \VerifySymb)$ such that:*
- ****Prove***, denoted $\sigma \leftarrow \ProveSymb(s,w,k)$, is executed by a prover to prove $(s,w) \in R$.*
- ****Verify***, denoted $v\leftarrow \VerifySymb(s,\sigma,k)$, is executed by anyone to check the validity of a proof. We assume $\VerifySymb$ is deterministic.*
*Moreover, the system must be *complete*: there exists a negligible function $\mu$, such that for all statement and witnesses $(s,w)\in R$ and security parameters $k$, we have $\Pr[\sigma \leftarrow \ProveSymb(s,w,k):\VerifySymb(s,\sigma,k) = 1] > 1 - \mu(k)$.*
We can derive non-interactive proof systems from sigma protocols using the *Fiat-Shamir transformation* (**FS87?**), which replaces the verifier’s challenge with a hash of the prover’s commitment, concatenated with the prover’s statement.
**Definition 9** (Fiat-Shamir transformation (**FS87?**)). *Given a sigma protocol $\Sigma = (\CommSymb,\ChallSymb,\allowbreak\RespSymb,\VerSymb_\Sigma)$ for relation $R$ and a hash function $\mathcal H$, the *Fiat-Shamir transformation*, denoted $\sFS{\Sigma}{\mathcal H}$, is the tuple $(\ProveSymb, \VerifySymb)$ of algorithms, defined as follows:*
*$\;=$
$(\comm,t) \leftarrow \CommSymb(s,w,k)$ $\chal \leftarrow\mathcal H(\comm,s)$ $\resp\leftarrow\RespSymb(\chal,t,k)$ $(\comm,\resp)$ *
*$\;=$
$\chal \leftarrow\mathcal H(\comm,s)$ $\VerSymb_\Sigma(s,(\comm,\allowbreak \chal,\resp),k)$ *
It is straightforward to check that $\sFSSymb$ produces non-interactive proof systems. In particular, given sigma protocol $\Sigma$ for relation $R$, and a hash function $\mathcal H$, we have $\sFS{\Sigma}{\mathcal H}$ is a non-interactive proof system for relation $R$.
Some applications of the Fiat-Shamir transformation produce non-interactive proof systems satisfying *zero-knowledge*: anything a verifier can derive about a witness can be derived without interaction with a prover—that is, the prover can be simulated by a PPT algorithm called a *simulator*. We will not need the details of zero-knowledge in our proofs, so we omit them here; see Bernhard et al. (**Bernhard12:Helios?**) or Quaglia & Smyth (**Smyth15:Hawk?**) for formalizations.
In addition, some applications of the Fiat-Shamir transformation produce non-interactive proof systems satisfying *simulation sound extractability*: an *extractor* can recover witnesses from proofs by *rewinding* the prover, as discussed below. (We use extractors in our proofs of theorems, to obtain witnesses from proofs.) We define simulation sound extractability in the *random oracle model* (**Bellare93:RandomOracles?**). A random oracle can be *programmed* or *patched*. We will not need the details of how patching works in our proofs, so we omit them here; see Bernhard et al. (**Bernhard12:Helios?**) for a formalization.
**Definition 10** (Simulation sound extractability (**Bernhard12:Helios?**; **Groth06:SimulationSoundExtractability?**)). *Suppose $\Sigma$ is a sigma protocol for relation $R$, $\mathcal H$ is a random oracle, and $(\ProveSymb, \VerifySymb)$ is a non-interactive proof system, such that $\sFS{\Sigma}{\mathcal H} = (\ProveSymb, \allowbreak\VerifySymb)$. Further suppose $\mathcal S$ is a simulator for $(\ProveSymb, \VerifySymb)$ and $\mathcal H$ can be patched by $\mathcal S$. Proof system $(\ProveSymb, \VerifySymb)$ satisfies *simulation sound extractability* if there exists a PPT algorithm $\mathcal K$, such that for all PPT adversaries $\adv$ and coins $r$, there exists a negligible function $\mu$, such that for all security parameters $k$, we have:[^24]*
*$$\begin{gathered}
\Pr[{\bf P}\leftarrow();
{\bf Q} \leftarrow\adv^{\mathcal H,\mathcal P}(\mbox{---};r);
{\bf W} \leftarrow \mathcal K^{\adv'}({\bf H},{\bf P},{\bf Q})
%
: \\
|{\bf Q}|\not=|{\bf W}| \vee \exists j\in\{1,\dots,|{\bf Q}|\} \mathrel . ({\bf Q}[j][1],{\bf W}[j])\not\in R \mathrel \wedge \\
%\exists j\in\{1,\dots,|{\bf Q}|\} \mathrel . ({\bf Q}[j][1],{\bf W}[j])\not\in R \mathrel\wedge |{\bf Q}| = |{\bf W}| \\
%\textrm{\sout{$\forall i\in\{1,\dots,|{\bf P}|\},j\in\{1,\dots,|{\bf Q}|\} \mathrel .
%{\bf P}[j][2] \not= {\bf Q}[j][2] \mathrel \wedge$}}\\ \textrm{\sout{$\VerifySymb({\bf Q}[j][1],{\bf Q}[j][2]) = 1$}}\\
\forall (s,\sigma) \in {\bf Q},(t,\tau) \in {\bf P} \mathrel . \VerifySymb(s,\sigma,k) = 1 \mathrel\wedge \sigma\not=\tau] \leq \mu(k)
\end{gathered}$$*
*where $\adv(\mbox{---};r)$ denotes running adversary $\adv$ with an empty input and coins $r$, where ${\bf H}$ is a transcript of the random oracle’s input and output, and where oracles $\adv'$ and $\mathcal P$ are defined below:*
- *$\adv'()$. Computes ${\bf Q'}\leftarrow\adv(\mbox{---};r)$, forwarding any of $\adv$’s oracle calls to $\mathcal K$, and outputs ${\bf Q'}$. By running $\adv(\mbox{---};r)$, $\mathcal K$ is rewinding the adversary.*
- *$\mathcal P(s)$. Computes $\sigma \leftarrow \mathcal S(s,k); {\bf P} \leftarrow ({\bf P}[1],\allowbreak\dots,\allowbreak{\bf P}[|{\bf P}|],\allowbreak(s,\sigma))$ and outputs $\sigma$.*
*Algorithm $\mathcal K$ is an *extractor* for $(\ProveSymb, \VerifySymb)$.*
Our definition of simulation sound extractability in the random oracle model is an analogue of Groth’s definition in the common reference string model (**Groth06:SimulationSoundExtractability?**). (See Bernhard et al. (**Bernhard12:Helios?**) for a detailed comparison.) Our presentation of simulation sound extractability differs from the presentation by Bernhard et al. (**Bernhard12:Helios?**) by formalizing some of the details.
Bernhard et al. (**Bernhard12:Helios?**) show that non-interactive proof systems derived using the Fiat-Shamir transformation satisfy zero-knowledge and simulation sound extractability:
**Theorem 1** (from (**Bernhard12:Helios?**)). *Let $\Sigma$ be a sigma protocol for relation $R$, and let $\mathcal H$ be a random oracle. If $\Sigma$ satisfies special soundness and special honest verifier zero-knowledge, then $\sFS{\Sigma}{\mathcal H}$ satisfies zero-knowledge and simulation sound extractability.*
The Fiat-Shamir transformation can be generalized to include an optional string $m$ in the hashes produced by functions $\ProveSymb$ and $\VerSymb$. We write $\ProveSymb(s,\allowbreak w,m,k)$ and $\VerSymb(s,\allowbreak(\comm,\allowbreak \resp),\allowbreak m,\allowbreak k)$ for invocations of $\ProveSymb$ and $\VerSymb$ which include an optional string. When $m$ is provided, it is included in the hashes in both algorithms. That is, given $\sFS{\Sigma}{\mathcal H} = (\ProveSymb, \VerifySymb)$, the hashes are computed as follows in both algorithms: $\chal \leftarrow\mathcal H(\comm,s,m)$. Theorem 1 can be extended to this generalization.
# Variants of $\Exp\text{-}\IVSymb$
Our individual verifiability experiment with external authentication (§[sec:def:iv]) can be equivalently formulated as an experiment that challenges $\adv$ to predict the output of $\VoteSymb$:
$\;=$
$(\PKT,n_C,\beta,b) \leftarrow \adv(k)$ $b'\leftarrow\Vote[\PKT,n_C,\beta,k]$
**Proposition 1**. *Given an election scheme $\Pi$, we have $$\begin{gathered}
\forall \adv \; \exists \mu \; \forall k \mathrel .\SuccIV\leq \mu(k) \\
\mathrel\Leftrightarrow
\forall \adv' \; \exists \mu' \; \forall k' \mathrel . \Succ(\ExpIVSymb'(\Pi,\adv',k'))\leq \mu'(k'),
\end{gathered}$$ where $\adv$ and $\adv'$ are PPT adversaries, $\mu$ and $\mu'$ are negligible functions, and $k$ and $k'$ are security parameters.*
Intuitively, if $\adv$ can predict the output of $\VoteSymb$, then $\adv$ can use that prediction to generate a collision. And if $\adv$ can generate collisions, then $\adv$ can use them to predict outputs.
For the forward implication, suppose $\adv'$ is a PPT adversary such that $\Succ(\ExpIVSymb'(\Pi,\allowbreak\adv',k'))> \frac{1}{p(k')}$ for some polynomial function $p$ and security parameter $k'$. We construct an adversary $\adv$ against $\ExpIVSymb$. On input $k'$, adversary $\adv$ computes $(\PKT,n_C,\beta,b) \leftarrow \adv'(k')$ and outputs $(\PKT,n_C,\beta,\beta)$. Since $\adv'$ wins $\ExpIVSymb'$ with non-negligible probability, we have $$\Pr[b'\leftarrow \VoteSymb(\PKT,n_C,\beta,k') : b= b' \wedge b\not={\perp}]>\frac{1}{p(k')}.$$ Moreover, since calls to algorithm $\VoteSymb$ are independent, we have $$\begin{gathered}
\Pr[b_1\leftarrow \VoteSymb(\PKT,n_C,\beta,k');\\
b_2\leftarrow \VoteSymb(\PKT,n_C,\beta,k')\\ : b_1 = b \wedge b_2 = b\wedge b_1\not={\perp}\wedge b_2\not={\perp}]>\frac{1}{p(k')^2}.
\end{gathered}$$ It follows that $\Succ(\ExpIVSymb(\Pi,\adv,k'))>\frac{1}{p(k')^2}$.
For the reverse implication, suppose $\adv$ is a PPT adversary such that $\SuccIV > \frac{1}{p(k)}$ for some polynomial function $p$ and security parameter $k$. We construct an adversary $\adv'$ against $\ExpIVSymb'$. On input $k$, adversary $\adv'$ computes $(\PKT,n_C,\beta_1,\beta_2) \leftarrow \adv(k);
b_1\leftarrow\VoteSymb(\PKT,n_C,\beta_1,k)$ and outputs $(\PKT,n_C,\allowbreak\beta_2,b_1)$. Since $\adv$ wins $\ExpIVSymb$ with probability no less than $\frac{1}{p(k)}$, we have $$\Pr[b_2\leftarrow\VoteSymb(\PKT,n_C,\beta_2,k) : b_1=b_2\wedge b_1\not={\perp}]> \frac{1}{p(k)}.$$ It follows that $\Succ(\ExpIVVSymb'(\Pi,\adv',k))> \frac{1}{p(k)}$.
Our individual verifiability experiment with internal authentication (§[sec:def:ivv]) can also be reformulated as an experiment that challenges $\adv$ to predict the output of $\VoteSymb$ algorithms:
$\;=$
$(\PKT,n_V) \leftarrow \adv(k)$ $\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$ $\mathit{Crpt}\leftarrow\emptyset;$
$(n_C,\beta,i,b) \leftarrow \adv^{\corruptOracle}(\electoralroll)$ $b'\leftarrow\Vote[sk_i,\PKT,n_C,\beta,k]$
Similarly to Section [sec:def:ivv], the adversary is given access to oracle $\corruptOracle$ and the voter index output on line 5 must be legal with respect to $n_V$.
Experiment $\ExpIVVSymb'$ is strictly stronger than our original experiment $\ExpIVVSymb$, since predicting the output of $\VoteSymb$ does not imply the existence of collisions, whereas collisions can be used to predict the output of $\VoteSymb$. For instance, consider the following variant of $\Nonce$ (Definition [def:nonce]):
**Definition 1**. *Election scheme $\Nonce'$ is defined as follows:*
- *$\Setup[k]$ outputs $({\perp},{\perp},\infty,\infty)$.*
- *$\Register[\PKT,k]$ computes $r\in\mathbb Z_{2^k}$ and outputs $(r,r)$.*
- *$\Vote[r,\PKT,n_C,\beta,k]$ outputs $(r,\beta)$.*
- *$\Tally[\SKT,\bbb,\electoralroll,n_C,k]$ computes a vector ${\bf X}$ of length $n_C$, such that ${\bf X}$ is a tally of the votes on $\bbb$ for which the nonce is in $\electoralroll$, and outputs $({\bf X},\perp)$.*
- *$\Verify[\PKT,\bbb,\electoralroll,n_C,{\bf X},P,k]$ outputs $1$ if $({\bf X},P) =\Tally[{\perp},{\perp},\bbb,\electoralroll,n_C,\allowbreak k]$ and $0$ otherwise.*
Intuitively, an adversary can predict the output of $\VoteSymb$, because the algorithm is deterministic and the electoral roll lists private credentials. However, the $\RegisterSymb$ algorithm ensures that voters’ credentials are distinct with overwhelming probability, hence, instantiations of the $\VoteSymb$ algorithm with distinct voter credentials will never collide.
**Proposition 2**. *Given an election scheme $\Pi$, PPT adversary $\adv$, negligible function $\mu$, and security parameter $k$, if $\Succ(\ExpIVVSymb'(\Pi,\adv,k))\leq \mu(k)$, then there exists a PPT adversary $\Adv$ such that $\Succ(\ExpIVVSymb(\Pi,\Adv,k))\leq \mu(k)$.*
The proof of Proposition 2 is similar to the reverse implication proof of Proposition 1.
# Generalized Helios Scheme
We formalize a generic construction for Helios-like election schemes (Definition 2). Our construction is parameterized on the choice of homomorphic encryption scheme and sigma protocols for the relations introduced in the following definition.
**Definition 1**. *Let $(\GGenSymb,\EEncSymb,\DDecSymb)$ be a homomorphic asymmetric encryption scheme and $\Sigma$ be a sigma protocol for a binary relation $R$.[^25]*
- *$\Sigma$ *proves correct key construction* if $((k,\allowbreak\pk,\allowbreak\mathfrak m),\allowbreak(\sk,\allowbreak s)) \in R \Leftrightarrow (\pk, \sk,\mathfrak m) = \GGen[k;s]$.*
*Suppose $(\pk,\sk,\mathfrak m)=\GGen[k;s]$, for some security parameter $k$ and coins $s$.*
- *$\Sigma$ *proves plaintext knowledge in a subspace* if $((\pk,\allowbreak c,\allowbreak\mathfrak m'),\allowbreak(m,\allowbreak r)) \in R
\Leftrightarrow c = \EEnc[\pk]{m;r}\wedge m\in\mathfrak m' \wedge \mathfrak m'\subseteq \mathfrak m$.*
- *$\Sigma$ *proves correct decryption* if $((\pk,c,m),\sk) \in R \Leftrightarrow m=\DDec[\sk]{c}$.*
**Definition 2** (Generalized Helios). *Suppose $\Gamma =\allowbreak (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$ is an additively homomorphic asymmetric encryption scheme, $\Sigma_1$ proves correct key construction, $\Sigma_2$ proves plaintext knowledge in a subspace, $\Sigma_3$ proves correct decryption, and $\mathcal H$ is a hash function. Let $\sFS{\Sigma_1}{\allowbreak\mathcal H} = (\ProveKeySymb,\allowbreak \VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} = (\SignCiphSymb,\allowbreak \VerCiphSymb)$, and $\sFS{\Sigma_3}{\allowbreak\mathcal H} = (\ProveDecSymb,\allowbreak \VerDecSymb)$. We define *generalized Helios* as $\mathsf{Helios}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \mathcal H) =\allowbreak (\SetupSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$:*
- *$\Setup[k]$. Select coins $s$ uniformly at random, compute $(\pk,\allowbreak\sk,\allowbreak\mathfrak m) \leftarrow \GGen[k;\allowbreak s];\rho \leftarrow \ProveKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\sk,\allowbreak s};\PKT\leftarrow(\pk,\allowbreak\mathfrak m,\allowbreak\rho);\SKT\leftarrow(\pk,\allowbreak\sk)$, let $m$ be the largest integer such that $\{0,\dots,m\}\subseteq\{0\} \cup\mathfrak m$, and output $(\PKT,\SKT,m,m)$.*
- *$\Vote[\PKT,n_C,\beta,k]$. Parse $\PKT$ as a vector $(\pk,\mathfrak m,\rho)$. Output $\perp$ if parsing fails or $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\rho} \not= 1 \vee \beta\not\in\{1,\dots,n_C\}$. Select coins $r_1, \dots, r_{n_C-1}$ uniformly at random and compute:*
* $c_j \leftarrow \EEnc[\pk]{m_j;r_j}$ $\sigma_j \leftarrow \SignCiph{\pk, c_j,\{0,1\}}{m_j, r_j}{j}$ $c\leftarrow c_1 \otimes \dots \otimes c_{n_C-1}$ $m\leftarrow m_1 \odot \dots \odot m_{n_C-1}$ $r\leftarrow r_1 \oplus \dots \oplus r_{n_C-1}$ $\sigma_{n_C} \leftarrow \SignCiph{\pk,c,\{0,1\}}{m, r}{n_C}$ *
*Output ballot $(c_1,\dots,c_{n_C-1},\sigma_1,\dots,\sigma_{n_C})$.*
- *$\Tally[\SKT,\bbb,n_C,k]$. Initialize vectors ${\bf X}$ of length $n_C$ and ${\bf P}$ of length $n_C-1$. Compute . Parse $\SKT$ as a vector $(\pk,\sk)$. Output $({\bf X},{\bf P})$ if parsing fails. Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ such that $b_1 < \dots < b_\ell$ and for all $1 \leq i \leq \ell$ we have $b_i$ is a vector of length $2\cdot n_C-1$ and $\bigwedge_{j = 1}^{n_C-1} \VerCiph{\pk,b_i[j],\{0,1\}}{b_i[j+n_C-1]}{j} =1 \wedge
\VerCiph{\pk,b_i[1]\otimes\cdots\otimes b_i[n_C-1],\{0,1\}}{b_i[2 \cdot n_C-1]}{n_C} =1$. If $\{b_1, \dots, b_\ell\} = \emptyset$, then output $({\bf X},{\bf P})$, otherwise, compute:*
* $c \leftarrow b_1[j] \otimes \dots \otimes b_\ell[j]$ ${\bf X}[j] \leftarrow\DDec[\sk]{c}$ ${\bf P}[j] \leftarrow \ProveDec{\pk, c,{\bf X}[j]}{\sk}$ ${\bf X}[n_C] \leftarrow \ell-\sum_{j=1}^{n_C-1}{\bf X}[j]$ *
*Output $({\bf X},{\bf P})$.*
- *$\Verify[\PKT,\bbb,n_C,{\bf X},{\bf P},k]$. Parse ${\bf X}$ as a vector of length $n_C$, parse ${\bf P}$ as a vector of length $n_C-1$, parse $\PKT$ as a vector $(\pk,\mathfrak m,\rho)$. Output $0$ if parsing fails or $\VerKey{k,\pk,\mathfrak m}{\rho} \not= 1$. Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ satisfying the conditions given by the tally algorithm and let $\mB$ be the largest integer such that $\{0,\dots,\mB\}\subseteq\mathfrak m$. If $\{b_1, \dots, b_\ell\} = \emptyset \wedge \bigwedge_{j=1}^{n_C}{\bf X}[j] = 0$ or $\bigwedge_{j=1}^{n_C-1}\VerDec{\pk, b_1[j] \otimes \dots \otimes b_\ell[j],{\bf X}[j]}{{\bf P}[j]} = 1\wedge {\bf X}[n_C]=\ell-\sum_{j=1}^{n_C-1}{\bf X}[j] \wedge 1 \leq \ell \leq \mB$, then output $1$, otherwise, output $0$.*
*The above algorithms assume $n_C >1$ and we define special cases of $\VoteSymb$, $\TallySymb$ and $\VerifySymb$ when $n_C = 1$:*
- *$\Vote[\PKT,n_C,\beta,k]$. Parse $\PKT$ as a vector $(\pk,\allowbreak\mathfrak m,\allowbreak\rho)$. Output $\perp$ if parsing fails or $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\rho} \not=\allowbreak 1
\allowbreak\vee\allowbreak \beta\not=1$. Select coins $r$ uniformly at random, compute $m \leftarrow 1;c \leftarrow \EEnc[\pk]{\allowbreak m;\allowbreak r};\sigma \leftarrow \SignCiphh{\pk,\allowbreak c,\allowbreak\{0,1\}}{\allowbreak m,\allowbreak r}$, and output ballot $(c,\allowbreak\sigma)$.*
- *$\Tally[\SKT,\bbb,n_C,k]$. Initialize ${\bf X}$ and ${\bf P}$ as vectors of length $1$. Compute ${\bf X}[1]\leftarrow 0$. Parse $\SKT$ as a vector $(\pk,\sk)$. Output $({\bf X},{\bf P})$ if parsing fails. Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ such that for all $1 \leq i \leq \ell$ we have $b_i$ is a vector of length $2$ and $\VerCiphh{\pk,b_i[1],\{0,1\}}{b_i[2]} =1$. If $\{b_1, \dots, b_\ell\} = \emptyset$, then output $({\bf X},{\bf P})$. Otherwise, compute $c \leftarrow b_1[1] \otimes \dots \otimes b_\ell[1];{\bf X}[1] \leftarrow\DDec[\sk]{c};{\bf P}[1] \leftarrow \ProveDec{\pk, c,{\bf X}[1]}{\sk}$ and output $({\bf X},{\bf P})$.*
- *$\Verify[\PKT,\bbb,n_C,{\bf X},{\bf P},k]$. Parse ${\bf X}$ and ${\bf P}$ as vectors of length $1$, and parse $\PKT$ as a vector $(\pk,\mathfrak m,\rho)$. Output $0$ if parsing fails or $\VerKey{k,\pk,\mathfrak m}{\rho} \not= 1$. Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ satisfying the conditions given by the tally algorithm and let $\mB$ be the largest integer such that $\{0,\dots,\mB\}\subseteq\mathfrak m$. If $\{b_1, \dots, b_\ell\} = \emptyset \wedge {\bf X}[1] = 0$ or $\VerDec{\pk, b_1[1] \otimes \dots \otimes b_\ell[1],{\bf X}[1]}{{\bf P}[1]} = 1 \wedge 1 \leq \ell \leq \mB$, then output $1$, otherwise, output $0$.*
Generalized Helios works as follows. $\SetupSymb$ generates the tallier’s key pair. The public key includes a non-interactive proof demonstrating that the key pair is correctly constructed. $\VoteSymb$ takes a choice $\beta\in\{1,\allowbreak\dots,\allowbreak n_C\}$ and outputs ciphertexts $c_1,\dots,c_{n_C-1}$ such that if $\beta < n_C$, then ciphertext $c_\beta$ contains plaintext $1$ and the remaining ciphertexts contain plaintext $0$, otherwise, all ciphertexts contain plaintext $0$. $\VoteSymb$ also outputs proofs $\sigma_1, ..., \sigma_{n_C}$ so that this can be verified. In particular, proof $\sigma_j$ demonstrates ciphertext $c_j$ contains $0$ or $1$, for all $1 \leq j \leq n_C-1$. And proof $\sigma_{n_C}$ demonstrates that the homomorphic combination of ciphertexts $c_1 \otimes\cdots\otimes c_{n_C-1}$ contains $0$ or $1$. (It follows that the voter’s ballot contains a vote for exactly one candidate.) $\TallySymb$ homomorphically combines ciphertexts representing votes for a particular candidate and decrypts the homomorphic combinations. The number of votes for a candidate $\beta\in\{1,\dots,n_C-1\}$ is simply the homomorphic combination of ciphertexts representing votes for that candidate. The number of votes for candidate $n_C$ is equal to the number of votes for all other candidates subtracted from the total number of valid ballots on the bulletin board. $\VerifySymb$ checks that each of the above steps has been performed correctly.
Lemma 1 demonstrates that generalized Helios is a construction for election schemes.
**Lemma 1**. *$\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H)$ satisfies Correctness, where $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the preconditions of Definition 2.*
# Proof: Helios 2.0 is not verifiable
Chang-Fong & Essex (**Essex16:HeliosVerifiability?**) demonstrate that Helios 2.0 is not verifiable and we prove that Helios 2.0 does not satisfy $\EVEA$. Our proof formalizes the attack by Chang-Fong & Essex (**Essex16:HeliosVerifiability?**) in the context of our Completeness definition using the adversary we define in Figure 1. Intuitively, that adversary computes a ciphertext with a masked term (Line 1) and falsifies a proof of correct construction in a manner that hides malice (Lines 2–12). In particular, the proof ensures $c_1 \not\equiv 0 \pmod{2}$, which causes cancellation of the mask during verification. A ballot is constructed from that ciphertext and proof, and added to a bulletin board (Line 14). The ballot is valid, hence, it will be decrypted during tallying, yet correct decryption cannot be proved, due to the masked ciphertext, thus, verification will fail and Completeness is not satisfied.
**Definition 1** (Weak Fiat-Shamir transformation (**Bernhard12:Helios?**)). *The *weak Fiat-Shamir transformation* is a function $\FSSymb$ that is identical to $\sFSSymb$, except that it excludes statement $s$ in the hashes computed by $\ProveSymb$ and $\VerSymb$, as follows: $\chal \leftarrow\mathcal H(\comm)$.*
**Definition 2** (Helios 2.0). *Let $\widehat{\mathsf{Helios}}$ be $\mathsf{Helios}$ after replacing all instances of the Fiat-Shamir transformation with the weak Fiat-Shamir transformation and excluding the (optional) messages input to $\SignCiphSymb$—i.e., $\SignCiphSymb$ should be used as a ternary function. *Helios 2.0* is $\widehat{\mathsf{Helios}}(\Gamma,\Sigma_1, \allowbreak\Sigma_2, \Sigma_3, \allowbreak\mathcal H)$, where $\Gamma$ is additively homomorphic El Gamal (**CramerGennaroSchoenmakers97:AdditiveElGamal?**), $\Sigma_1$ is the sigma protocol for proving knowledge of discrete logarithms by Chaum et al. (**Chaum86?**, Protocol 2), $\Sigma_2$ is the sigma protocol for proving knowledge of disjunctive equality between discrete logarithms by Cramer et al. (**CramerFranklinSchoenmakersYung96?**), $\Sigma_3$ is the sigma protocol for proving knowledge of equality between discrete logarithms by Chaum and Pedersen (**Pedersen92?**), and $\mathcal H$ is SHA-256 (**SHA?**).*
We assume the sigma protocols used by Helios 2.0 satisfy the preconditions of generalized Helios—that is, (**Chaum86?**, Protocol 2) is a sigma protocol for proving correct key construction, (**CramerFranklinSchoenmakersYung96?**) is a sigma protocol for proving plaintext knowledge in a subspace, and (**Pedersen92?**) is a sigma protocol for proving decryption. We leave formally proving this assumption as future work. Under this assumption, Lemma [lem:Helios-is-correct] demonstrates that Helios 2.0 is an election scheme.
Let $\SetupSymb$, $\TallySymb$ and $\VerifySymb$ be the setup, tallying and verification algorithms defined by Helios 2.0. Moreover, let $\Gamma =\allowbreak (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$, $\FS{\Sigma_1}{\allowbreak\mathcal H} =\allowbreak (\ProveKeySymb,\allowbreak \VerKeySymb)$, and $\FS{\Sigma_3}{\allowbreak\mathcal H} =\allowbreak (\ProveDecSymb,\allowbreak \VerDecSymb)$. We construct an adversary $\adv$ (Figure 1) against the Completeness experiment.
Given a public key $\PKT$ and security parameter k as input, adversary $\adv$ parses $\PKT$ as a vector $(\pk,\mathfrak m,\rho)$ and $\pk$ as (p, q, g, h), computes a generator g′ of a sub-group of order 2 such that g′ ∣ p − 1, selects coins r, and computes:
e ← (g′ ⋅ gr mod p, hr ⋅ g mod p)f1 ← w + c1 ⋅ r (mod q)σ ← (A0, B0, c0, f0, A1, B1, c1, f1)nC ← 2$\bbb \leftarrow \{(e,\sigma,\sigma)\}$$(n_C,\bbb)$
Adversary against Helios 2.0
Suppose $k$ is a security parameter, $(\PKT,\SKT,\mB, \mC)$ is an output of $\Setup[k]$, and $(\bbb,n_C)$ is an output of $\adv(\PKT,k)$, such that $|\bbb| \leq \mB \wedge n_C\leq \mC$. By definition of $\SetupSymb$, we have $\PKT$ parses as $(\pk,\mathfrak m,\rho)$ and $\SKT$ parses as $(\pk,\sk)$, such that $(\pk,\allowbreak\sk,\allowbreak\mathfrak m) = \GGen[k;\allowbreak s]$ and $\rho$ is an output of $\ProveKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\sk,\allowbreak s}$ for some coins $s$ chosen uniformly at random by $\SetupSymb$. By definition of $\GGenSymb$, we have $\pk$ parses as $(p,q,g,h)$. And by definition of $\adv$, we have $n_C = 2$ and $\bbb = \{(e,\sigma,\sigma)\}$, where $e$ and $\sigma$ are computed by the adversary. Further suppose $({\bf X},{\bf P})$ is an output of $\Tally[\SKT, \bbb, n_C,k]$.
Let us recall the definition of $\VerCiphSymb$ (cf. (**CramerFranklinSchoenmakersYung96?**), Definition 1, and Helios 2.0 source code) and consider whether $\VerCiphh{\pk,e,\{0,1\}}{\sigma} = 1$:
- $\VerCiphh{\pk,e,\{0,1\}}{\sigma}$. Parses $\pk$ as $(p,\allowbreak q,\allowbreak g, \allowbreak h)$, $e$ as $(R,S)$, and $\sigma$ as $(A_0,B_0,c_0,f_0,A_1,B_1,c_1,\allowbreak f_1)$, outputting $0$ if parsing fails. If $g^{f_0} \equiv A_0 \cdot R^{c_0} \pmod{p} \wedge
h^{f_0} \equiv B_0 \cdot S^{c_0} \pmod{p} \wedge
g^{f_1} \equiv A_1 \cdot R^{c_1} \pmod{p} \wedge
h^{f_1} \equiv B_1 \cdot (S/g)^{c_1} \pmod{p} \wedge
\mathcal H(A_0,B_0,A_1,B_1) \equiv c_0 + c_1 \pmod{q}$, then output $1$, otherwise, output $0$.
By definition of $\adv$, we have $\sigma = (A_0,B_0,c_0,f_0,A_1,B_1,c_1,\allowbreak f_1)$. Moreover, we have $e[1] \equiv g'\cdot g^r \pmod{p}$, $e[2] \equiv h^r\cdot g \pmod{p}$, $A_0 \equiv g^{f_0}\cdot e[1]^{-c_0} \pmod{p}$, and $B_0 \equiv h^{f_0}\cdot e[2]^{-c_0} \pmod{p}$, where $g'$ is a generator of a sub-group of order $2$ such that $g'\mid p-1$ and $c_0$, $f_0$ and $r$ are coins. Hence, we trivially have $$\begin{aligned}
&g^{f_0} \equiv g^{f_0}\cdot e[1]^{-c_0} \cdot e[1]^{c_0} \equiv A_0 \cdot e[1]^{c_0} \pmod{p}\\
&h^{f_0} \equiv h^{f_0}\cdot e[2]^{-c_0} \cdot e[2]^{c_0} \equiv B_0 \cdot e[2]^{c_0}\pmod{p}
\end{aligned}$$ By definition of $\adv$, we also have $A_1 \equiv g^{w} \pmod{p}$, $B_1 \equiv h^{w} \pmod{p}$, $c_1 \equiv \mathcal H(A_0,B_0,A_1,B_1) - c_0\pmod{q}$, and $f_1 \equiv w+c_1\cdot r \pmod{q}$, such that $c_1 \equiv 0 \pmod{2}$, where $w$ are coins. Hence, we have $$\begin{aligned}
g^{f_1} &\equiv g^{w} \cdot g^{c_1\cdot r} \pmod{p}
%
\intertext{%
and, since $c_1 \equiv 0 \pmod{2}$, we have
$g'^{c_1} \equiv 1 \pmod{p}$, thus,
}
&\equiv g^{w} \cdot g'^{c_1}\cdot g^{c_1 \cdot r} \pmod{p} \\
&\equiv g^{w} \cdot (g'\cdot g^{r})^{c_1} \pmod{p} \\
&\equiv g^{w} \cdot e[1]^{c_1} \pmod{p}
\end{aligned}$$ Moreover, we trivially have $$h^{f_1} \equiv h^{w} \cdot h^{c_1\cdot r} \equiv h^{w} \cdot (h^r\cdot g /g)^{c_1} \equiv
B_1 \cdot (e[2]/g)^{c_1} \pmod{p}$$ Furthermore, we have $\mathcal H(A_0,B_0,A_1,B_1) \equiv c_0 + c_1 \pmod{q}$. Hence, $\VerCiphh{\pk,e,\{0,1\}}{\sigma} = 1$. It follows that $\bbb$ is the largest subset of $\bbb$ satisfying the conditions defined by algorithm $\TallySymb$. Thus, ${\bf X} = (\DDec[\sk]{e}, 1-\DDec[\sk]{e})$ and ${\bf P}$ is an output of $\ProveDec{\pk, e,{\bf X}[1]}{\sk}$. It remains to show $\Verify[\PKT,\bbb,n_C,{\bf X},P,k] \not= 1$ with non-negligible probability. By definition of $\VerifySymb$, it suffices to show $\VerDec{\pk, e,{\bf X}[1]}{{\bf P}[1]} \not= 1$.
Let us recall definitions of $\ProveDecSymb$ and $\VerDecSymb$ (cf. (**Pedersen92?**), Definition 1, and Helios 2.0 source code):
- $\ProveDec{\pk, e,m}{\sk}$. Parses $\pk$ as $(p,\allowbreak q,\allowbreak g,\allowbreak h)$, outputting $0$ if parsing fails. Computes $w \leftarrow_R \mathbb Z_q;
A\leftarrow g^w \pmod{p};
B\leftarrow e[1]^w \pmod{p};
c\leftarrow \mathcal H(A,B) \pmod{q};
f\leftarrow w + c\cdot \sk \pmod{q}$. And outputs $(A,B,f)$
- $\VerDec{\pk, e,m}{\tau}$. Parses $\pk$ as $(p,q,g,h)$ and $\tau$ as $(A,B,f)$, outputting $0$ if parsing fails. If $g^f \equiv A \cdot h^c \pmod{p}$ and $e[1]^f \equiv B \cdot (e[2]/g^m) ^c \pmod{p}$, then output $1$, otherwise, output $0$, where $c \equiv \mathcal H(A,B) \pmod{q}$.
Hence, we have ${\bf P} = (A,B,f)$ such that $B\equiv e[1]^w \pmod{p}$ and $f\equiv w + c\cdot \sk \pmod{q}$, where $c\equiv \mathcal H(A,B) \pmod{q}$ and coins $w$ were selected by $\ProveDecSymb$. Thus, $e[1]^f \not\equiv B \cdot (e[2]/g^{{\bf X}[1]}) ^c \pmod{p}$, concluding our proof.
# Proof: Helios 3.1.4 is not verifiable
Helios 2.0 is vulnerable to attacks because it does not check the suitability of cryptographic parameters, nor does it check that all elements of ballots are constructed using the correct parameters. Chang-Fong & Essex (**Essex16:HeliosVerifiability?**) address these vulnerabilities by performing the necessary checks.
**Definition 1** (Helios 3.1.4). *Election scheme *Helios 3.1.4* is *Helios 2.0* after modifying the sigma protocols to perform the checks proposed by Chang-Fong & Essex (**Essex16:HeliosVerifiability?**).*
Bernhard et al. (**Bernhard12:Helios?**) demonstrate that Helios 2.0 is not verifiable and we prove that Helios 3.1.4 does not satisfy $\EVEA$. Our proof formalizes the attack by Bernhard et al. (**Bernhard12:Helios?**) in the context of our universal verifiability experiment using the adversary we define in Figure 1. That adversary computes the challenge hash (Line 9) before computing a ciphertext. (This is possible because weak Fiat-Shamir does not include statements in hashes, hence, ciphertexts are not included in hashes.) Moreover, the adversary computes: a private key as a function of that hash (Line 11), challenges as functions of the hash and the private key (Lines 13 & 14), and responses as functions of the challenges and some coins (Lines 18 & 19). Furthermore, the adversary computes a public key from the private key (Line 23) and a proof of correct key generation (Line 25). That proof is valid, because the private key could have been correctly computed. The adversary encrypts a plaintext $m$ (such that $m>1$) using the aforementioned coins (Line 27) and proves correct decryption of that ciphertext (Line 33). That proof is valid, because the ciphertext is well-formed. Finally, the adversary claims $(m,m-1)$ is the election outcome corresponding to the ballot containing the ciphertext and falsified proof of correct construction. The verification procedure will accept that outcome, because all proofs hold, yet the election outcome is clearly invalid, hence, universal verifiability is not satisfied.
Let $\VoteSymb$ and $\TallySymb$ be the vote and tallying algorithms defined by Helios 3.1.4. Moreover, let $\FS{\Sigma_1}{\allowbreak\mathcal H} =\allowbreak (\ProveKeySymb,\allowbreak \VerKeySymb)$, $\FS{\Sigma_2}{\allowbreak\mathcal H} =\allowbreak (\SignCiphSymb, \allowbreak\VerCiphSymb)$ and $\FS{\Sigma_3}{\allowbreak\mathcal H} =\allowbreak (\ProveDecSymb,\allowbreak \VerDecSymb)$. We construct an adversary $\adv$ (Figure 1) against the universal verifiability experiment.
Given a security parameter k as input, adversary $\adv$ computes primes p and q such that p = 2 ⋅ q + 1 and q is of length k, and also computes a generator g of the multiplicative group ℤp*. Let nC ← 2 and 𝔪 ← ℕq − 1, moreover, let m > 1 be an element of 𝔪. The adversary proceeds as follows:
where r′ is computed such that $(\pk,x,\mathfrak m) = \GGen[k;r']$.
Adversary against Helios 3.1.4
Suppose an execution of $\ExpUVSymb$ computes $$\begin{aligned}
&(\PKT,\bbb,n_C,{\bf X}, P) \leftarrow \adv(k); \\
&{\bf Y}\gets \correcttally(\pk,\bbb,n_C,k)
\end{aligned}$$ Since $m>1$, there is no choice $\beta\in\{1,2\}$ nor coins $r$ such that $\Vote[\PKT,n_C,\beta,\allowbreak k; r]\in\bbb$. By definition of function $\correcttally$, we have ${\bf Y} = (0,0)$. Moreover, since ${\bf X} = (m,1-m)$, we have ${\bf X} \not= {\bf Y}$ and ${\bf X}[2] = 1 - {\bf X}[1]$. Let us show that $\Verify[\PKT,\bbb,n_C,{\bf X},P,k] = 1$.
By definition of $\adv$, we have $\PKT$ is a vector $(\pk,\mathfrak m,\rho)$. Moreover, by the completeness of $(\ProveKeySymb, \VerKeySymb)$ and $(\ProveDecSymb, \VerDecSymb)$, we have $\VerKey{k,\pk,\mathfrak m}{\rho} = 1$ and $\VerDec{\pk, e,{\bf X}[1]}{\allowbreak{\bf P}[1]} = 1$. It remains to show that $\bbb$ is the largest subset of $\bbb$ satisfying the conditions given by the $\TallySymb$ algorithm. Since $\bbb = \{(e,\sigma,\sigma)\}$ and $(e,\sigma,\sigma)$ is a vector of length $2\cdot n_C -1$, it suffices to show that $\VerCiphh{\pk,e,\{0,1\}}{\sigma} =1$. Let us recall the definition of $\VerCiphSymb$ (cf. (**CramerFranklinSchoenmakersYung96?**), Definition [def:wfs], and Helios source code) with the additional checks proposed by Chang-Fong & Essex (**Essex16:HeliosVerifiability?**):
- $\VerCiphh{\pk,e,\{0,1\}}{\sigma}$. Parses $\pk$ as $(p,\allowbreak q,\allowbreak g, \allowbreak h)$, $e$ as $(R,S)$, and $\sigma$ as $(A_0,B_0,c_0,f_0,A_1,B_1,c_1,\allowbreak f_1)$, outputting $0$ if parsing fails or $R$, $S$, $A_0$, $B_0$, $A_1$ or $B_1$ belong to the wrong group. If $g^{f_0} \equiv A_0 \cdot R^{c_0} \pmod{p} \wedge
h^{f_0} \equiv B_0 \cdot S^{c_0} \pmod{p} \wedge
g^{f_1} \equiv A_1 \cdot R^{c_1} \pmod{p} \wedge
h^{f_1} \equiv B_1 \cdot (S/g)^{c_1} \pmod{p} \wedge
\mathcal H(A_0,B_0,A_1,B_1) \equiv c_0 + c_1 \pmod{q}$, then output $1$, otherwise, output $0$.
By definition of $\adv$, we have $R$, $S$, $A_0$, $B_0$, $A_1$ and $B_1$ belong to the right group. And we have $$\begin{aligned}
&g^{f_0} \equiv g^{a_0 + c_0 \cdot r} \equiv g^{a_0} \cdot (g^r)^{c_0} \equiv A_0 \cdot R^{c_0} \pmod{p}\\
&g^{f_1} \equiv g^{a_1 + c_1 \cdot r} \equiv g^{a_1} \cdot (g^r)^{c_1} \equiv A_1 \cdot R^{c_1} \pmod{p}
\end{aligned}$$ Moreover, we have $h^{f_0} \equiv g^{x(a_0+c_0\cdot r)}\pmod{p}$ and $B_0\cdot S^{c_0} \equiv g^{b_0 + c_0 (x\cdot r + m)}\pmod{p}$, hence, to show $h^{f_0} \equiv B_0 \cdot S^{c_0} \pmod{p}$, it is sufficient to show $(b_0 + c_0\cdot m) \equiv x\cdot a_0 \pmod{q}$: $$\begin{array}{l}
b_0 + c_0\cdot m\\
\equiv b_0 + c\cdot m - m\cdot c_1 \\
\equiv b_0 + c\cdot m - \frac{b_1\cdot m - a_1\cdot m \cdot x }{1-m} \\
\equiv \frac{(b_0 + c\cdot m)(1-m) - b_1\cdot m + a_1\cdot m \cdot x}{1-m} \\
\equiv \frac{(b_0 + c\cdot m)(1-m) - b_1\cdot m + \frac{a_1\cdot m \cdot\left((b_0+c\cdot m)(1-m)-b_1\cdot m\right)}{a_0(1-m)-a_1\cdot m}}{1-m} \\
\equiv \frac{\left(a_0(1-m)-a_1\cdot m\right)\left((b_0 + c\cdot m)(1-m) - b_1\cdot m\right)}{(1-m)(a_0(1-m)-a_1\cdot m)}\\
\hspace{3ex}+ \frac{a_1\cdot m ((b_0+c\cdot m)(1-m)-b_1\cdot m)}{(1-m)(a_0(1-m)-a_1\cdot m)} \\
\equiv \frac{a_0(1-m)\left((b_0 + c\cdot m)(1-m) - b_1\cdot m\right)}{(1-m)(a_0(1-m)-a_1\cdot m)} \\
\equiv \frac{a_0 \cdot\left((b_0+c\cdot m)(1-m) - b_1\cdot m\right)}{a_0(1-m)-a_1\cdot m} \\
\equiv x\cdot a_0 \pmod{q}
\end{array}$$ Similarly, $h^{f_1} \equiv g^{x(a_1+c_1\cdot r)}\pmod{p}$ and $B_1\cdot (S/g)^{c_1} \equiv g^{b_1 + c_1 (x\cdot r + m -1)} \pmod{p}$, hence, to show $h^{f_1} \equiv B_1 \cdot (S/g)^{c_1} \pmod{p}$, it is sufficient to show $b_1 + c_1(m - 1) \equiv a_1 \cdot x \pmod{q}$: $$\begin{array}{l}
b_1 + c_1(m - 1) \\
\equiv b_1 + \frac{(m-1)(b_1 - a_1 \cdot x)}{1-m} \\
\equiv \frac{b_1(1-m) +(m-1)(b_1 - a_1 \cdot x)}{1-m} \\
\equiv \frac{a_1 \cdot x(1-m)}{1-m} \\
\equiv a_1 \cdot x \pmod{q}
\end{array}$$ Furthermore, we have $$\begin{gathered}
\mathcal H(A_0,B_0,A_1,B_1) \equiv c_0 + c_1 \equiv c- c_1 + c_1 \\
\equiv\mathcal H(A_0,B_0,A_1,B_1) - c_1 + c_1\pmod{q}
\end{gathered}$$ It follows that $\VerCiphh{\pk,e,\{0,1\}}{\sigma} =1$, concluding our proof.
# Proof: is Verifiable
Elections schemes constructed from generalized Helios satisfy individual (§1.1) and universal (§1.2) verifiability, assuming cryptographic primitives satisfy certain properties that we identify. It follows that satisfies election verifiability with external authentication (§[sec:helios-proof-thm]).
## Individual verifiability
**Definition 1** (Collision-free). *Suppose $\Gamma = (\GGenSymb,\EEncSymb,\allowbreak\DDecSymb)$ is an asymmetric encryption scheme, $\Sigma_1$ proves correct key construction, $\mathcal H$ is a hash function, and $\mathfrak m$ and $\mathfrak m'$ are message spaces such that $\mathfrak m\subseteq\mathfrak m'$. Let $\sFS{\Sigma_1}{\mathcal H} = (\ProveKeySymb, \VerKeySymb)$. If for all security parameters $k$, public keys $\pk$, proofs $\rho$, messages $m_1,m_2\in\mathfrak{m}$, and coins $r_1$ and $r_2$, we have $$\begin{gathered}
\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m'}{\allowbreak\rho}\allowbreak =\allowbreak 1\wedge\left(m_1 \not= m_2 \vee r_1 \not= r_2\right)\\ \Rightarrow\EEncSymb(\pk,m_1;r_1) \not=\EEncSymb(\pk,m_2;r_2)
\end{gathered}$$ Then we say $\Gamma$ is *collision-free for $\mathfrak m$*.*
**Proposition 1**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the preconditions of Definition [def:elec:helios]. Further suppose that $\Gamma$ is collision-free for $\{0,1\}$. We have $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \allowbreak\Sigma_3, \mathcal H)$ satisfies individual verifiability.*
Let $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H) = (\SetupSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\Gamma = (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$, and $\sFS{\Sigma_1}{\mathcal H} = (\ProveKeySymb, \allowbreak\VerKeySymb)$. Suppose $k$ is a security parameter, $\PKT$ is a public key, $n_C$ is an integer, and $\beta$ and $\beta'$ are choices. Further suppose $b$ is an output of $\Vote[\PKT,n_C,\beta,k]$ and $b'$ is an output of $\Vote[\PKT,n_C,\beta',k]$ such that $b\neq{\perp}$ and $b'\neq{\perp}$. By definition of $\VoteSymb$, we have $\PKT$ parses as a vector $(\pk,\mathfrak m,\rho)$ and $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\rho} = 1$. Moreover, $b[1]$ is an output of $\EEnc[\pk]{m}$, and $b'[1]$ is an output of $\EEnc[\pk]{m'}$, where $m,m'\in\{0,1\}$. Furthermore, the ciphertexts are constructed using coins chosen uniformly at random—i.e., the coins used by $b[1]$ and $b'[1]$ will be distinct with overwhelming probability. Since $\Gamma$ is collision-free for $\{0,1\}$, we have $b[1]\not=b'[1]$ and $b\not= b'$ with overwhelming probability, concluding our proof.
## Universal verifiability
**Lemma 2**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the preconditions of Definition [def:elec:helios]. Further suppose $\Gamma$ is collision-free for $\{0,1\}$. We have $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H)$ satisfies Injectivity.*
The proof of Lemma 2 is similar to the proof of Proposition 1.
Let $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H) = (\SetupSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\Gamma = (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$, and $\sFS{\Sigma_1}{\allowbreak\mathcal H} = (\ProveKeySymb,\allowbreak \VerKeySymb)$. Suppose $k$ is a security parameter, $\PKT$ is a public key, $n_C$ is an integer, and $\beta$ and $\beta'$ are choices such that $\beta\not=\beta'$. Further suppose $b$ is an output of $\Vote[\PKT,n_C,\beta,k]$ and $b'$ is an output of $\Vote[\PKT,n_C,\beta',k]$ such that $b\not={\perp}$ and $b'\not={\perp}$. By definition of $\VoteSymb$, we have $\PKT$ is a vector $(\pk,\mathfrak m,\rho)$ and $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\rho} = 1$. Moreover, there exist coins $r$ and $r'$ such that $$\begin{aligned}
b[1] &= \EEnc[\pk]{m;r} \textrm{, where }
%
m = \left\{
\begin{array}{ll}
1 & \textrm{if $\beta = 1$} \\
0 & \textrm{otherwise}
\end{array} \right. \\
%
\intertext{and}
%
b'[1] &= \EEnc[\pk]{m';r'} \textrm{, where }
%
m' = \left\{
\begin{array}{ll}
1 & \textrm{if $\beta' = 1$} \\
0 & \textrm{otherwise}
\end{array} \right.
\end{aligned}$$ Since $\beta\not=\beta'$, we have $m\not= m'$. And, since $\Gamma$ if collision-free for $\{0,1\}$, we have $b[1]\not=b'[1]$ and, therefore, $b\not=b'$, concluding our proof.
**Proposition 3**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the preconditions of Definition [def:elec:helios]. Further suppose $\Gamma$ is perfectly correct, perfectly homomorphic, and collision-free for $\{0,1\}$, $\Sigma_1$, $\Sigma_2$ and $\Sigma_3$ satisfy special soundness and special honest verifier zero-knowledge, and $\mathcal H$ is a random oracle. We have $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H)$ satisfies universal verifiability.*
Let $\Pi = \mathsf{Helios}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \mathcal H) = (\SetupSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\sFS{\Sigma_1}{\allowbreak\mathcal H} = (\ProveKeySymb, \allowbreak\VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} = (\SignCiphSymb, \allowbreak\VerCiphSymb)$, and $\sFS{\Sigma_3}{\allowbreak\mathcal H} = (\ProveDecSymb,\allowbreak \VerDecSymb)$. By Theorem [thm:sigma], each of the non-interactive proof systems satisfies simulation sound extractability.
Suppose $k$ is a security parameter and $\adv$ is a PPT adversary. Further suppose that an execution of $\ExpUV$ computes $$\begin{aligned}
&(\PKT,\bbb,n_C,{\bf X}, P) \leftarrow \adv(k); \\
&{\bf Y}\gets \correcttally(\PKT,\bbb,n_C,k)
\end{aligned}$$ such that $\Verify[\PKT,\bbb,n_C,{\bf X},P,k] = 1$. (If $\Verify[\allowbreak\PKT,\allowbreak\bbb,\allowbreak n_C,\allowbreak {\bf X},\allowbreak P,\allowbreak k] \not= 1$, then we can conclude immediately.) We focus on the case $n_C>1$; the case $n_C=1$ is similar.
By definition of the verification algorithm, vector ${\bf X}$ is of length $n_C$ and $P$ is a vector of length $n_C-1$. Moreover, $\PKT$ is a vector $(\pk,\mathfrak m,\rho)$. Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ such that for all $1 \leq i \leq \ell$ we have $b_i$ is a vector of length $2\cdot n_C-1$ and $\bigwedge_{j = 1}^{n_C-1} \VerCiph{\pk,b_i[j],\{0,1\}}{b_i[j+n_C-1]}{j} =1 \wedge
\VerCiph{\pk,b_i[1]\otimes\cdots\otimes b_i[n_C-1],\{0,1\}}{b_i[2 \cdot n_C-1]}{n_C} =1$.
We have for all choices $\beta\in\{1,\dots,n_C\}$, coins $r$ and ballots $b=\Vote[\PKT,n_C,\allowbreak\beta,k; r]$ that $b \not\in
\bbb \setminus \{b_1, \dots, b_\ell\}$ with overwhelming probability, since such an occurrence would imply a contradiction: $\{b_1, \dots, b_\ell\}$ is not the largest subset of $\bbb$ satisfying the conditions given by the tally algorithm, because $b$ is a vector of length $2\cdot n_C - 1$ such that $\bigwedge_{j = 1}^{n_C-1} \VerCiph{\pk,b[j],\{0,1\}}{b[j+n_C-1]}{j} =1 \wedge
\VerCiph{\pk,b[1]\otimes\cdots\otimes b[n_C-1],\{0,1\}}{b[2 \cdot n_C-1]}{n_C} =1$ with overwhelming probability, but $b\not\in\{b_1, \dots, b_\ell\}$. It follows that: $$\begin{gathered}
\label{eq:correctTally}
\correcttally(\PKT,\bbb,n_C,k)\\
\mathrel= \correcttally(\PKT,\{b_1, \dots, b_\ell\},n_C,k)
\end{gathered}$$ A proof of ([eq:correctTally]) follows from the definition of function $\correcttally$. If $\{b_1, \dots, b_\ell\} = \emptyset$, then ${\bf Y}$ is a vector of length $n_C$ such that $\bigwedge_{j=1}^{n_C}{\bf Y}[j] = 0$ by definition of function $\correcttally$ and ([eq:correctTally]), and, since $\bigwedge_{i=j}^{n_C}{\bf X}[j] = 0$, we have ${\bf X} = {\bf Y}$ by definition of the verification algorithm, hence, $\ExpUVSymb(\Pi,\allowbreak\adv,k)$ outputs $0$ with overwhelming probability and $\Succ(\allowbreak\ExpUVSymb(\Pi,\adv,k))$ is negligible, concluding our proof. Otherwise ($\{b_1, \dots, b_\ell\} \not= \emptyset$), we proceed as follows.
By definition of the verification algorithm, we have $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\rho} = 1$. Moreover, by simulation sound extractability, we are assured that $\pk$ is an output of $\GGenSymb$ with overwhelming probability—i.e., there exists $s$ and $\sk$ such that $(\pk, \sk,\mathfrak m) \allowbreak= \GGen[k;s]$.
By simulation sound extractability, with overwhelming probability, for all $1 \leq i \leq \ell$ there exists messages $m_{i,1},\allowbreak\dots,\allowbreak m_{i,n_C-1}\in \{0,1\}$ and coins $r_{i,1},\allowbreak\dots,\allowbreak r_{i,2\cdot n_C-2}$ such that for all $1 \leq j \leq n_C-1$ we have $$\begin{gathered}
b_i[j+n_C-1] = \SignCiphSymb((\pk, b_i[j],\{0,1\}), \\
(m_{i,j}, r_{i,j}),j,k; r_{i,j+n_C-1})
\end{gathered}$$ and $$b_i[j] = \EEnc[\pk]{m_{i,j};r_{i,j}}.$$ Moreover, for all $1 \leq i \leq \ell$ we have $\sum_{j=1}^{n_C-1} m_{i,j} \in \{0,1\}$ and there exist coins $r_{i,2\cdot n_C - 1}$ such that $$\begin{gathered}
b_i[2\cdot n_C - 1] = \SignCiphSymb(\pk, c,\{0,1\}), \\
(m, r), n_C,k; r_{i,2\cdot n_C - 1})
\end{gathered}$$ with overwhelming probability, where $c\leftarrow b_i[1] \otimes \dots \otimes b_i[n_C-1]$, $m\leftarrow m_{i,1} \odot \dots \odot m_{i,n_C-1}$, and $r\leftarrow r_{i,1}\oplus\dots \oplus r_{i,n_C-1}$.
By inspection of $\VoteSymb$, for all $1 \leq i \leq \ell$ there exists $\beta_i,r_i$ such that $$b_i = \Vote[\PKT,n_C,\beta_i,k; r_i]$$ and either $\beta_i = n_C \wedge \bigwedge_{j=1}^{n_C-1} m_{i,j} = 0$ or $\beta_i \in\{1,\dots,n_C-1\} \wedge m_{i,\beta_i} = 1 \wedge \bigwedge_{j\in\{1,\dots,\beta_i-1,\beta_i+1,\dots,n_C-1\}} m_{i,j} \allowbreak= 0$. It follows for all $1\leq i \leq \ell$ and $1\leq j \leq n_C-1$ that: $$\label{eq:choice:prop:Helios}
m_{i,j} = 0 \Longleftrightarrow \beta_i = n_C \vee \beta_i \not= j$$ $$\label{eq:choiceII:prop:Helios}
m_{i,j} = 1 \Longleftrightarrow \beta_i = j$$ Moreover, for all $1\leq i \leq \ell$ we have: $$\label{eq:choiceIII:prop:Helios}
\sum_{j=1}^{n_C-1} m_{i,j} = 0 \Longleftrightarrow \beta_i = n_C$$ Furthermore, we have the following facts:
**Fact 1**. *For all integers $\beta$ and $n$ such that $1\leq \beta \leq n_C$, we have: $$\begin{gathered}
\exists^{=n} b\in(\{b_1,\dots,b_\ell\}\setminus\{\perp\}) : \\\exists r : b=\Vote[\PKT,n_C,\beta,k; r]
\\\iff \exists^{=n} i\in\{1,\dots,\ell\} : \beta = \beta_i
\end{gathered}$$*
**Fact 2**. *For all integers $j$ and $n$ such that $1\leq j \leq n_C-1$, we have: $$\exists^{=n} i\in\{1,\dots,\ell\} : \beta_i = j
\iff n= \sum_{i=1}^\ell m_{i,j}$$*
For the forward implication, suppose $j,n$ are integers such that $1\leq j \leq n_C-1$ and $\exists^{=n} i\in\{1,\dots,\ell\} : \beta_i = j$. We proceed by induction on $\ell$. In the base case ($\ell=0$), we have $n=0$, hence, $n= \sum_{i=1}^\ell m_{i,j}$. In the inductive case, we distinguish two cases. Case I: $\exists^{=n} i\in\{1,\dots,\ell-1\} : \beta_i = j$ holds. We have $\beta_\ell \not= j$ by definition of the counting quantifier and, hence, $m_{i,j} = 0$ by ([eq:choice:prop:Helios]). By our induction hypothesis, we derive $n= \sum_{i=1}^{\ell-1} m_{i,j}= \sum_{i=1}^{\ell} m_{i,j}$. Case II: $\exists^{=n} i\in\{1,\dots,\ell-1\} : \beta_i = j$ does not hold. We have $\beta_\ell = j$ by definition of the counting quantifier and, hence, $m_{i,j} = 1$ by ([eq:choiceII:prop:Helios]). Moreover, we have $\exists^{=n-1} i\in\{1,\dots,\ell-1\} : \beta_i = j$ holds. By our induction hypothesis, we derive $n-1 = \sum_{i=1}^{\ell-1} m_{i,j}$, that is, $n= \sum_{i=1}^{\ell} m_{i,j}$.
For the reverse implication, suppose $j,n$ are integers such that $1\leq j \leq n_C-1$ and $n= \sum_{i=1}^\ell m_{i,j}$. We proceed by induction on $\ell$. In the base case ($\ell=0$), we have $n= 0$, hence, $\exists^{=n} i\in\{1,\dots,\ell\} : \beta_i = j$. In the inductive case, we distinguish two cases. Case I: $n= \sum_{i=1}^{\ell-1} m_{i,j}$. We have $m_{\ell,j} = 0$, hence, $\beta_\ell\not=j$ by ([eq:choice:prop:Helios]). By our induction hypothesis, we have $\exists^{=n} i\in\{1,\dots,\ell-1\} : \beta_i=j$. Since $\beta_\ell\not=j$, the result follows. Case II: $n\not= \sum_{i=1}^{\ell-1} m_{i,j}$. Since $m_{\ell,j}\in \{0,1\}$, we have $m_{\ell,j} = 1$, hence, $\beta_\ell =j$ by ([eq:choiceII:prop:Helios]). Moreover, we have $n-1 = \sum_{i=1}^{\ell-1} m_{i,j}$. By our induction hypothesis, we derive $\exists^{=n-1} i\in\{1,\dots,\ell-1\} : \beta_i=j$. The result follows.
**Fact 3**. *For all integers $n$, we have $$\exists^{=n} i\in\{1,\dots,\ell\} : \beta_i = n_C
\iff n= \ell-\sum_{j=1}^{n_C-1}\sum_{i=1}^\ell m_{i,j}$$*
For the forward implication, suppose $\exists^{=n} i\in\{1,\dots,\ell\} : \beta_i = n_C$. We proceed by induction on $\ell$. In the base case ($\ell=0$), we have $n=0$, hence, $n= \ell-\sum_{j=1}^{n_C-1}\sum_{i=1}^\ell m_{i,j}$. In the inductive case, we distinguish two cases. Case I: $\exists^{=n} i\in\{1,\dots,\ell-1\} : \beta_i=n_C$ holds. We have $\beta_\ell \not= n_C$ by definition of the counting quantifier and we derive $\sum_{j=1}^{n_C-1} m_{\ell,j} \not= 0$ by ([eq:choiceIII:prop:Helios]). Moreover, since $\sum_{j=1}^{n_C-1} m_{\ell,j} \in \{0,1\}$, we have $\sum_{j=1}^{n_C-1} m_{\ell,j} = 1$. By our induction hypothesis, we derive $n= \ell-1-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell-1} m_{i,j} = \ell-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell} m_{i,j}$. Case II: $\exists^{=n} i\in\{1,\dots,\ell-1\} : \beta_i=n_C$ does not hold. We have $\beta_\ell = n_C$ by definition of the counting quantifier and we derive $\sum_{j=1}^{n_C-1} m_{i,j} = 0$ by ([eq:choiceIII:prop:Helios]). Moreover, we have $\exists^{=n-1} i\in\{1,\dots,\ell-1\} : \beta_i=n_C$ holds. By our induction hypothesis, we derive $n-1 = \ell-1-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell-1} m_{i,j}$, that is, $n= \ell-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell-1} m_{i,j} = \ell-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell} m_{i,j}$.
For the reverse implication, suppose $n= \ell-\sum_{j=1}^{n_C-1}\sum_{i=1}^\ell m_{i,j}$. We proceed by induction on $\ell$. In the base case ($\ell=0$), we have $n= 0$, hence, $\exists^{=n} i\in\{1,\dots,\ell\} : \beta_i = n_C$. In the inductive case, we distinguish two cases. Case I: $n= \ell-1-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell-1} m_{i,j}$. We have $\sum_{j=1}^{n_C-1} m_{\ell,j} = 1$. Since $m_{\ell,1},\allowbreak\dots,\allowbreak m_{\ell,n_C-1}\in \{0,1\}$, there exists $j$ such that $1\leq j \leq n_C-1$ and $m_{\ell,j} = 1$, moreover, $\beta_\ell =j$ by ([eq:choiceII:prop:Helios]), hence, $\beta_\ell \not=n_C$. By our induction hypothesis, we derive $\exists^{=n} i\in\{1,\dots,\ell-1\} : \beta_i = n_C$. The result follows. Case II: $n\not= \ell-1-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell-1} m_{i,j}$. Since $\sum_{j=1}^{n_C-1} m_{\ell,j} \in \{0,1\}$, we have $\sum_{j=1}^{n_C-1} m_{\ell,j} = 0$, and we derive $\beta_i = n_C$ by ([eq:choiceIII:prop:Helios]). Moreover, we have $n-1 = \ell-1-\sum_{j=1}^{n_C-1}\sum_{i=1}^{\ell-1} m_{i,j}$. By our induction hypothesis, we derive $\exists^{=n-1} i\in\{1,\dots,\ell-l\} : \beta_i = n_C$. The result follows.
We proceed the proof of Proposition 3 using the above facts.
By definition of the verification algorithm, we have $\bigwedge_{j=1}^{n_C-1}\VerDec{\pk, b_1[j] \otimes \dots \otimes b_\ell[j],{\bf X}[j]}{P[j]} = 1 \wedge {\bf X}[n_C]=\ell-\sum_{j=1}^{n_C-1}{\bf X}[j]$. By simulation sound extractability, we have for all $1\leq j \leq n_C-1$ that ${\bf X}[j] = \DDec[\allowbreak\sk]{\allowbreak b_1[j] \otimes\allowbreak \dots \otimes\allowbreak b_\ell[j]}$ with overwhelming probability. Although, public key $\pk$ may not have been constructed using coins chosen uniformly at random, we nevertheless have for all $1\leq j \leq n_C-1$ that $b_1[j] \otimes \dots \otimes b_\ell[j]$ is a ciphertext with overwhelming probability, because $\Gamma$ is perfectly homomorphic. Similarly, for all $1\leq j \leq n_C-1$, although ciphertext $b_1[j] \otimes \dots \otimes b_\ell[j]$ may not have been constructed using coins chosen uniformly at random nor using a public key that was constructed using coins chosen uniformly, and although private key $\sk$ may not have been constructed using coins chosen uniformly, we have $\DDec[\allowbreak\sk]{\allowbreak b_1[j] \otimes\allowbreak \dots \otimes\allowbreak b_\ell[j]} = m_{1,j} \odot \dots \odot m_{\ell,j}$ with overwhelming probability, because $\Gamma$ is perfectly correct.
Let $\mB$ be the largest integer such that $\{0,\dots,\mB\}\subseteq\mathfrak m$. By definition of the verification algorithm, we have $\ell \leq \mB$. It follows that $m_{1,j} \odot \dots \odot m_{\ell,j} = \sum_{i=1}^\ell m_{i,j}$, hence, $${\bf X}[j] = \sum_{i=1}^\ell m_{i,j}r$$ with overwhelming probability. By definition of function $\correcttally$, ([eq:correctTally]) and Fact 1, we have ${\bf Y}$ is a vector of length $n_C$ such that for all $1\leq \beta \leq n_C$ we have $${\bf Y}[\beta] = n\textrm{ if } \exists^{=n} i\in\{1,\dots,\ell\} : \beta = \beta_i$$ It follows by Facts 2 and 3 that for all $1\leq \beta \leq n_C$ we have ${\bf X}[\beta] = {\bf Y}[\beta]$ with overwhelming probability, hence, ${\bf X} = {\bf Y}$ with overwhelming probability, therefore, $\ExpUVSymb(\Pi,\allowbreak\adv,k)$ outputs $0$ with overwhelming probability and $\Succ(\allowbreak\ExpUVSymb(\Pi,\adv,k))$ is negligible, concluding our proof.
**Proposition 4**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the preconditions of Definition [def:elec:helios]. Further suppose $\Sigma_2$ satisfies special soundness and special honest verifier zero-knowledge, and $\mathcal H$ is a random oracle. We have $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H)$ satisfies Completeness.*
Let $\mathsf{Helios}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \mathcal H) = (\SetupSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\sFS{\Sigma_1}{\mathcal H} = (\ProveKeySymb,\allowbreak \VerKeySymb)$, $\sFS{\Sigma_2}{\mathcal H} = (\SignCiphSymb,\allowbreak \VerCiphSymb)$, and $\sFS{\Sigma_3}{\mathcal H} = (\ProveDecSymb,\allowbreak \VerDecSymb)$. Suppose $k$ is a security parameter and $\adv$ is a PPT adversary. Further suppose $(\PKT,\SKT,\mB, \mC)$ is an output of $\Setup[k]$, $(\bbb,n_C)$ is an output of $\adv(\PKT,k)$, and $({\bf X},P)$ is an output of $\Tally[\SKT, \bbb,n_C,k]$. Moreover, suppose $|\bbb| \leq \mB$. We focus on the case $n_C > 1$; the case $n_C = 1$ is similar. By definition of $\SetupSymb$, there exist coins $s$ such that $(\pk,\sk,\mathfrak m) = \GGen[k;s]$, $\PKT = (\pk,\mathfrak m,\rho)$, $\SKT=(\pk,\sk)$ and $\mB$ is the largest integer such that $\{0,\dots,\mB\}\subseteq\{0\} \cup\mathfrak m$, where $\rho$ is an output of $\ProveKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\sk,\allowbreak s}$. By definition of $\TallySymb$, we have ${\bf X}$ is a vector of length $n_C$ and $P$ is a vector of length $n_C-1$. It follows that $\VerifySymb$ can successfully parse ${\bf X}$, $P$, and $\PKT$. Moreover, by the completeness of $(\ProveKeySymb, \VerKeySymb)$, we have $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m}{\allowbreak\rho}\allowbreak =\allowbreak 1$ with overwhelming probability. Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ satisfying the conditions given by the tally algorithm. If $\{b_1, \dots, b_\ell\} = \emptyset$, then ${\bf X}$ is a zero-filled vector and $\VerifySymb$ outputs $1$, concluding our proof, otherwise, we proceed as follows. Since $\{b_1, \dots, b_\ell\}$ is a subset of $\bbb$, we have $\ell \leq \mB$. By definition of $\TallySymb$, we have for all $1 \leq i \leq \ell$ that $\bigwedge_{j = 1}^{n_C-1} \VerCiphSymb((\pk,\allowbreak b_i[j],\allowbreak \{0,1\}),\allowbreak b_i[j+n_C-1],\allowbreak j,k)\allowbreak =\allowbreak 1$. By Theorem [thm:sigma], we have $(\SignCiphSymb, \VerCiphSymb)$ satisfies simulation sound extractability, hence, for all $1 \leq i \leq \ell$ and all $1 \leq j \leq n_C-1$ we have $b_i[j]$ is a ciphertext with overwhelming probability. And, because $\Gamma$ is homomorphic, we have $b_1[j] \otimes \dots \otimes b_\ell[j]$ is also a ciphertext with overwhelming probability. By definition of $\TallySymb$ and completeness of $(\ProveDecSymb, \VerDecSymb)$, we have $\bigwedge_{j=1}^{n_C-1}\VerDec{\pk, b_1[j] \otimes \dots \otimes b_\ell[j],{\bf X}[j]}{P[j]} = 1\wedge {\bf X}[n_C]=\ell-\sum_{j=1}^{n_C-1}{\bf X}[j]$ with overwhelming probability, hence, $\VerifySymb$ outputs $1$ with overwhelming probability, concluding our proof.
## Proof: Theorem [thm:helios]
By Propositions 1, 3 & 4 and Lemma 2, election schemes constructed from generalized Helios satisfy election verifiability with external authentication:
**Corollary 5**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the preconditions of Definition [def:elec:helios]. Further suppose that $\Gamma$ is perfectly correct, perfectly homomorphic and collision-free for $\{0,1\}$, $\Sigma_1$, $\Sigma_2$ and $\Sigma_3$ satisfy special soundness and special honest verifier zero-knowledge, and $\mathcal H$ is a random oracle. We have $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H)$ satisfies election verifiability with external authentication.*
Let be the set of election schemes derived from $\mathsf{Helios}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \mathcal H)$, where primitives $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$ and $\mathcal H$ satisfy the conditions identified in Corollary 5. Hence, Theorem [thm:helios] is an immediate consequence of Corollary 5
A non-interactive proof system $(\ProveKeySymb, \VerKeySymb)$ derived from a sigma protocol for proving correct key construction is sufficient to ensure that additively homomorphic El Gamal (**CramerGennaroSchoenmakers97:AdditiveElGamal?**) is collision-free (Lemma 6), assuming algorithm $\VerKeySymb$ guarantees that public keys are constructed from suitable parameters: if $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m }{\allowbreak\rho} = 1$, then there exists $p$, $q$, $g$ and $h$ such that $\pk = (p,q,g,h)$ and $(p,q,g)$ are *cryptographic parameters*—i.e., $p=2\cdot q +1$, $|q|=k$, and $g$ is a generator of $\mathbb{Z}_p^*$ of order $q$. Thus, since El Gamal is perfectly correct and perfectly homomorphic, we have additively homomorphic El Gamal is a suitable asymmetric encryption scheme to instantiate .
**Lemma 6**. *Suppose $\Sigma_1$ is a sigma protocol that proves correct key construction and $\mathcal H$ is a hash function. Let $\sFS{\Sigma_1}{\allowbreak\mathcal H} = (\ProveKeySymb, \allowbreak\VerKeySymb)$. Further suppose for all security parameters $k$, public keys $\pk$, message spaces $\mathfrak m$, and proofs $\rho$, we have $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m }{\allowbreak\rho} = 1$ implies $h\not=0$ and there exists $p$, $q$, $g$ and $h$ such that $\pk = (p,q,g,h)$ and $(p,q,g)$ are cryptographic parameters. It follows that additively homomorphic El Gamal is collision-free for $\{0,1\}$.*
Suppose $k$ is a security parameter, $\pk$ is a public key, $\rho$ is a proof, $m_1,m_2\in\{0,1\}$ are messages and $r_1$ and $r_2$ are coins such that $\VerKey{k,\allowbreak\pk,\allowbreak\mathfrak m }{\allowbreak\rho} = 1$, $m_1 \not= m_2 \vee r_1 \not= r_2$, $\pk = (p,q,g,h)$ and $(p,q,g)$ are cryptographic parameters, for some $p$, $q$, $g$ and $h$. Further suppose that $c_1$ and $c_2$ are ciphertexts such that $c_1 = \EEncSymb(\pk,m_1;r_1)$, $c_2 = \EEncSymb(\pk,m_2;r_2)$, and $\EEncSymb$ is El Gamal’s encryption algorithm. If $r_1 \not= r_2$, then we proceed as follows. By definition of $\EEncSymb$, we have $c_1[1] = g^{r_1} \pmod p$ and $c_2[1] = g^{r_2} \pmod p$. Since $r_1$ and $r_2$ are distinct, we have $g^{r_1} \not\equiv g^{r_2} \pmod p$. (We implicitly assume that coins $r_1$ and $r_2$ are selected from the coin space $\mathbb Z_q^*$, hence, $g^{r_1} = g^{r_1} \bmod p$ and $g^{r_2} = g^{r_2} \bmod p$.) It follows that $c_1\not=c_2$. Otherwise ($r_1 = r_2$), we have $m_1 \not= m_2$ and we proceed as follows. By definition of $\EEncSymb$, we have $c_1[2] = h^{r_1}\cdot g^m_1 \pmod p$ and $c_2[2] = h^{r_2}\cdot g^m_2 \pmod p$. Since $(p,q,g)$ are cryptographic parameters and $h\not=0$, we have $h^{r_1} \not\equiv h^{r_1}\cdot g \pmod p$, which is sufficient to conclude, because $m_1,m_2\in\{0,1\}$.
The sigma protocol for proving knowledge of discrete logarithms by Chaum et al. (**Chaum86?**, Protocol 2) does not explicitly require the suitability of cryptographic parameters to be checked, hence, Lemma 6 is not immediately applicable. Nonetheless, we can trivially make the necessary checks explicit and, hence, the non-interactive proof system derived from the sigma protocol for proving knowledge of discrete logarithms by Chaum et al. is sufficient to ensure that El Gamal is collision-free for $\{0,1\}$. We can also trivially include the checks proposed by Chang-Fong & Essex (**Essex16:HeliosVerifiability?**). These modificiations should suffice to ensure special soundness and special honest verifier zero-knowledge. Similarly, it should be possible to modify the sigma protocols for proving knowledge of disjunctive equality between discrete logarithms by Cramer et al. (**CramerFranklinSchoenmakersYung96?**) and for proving knowledge of equality between discrete logarithms by Chaum and Pedersen (**Pedersen92?**) to ensure that they satisfy special soundness and special honest verifier zero-knowledge. Thus, the modified sigma protocols should be suitable to instantiate .
# Proof: $\ExpEVVSymb \Rightarrow \ExpIVVSymb$
Our eligibility verifiability experiment (§[sec:def:evv]) asserts that no one can construct a ballot that appears to be associated with public credential $\pk$ unless they know private credential $\sk$. It follows that a voter can uniquely identify their ballot on the bulletin board, because no one else knows their private credential. Eligibility verifiability therefore implies individual verifiability (Theorem [thm:EVImpliesIV]).
Our proof of Theorem [thm:EVImpliesIV] is reliant on distinct credentials, which is an consequence of eligibility verifiability:
**Lemma 1**. *If an election scheme $\Pi$ satisfies strong eligibility verifiability, then there exists a negligible function $\mu$, such that for all security parameters $k$, we have $$\begin{gathered}
\mathit{Pr}[
(\PKT,\SKT,\mB,\mC)\leftarrow\SetupSymb(k);\\
(\pk_0,\sk_0)\leftarrow\RegisterSymb(\PKT,k);\\
(\pk_1,\sk_1)\leftarrow\RegisterSymb(\PKT,k) : \\
\sk_0=\sk_1]\leq\mu(k)
\end{gathered}$$*
Suppose an election scheme $\Pi$ satisfies $\ExpEVVSymb$, but $$\begin{gathered}
\mathit{Pr}[
(\PKT,\SKT,\mB,\mC)\leftarrow\SetupSymb(k);\\
(\pk_0,\sk_0)\leftarrow\RegisterSymb(\PKT,k);\\
(\pk_1,\sk_1)\leftarrow\RegisterSymb(\PKT,k) : \\
\sk_0=\sk_1]\geq \frac{1}{p(k)}
\end{gathered}$$ for some polynomial function $p$ and security parameter $k$. Then we can construct an adversary $\adv$ that wins $\ExpEVVSymb$ as follows. Adversary $\adv$ is given input $k$ and runs $\SetupSymb$ to obtain a key pair $(\PKT,\SKT)$, chooses some positive integer $n_V$, and outputs $(\PKT,n_V)$. The challenger then generates $n_V$ key pairs and gives the set $\electoralroll$ of public keys to $\adv$. Now $\adv$ simply runs $\RegisterSymb(\PKT,k)$ to get a key pair $(\pk,\sk)$, chooses some positive integers $n_C$ and $\beta$ such that $1\leq\beta\leq n_C$, computes $b\leftarrow\VoteSymb(\sk,\PKT,n_C,\beta,\allowbreak k)$, and outputs $(n_C,b)$. We know that secret keys generated by $\RegisterSymb$ collide with probability at least $\frac{1}{p(k)}$, so $\RegisterSymb$ must generate a particular secret key $\sk'$ with probability $\frac{1}{p(k)}$. Therefore, this $\sk'$ will correspond to one of the public keys in $\electoralroll$ with probability $\frac{n_V}{p(k)}$. Furthermore, the key $\sk$ generated by the adversary will be $\sk'$ with probability $\frac{1}{p(k)}$. Therefore, $b$ will be a vote constructed under a voter’s secret key with probability $\frac{n_V}{p(k)^2}$, so $\adv$ wins the experiment with non-negligible probability.
## Proof: Theorem [thm:EVImpliesIV]
Suppose there exists an adversary $\adv'$ that wins $\ExpIVVSymb(\Pi,\adv',k)$ with probability $\frac{1}{p(k)}$ for some polynomial function $p$. Then we can construct an adversary $\adv$ that wins $\ExpEVVSymb(\Pi,\adv,k)$ with non-negligible probability. Adversary $\adv$ is given $k$ as input, which it passes to $\adv'$. Adversary $\adv'$ may ask for secret keys from its oracle $C$, in which case $\adv$ forwards these queries to its own, identical oracle. Adversary $\adv$ then forwards the oracle’s response back to $\adv'$. Adversary $\adv'$ then outputs $(\PKT, n_V)$, which is then output by $\adv$. Next, $\adv$ is given the public keys $(pk_1,\dots,pk_{n_V})$. Adversary $\adv$ passes these keys to $\adv'$, which returns $(n_C,\beta,\beta',i,j)$. Any oracle queries made by $\adv'$ are handled exactly as before. Now $\adv$ queries its oracle $C$ on $i$. The oracle returns $sk_i$. Adversary $\adv$ computes $b=\Vote[\sk_i,\PKT,n_C,\beta]$ and outputs $(n_C,\beta',j,b)$. Adversary $\adv'$ wins $\ExpIVV$ with non-negligible probability, so with non-negligible probability $b=\Vote[\sk_j,\PKT,n_C,\beta']$ and $\adv'$ (and therefore $\adv$) did not query the oracle on input $j$. Adversary $\adv$ only makes one additional oracle query on input $i$, so again, $\adv$ does not query the oracle on $j$. Furthermore, by Lemma 1, $sk_i=sk_j$ with only negligible probability. Therefore $\adv$ wins $\ExpEVVSymb(\Pi,\adv,k)$ with probability $\frac{1}{p(k)}-\mathsf{negl}(k)$.
# Variant of $\ExpEVVWeakSymb$
Our weak election verifiability experiment with internal authentication (§[sec:civitas]) can be equivalently formulated as an experiment with just one voter:
$\;=$
$(\PKT, \SKT,m_B,m_C)\leftarrow \SetupSymb(k)$;
$(\pk,\sk) \leftarrow \RegisterSymb(\PKT,k)$;
$\mathit{Rvld}\leftarrow\emptyset$;
$(n_C,\beta,b)\leftarrow \adv^{\revealOracle'}(\PKT,\pk,k)$;
Oracle $\revealOracle'$ is similar to oracle $\revealOracle$ in $\ExpEVVWeakSymb$. On invocation $\revealOracle'(\beta, \allowbreak n_C)$, oracle $\revealOracle'$ computes $b \leftarrow \Vote[\sk,\PKT,n_C,\beta,k];\mathit{Rvld}\leftarrow\mathit{Rvld} \cup \{b\}$ and outputs $b$.
**Lemma 1**. *Given an election scheme $\Pi$, we have $$\begin{gathered}
\forall \adv \; \exists \mu \; \forall k \mathrel .\Succ(\ExpEVVWeakSymb(\Pi,\adv,k))\leq \mu(k) \\
\mathrel\Leftrightarrow
\forall \adv' \; \exists \mu' \; \forall k' \mathrel . \Succ(\ExpEVVVWeak(\Pi,\adv',k'))\leq \mu'(k'),
\end{gathered}$$ where $\adv$ and $\adv'$ are PPT adversaries, $\mu$ and $\mu'$ are negligible functions, and $k$ and $k'$ are security parameters.*
A proof of the forward implication is straightforward, so we omit formalzing a proof. The reverse implication is formally proved below.
Suppose there exists an adversary $\adv$ that wins $\ExpEVVWeakSymb$ with non-negligible probability. Let us construct an adversary $\Adv$ against $\ExpEVVVWeak$.
- $\Adv(\PKT,\allowbreak \mathit{pk},\allowbreak k)$ computes
$n_V\leftarrow\adv(\PKT,\allowbreak k)$ $i^* \leftarrow_R \{1,\dots,n_V\}$ $\pk_{i^*} \leftarrow \pk$ $\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$ $(n_C,\beta,i,b)\leftarrow \adv(\electoralroll)$ $(n_C,\beta,b)$
responding to $\adv$’s oracle calls $\revealOracle(i,\beta, \allowbreak n_C)$ by computing and returning $b$, and oracle calls $\corruptOracle(i)$ by returning $sk_i$ if $i\not=i^*$ and aborting otherwise.
We prove that $\Adv$ wins $\ExpEVVVWeak$ with non-negligible probability.
Suppose $(\PKT,\SKT,m_B,m_C)$ is an output of $\SetupSymb(k)$ and $(\mathit{pk},\allowbreak\mathit{sk})$ is an output of $\RegisterSymb(\PKT,\allowbreak k)$. Further suppose we compute $\Adv(\PKT,\allowbreak \mathit{pk},\allowbreak k)$. If $\Adv$ does not abort, then it is trivial to see that $\Adv$ wins $\ExpEVVVWeak$ with non-negligible probability, because $\Adv$ simulates $\adv$’s challenger and oracles to $\adv$. Hence, it suffices to prove that $\Adv$ does not abort with non-negligible probability. Suppose $n_V$ is an output of $\adv(\PKT,\allowbreak k)$. If $n_V = 1$, then $\Adv$ aborts with negligible probability, otherwise, $\Adv$ aborts with probability less than $\frac{1}{n_V}$. Thus, $\Adv$ does not abort with non-negligible probability, concluding our proof.
# Generalized JCJ Scheme
We formalize a generic construction for JCJ-like election schemes (Definition 2). Our construction is parameterized on the choice of homomorphic encryption scheme and sigma protocols, using the relations introduced in the following definition.[^26]
**Definition 1**. *Let $(\GGenSymb,\EEncSymb,\DDecSymb)$ be a homomorphic asymmetric encryption scheme and $\Sigma$ be a sigma protocol for a binary relation $R$. Suppose $(\pk,\sk,\mathfrak m)=\GGen[k;r]$, for some security parameter $k$ and coins $r$.*
- *$\Sigma$ *proves conjunctive plaintext knowledge* if $((\pk,\allowbreak c_1,\allowbreak\dots,\allowbreak c_k),\allowbreak (m_1,\allowbreak r_1,\allowbreak\dots,\allowbreak m_k,\allowbreak r_k)) \in R
\Leftrightarrow \bigwedge_{1\leq i \leq k} c_i = \EEnc[\pk]{m_i;r_i} \mathrel\wedge m_i \in \mathfrak{m}$.*
- *$\Sigma$ is a *plaintext equivalence test* (PET) if $((\pk, c, c', i),\allowbreak \sk) \in R
\Leftrightarrow
\Big(\big(i = 0 \wedge \DDec[\sk]{c} \not=\DDec[\sk]{c'}\big)
\vee
\big(i = 1 \wedge \DDec[\sk]{c} =\DDec[\sk]{c'}\big)\Big)
\wedge \DDec[\sk]{c}\neq {\perp}
\wedge \DDec[\sk]{c'}\neq {\perp}$.*
- *$\Sigma$ is a *mixnet* if $((\pk,{\bf c},{\bf c'}),({\bf r},\chi)) \in R
\Leftrightarrow \bigwedge_{1\leq i \leq |{\bf c}|} {\bf c'}[i] = {\bf c}[\chi(i)] \otimes \EEnc[\pk]{\mathfrak e; {\bf r}[i]}
\wedge |{\bf c}| = |{\bf c'}| = |{\bf r}|$, where ${\bf r}$ is a vector of coins, $\chi$ is a permutation on $\{1,\dots,|{\bf c}|\}$, and $\mathfrak e$ is an identity element of the encryption scheme’s message space with respect to $\odot$.*
**Definition 2** (Generalized JCJ). *Suppose $\Gamma = (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$ is a multiplicatively homomorphic asymmetric encryption scheme with a message space over $\mathbb{Z}^*_{m}$ for some integer $m$ that is super-polynomial in the security parameter, $\mathfrak e$ is an identity element of $\Gamma$’s message space with respect to $\odot$, $\Sigma_1$ proves correct key construction, $\Sigma_2$ proves plaintext knowledge in a subspace, $\Sigma_3$ proves conjunctive plaintext knowledge, $\Sigma_4$ proves correct decryption, $\Sigma_5$ is a PET, $\Sigma_6$ is a mixnet, and $\mathcal H$ is a hash function. Let $\sFS{\Sigma_1}{\allowbreak\mathcal H} = (\ProveKeySymb,\allowbreak \VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} = (\SignCiphSymb,\allowbreak \VerCiphSymb)$, $\sFS{\Sigma_3}{\allowbreak\mathcal H} = (\ProveBindSymb,\allowbreak \VerBindSymb)$, $\sFS{\Sigma_4}{\allowbreak\mathcal H} = (\ProveDecSymb,\allowbreak \VerDecSymb)$, $\sFS{\Sigma_5}{\allowbreak\mathcal H} = (\ProveEQSymb,\allowbreak \VerEQSymb)$, and $\sFS{\Sigma_6}{\allowbreak\mathcal H} = (\ProveMixSymb,\allowbreak \VerMixSymb)$. We define *generalized JCJ* as $\mathsf{JCJ}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6,\allowbreak \mathcal H) = (\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$:*
- *$\Setup[k]$. Select coins $r$ uniformly at random, compute $(\pk_T,\allowbreak \sk_T,\allowbreak \mathfrak{m}) \leftarrow \GGen[k;\allowbreak r];\allowbreak\rho \leftarrow \ProveKeySymb((k,\allowbreak\pk_T,\allowbreak\mathfrak m),\allowbreak(\sk_T,\allowbreak r),\allowbreak k);\allowbreak\PKT\leftarrow(\pk_T,\allowbreak\mathfrak{m},\allowbreak\rho);\allowbreak\SKT\leftarrow(\pk_T,\allowbreak\sk_T);\allowbreak m_C\leftarrow|\mathfrak m|$, and output $(\PKT,\allowbreak \SKT,\allowbreak \mathit{poly}(k),\allowbreak m_C)$.*
- *$\Register[\PKT,k]$. Parse $\PKT$ as $(\pk_T,\mathfrak{m},\rho)$, outputting $(\perp,\perp)$ if parsing fails or $\VerKey{k,\allowbreak\pk_T,\allowbreak\mathfrak m}{\allowbreak\rho} \not=\allowbreak {1}$. Compute $d\leftarrow_R \mathfrak{m};pd \leftarrow\EEncSymb(\pk_T,d)$ and output $(pd,d)$.*
- *$\Vote[d,\PKT,n_C,\beta,k]$. Parse $\PKT$ as a vector $(\pk_T,\allowbreak\mathfrak m,\allowbreak\rho)$, outputting $\perp$ if parsing fails or $\VerKey{k,\allowbreak\pk_T,\allowbreak\mathfrak m}{\allowbreak\rho} \not=\allowbreak {1} \allowbreak\vee\allowbreak \beta\not\in\{1,\allowbreak\dots,\allowbreak n_C\}\allowbreak\vee\allowbreak \{1,\allowbreak\dots,\allowbreak n_C\}\not\subseteq\mathfrak m$. Select coins $r_1$ and $r_2$ uniformly at random, and compute*
* $c_1 \leftarrow \EEnc[\pk_T]{\allowbreak\beta;\allowbreak r_1}$ $c_2 \leftarrow \EEnc[\pk_T]{\allowbreak d;\allowbreak r_2}$ $\sigma\leftarrow \SignCiphSymb((\pk_T,\allowbreak c_1,\allowbreak\{1,\allowbreak\dots,\allowbreak n_C\}),\allowbreak(\beta,\allowbreak r_1),\allowbreak k)$ $\tau \leftarrow \ProveBindSymb((\pk_T,\allowbreak c_1,\allowbreak c_2),(\beta,\allowbreak r_1,\allowbreak d,\allowbreak r_2),\allowbreak k)$ *
*Output ballot $(c_1,\allowbreak c_2,\allowbreak \sigma,\allowbreak\tau)$.*
- *$\Tally[\SKT,\bbb,\electoralroll,n_C,k]$. Parse $\SKT$ as $(\pk_T,\sk_T)$. Initialize ${\bf X}$ as a zero-filled vector of length $n_C$, and ${\bf P}$ as a vector of length $9$. Proceed as follows.*
1. **Remove invalid ballots:* Let $\{b_1,\allowbreak \dots,\allowbreak b_\ell\}$ be the largest subset of $\bbb$ such that $b_1 <\allowbreak \dots <\allowbreak b_\ell$ and for all $1 \leq i \leq \ell$ we have $b_i$ is a vector of length $4$ and $\VerCiphSymb((\pk_T,\allowbreak b_i[1],\allowbreak\{1,\allowbreak\dots,\allowbreak n_C\}),\allowbreak b_i[3],\allowbreak k) =\allowbreak 1 \allowbreak\wedge\allowbreak \VerBindSymb((\pk_T,\allowbreak b_i[1],\allowbreak b_i[2]),\allowbreak b_i[4],\allowbreak k) =\allowbreak 1$. If $\{b_1,\allowbreak \dots,\allowbreak b_\ell\} =\allowbreak \emptyset$, then output $({\bf X},\allowbreak{\bf P})$.*
2. **Eliminating duplicates:* Initialize $\auxDupl$ as a vector of length $\ell$. For each $1\leq i \leq \ell$, if there exists $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak\allowbreak{i+1},\allowbreak\dots,\allowbreak\ell\}$ such that $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sigma,\allowbreak k) =\allowbreak {1}$ for some output $\sigma$ of $\ProveEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sk_T,\allowbreak k)$, then assign $\auxDupl[i] \leftarrow (j,\sigma)$, otherwise, compute $\sigma_j \leftarrow \ProveEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 0),\allowbreak \sk_T,\allowbreak k)$ for each $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak{i+1},\allowbreak\dots,\allowbreak\ell\}$ and assign $\auxDupl[i] \leftarrow (0,\sigma_1,\allowbreak\dots,\allowbreak\sigma_{i-1},\allowbreak\sigma_{i+1},\allowbreak\dots,\allowbreak\sigma_\ell)$. Initialize ${\bf BB}$ as the empty vector and compute , where ${\bf BB}\parallel (b_i)$ denotes the concatenation of vectors ${\bf BB}$ and $(b_i)$—i.e., ${\bf BB}\parallel (b_i) = ({\bf BB}[1],\allowbreak\dots,\allowbreak{\bf BB}[|{\bf BB}|],\allowbreak b_i)$.*
3. **Mixing:* Suppose ${\bf BB} = (b'_1,\dots,b'_{|{\bf BB}|})$, select a permutation $\chi$ on $\{1,\dots,|{\bf BB}|\}$ uniformly at random, initialize ${\bf C_1}$, ${\bf C_2}$, ${\bf r_1}$ and ${\bf r_2}$ as vectors of length $|{\bf BB}|$, and fill ${\bf r_1}$ and ${\bf r_2}$ with coins chosen uniformly at random. Compute*
* ${\bf C_1}[i] \leftarrow b'_{\chi(i)}[1] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_1}[i]}$ ${\bf C_2}[i] \leftarrow b'_{\chi(i)}[2] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_2}[i]}$ ${\bf BB_1} \leftarrow (b'_1[1],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[1])$ ${\bf BB_2} \leftarrow (b'_1[2],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[2])$ $\auxMix{1} \leftarrow \ProveMixSymb((\pk_T,\allowbreak{\bf BB_1},\allowbreak{\bf C_1}),\allowbreak({\bf r_1},\allowbreak\chi),\allowbreak k)$ $\auxMix{2} \leftarrow \ProveMixSymb((\pk_T,{\bf BB_2} \allowbreak,\allowbreak{\bf C_2}),\allowbreak({\bf r_2},\allowbreak\chi),\allowbreak k)$ *
*Similarly, suppose $\electoralroll = \{pd_1,\dots,pd_{|\electoralroll|}\}$ such that $pd_1<\allowbreak \dots <\allowbreak pd_{|\electoralroll|}$, select a permutation $\chi'$ on $\{1,\dots,|\electoralroll|\}$ uniformly at random, initialize ${\bf C_3}$ and ${\bf r_3}$ as vectors of length $|\electoralroll|$, fill ${\bf r_3}$ with coins chosen uniformly at random, and compute*
* ${\bf C_3}[i] \leftarrow pd_{\chi'(i)} \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_3}[i]}$ ${\bf pd} \leftarrow (pd_1,\dots,pd_{|\electoralroll|})$ $\auxMix{3} \leftarrow \ProveMix{\pk_T,\allowbreak{\bf pd},{\bf C_3}}{{\bf r_3},\allowbreak\chi'}$ *
4. **Remove ineligible ballots:* Initialize $\auxInelig$ as a vector of length $|{\bf C_2}|$. For each $1\leq i \leq |{\bf C_2}|$, if there exists $j\in\{1,\dots,|\bf C_3|\}$ such that $\VerEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],1),\allowbreak\sigma,\allowbreak k) =\allowbreak {1}$ for some output $\sigma$ of $\ProveEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 1), \sk_T,\allowbreak k)$, then compute $\auxInelig[i] \leftarrow (j,\sigma)$, otherwise, compute $\sigma_j \leftarrow \ProveEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak{\bf C_3}[j],\allowbreak 0),\allowbreak \sk_T,\allowbreak k)$ for each $j\in\{1,\dots,|{\bf C_3}|\}$ and assign $\auxInelig[i] \leftarrow (0,\sigma_1,\allowbreak\dots,\allowbreak\sigma_{|{\bf C_3}|})$. Initialize ${\bf C'_1}$ as the empty vector and compute .*
5. **Decrypting:* Initialize $\auxDec$ as the empty vector. Compute*
* *
*Assign ${\bf P} \leftarrow (\auxDupl,\allowbreak{\bf C_1},\allowbreak\auxMix{1},\allowbreak{\bf C_2},\allowbreak\auxMix{2},\allowbreak{\bf C_3},\allowbreak\auxMix{3},\allowbreak\auxInelig,\allowbreak\auxDec)$ and output $({\bf X},\allowbreak{\bf P})$.*
- *$\Verify[\PKT,\bbb,\electoralroll,n_C,{\bf X},{\bf P},k]$. Parse $\PKT$ as a vector $(\pk_T,\allowbreak\mathfrak m,\allowbreak\rho)$, ${\bf X}$ as a vector of length $n_C$, and ${\bf P}$ as a vector $(\auxDupl,\allowbreak{\bf C_1},\allowbreak\auxMix{1},\allowbreak{\bf C_2},\allowbreak\auxMix{2},\allowbreak{\bf C_3},\allowbreak\auxMix{3},\allowbreak\auxInelig,\allowbreak\auxDec)$, outputting $0$ if parsing fails, $\VerKey{k,\allowbreak\pk_T,\allowbreak\mathfrak m}{\rho} \not=\allowbreak {1}$, or $|\mathfrak m| < n_C$. Perform the following checks and output $0$ if any check does not hold.*
1. **Check removal of invalid ballots:* Compute $\{b_1, \dots, b_\ell\}$ as per Step [jcj:tally1] of the tallying algorithm. Check that $\{b_1,\allowbreak \dots,\allowbreak b_\ell\} =\allowbreak \emptyset$ implies ${\bf X}$ is a zero-filled vector.*
2. **Check duplicate elimination:* Check that $\auxDupl$ is a vector of length $\ell$ and that for all $1\leq i \leq \ell$, either:*
*i) $\auxDupl[i]$ parses as a vector $(j,\sigma)$, $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak\sigma,\allowbreak k) = {1}$, and $j\in\{1,\dots,i-1,i+1,\dots,\ell\}$, or ii) $\auxDupl[i]$ parses as a vector $(0,\sigma_1,\dots,\sigma_{i-1},\sigma_{i+1},\dots,\sigma_{\ell})$ and for all $j\in\{1\dots,i-1,i+1,\dots,\ell\}$ we have $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 0),\allowbreak\sigma_j,\allowbreak k) = {1}$.*
3. **Check mixing:* Compute ${\bf BB}$ as per Step [jcj:tally2] of the tallying algorithm. Suppose ${\bf BB} = (b'_1,\allowbreak\dots,\allowbreak b'_{|{\bf BB}|})$ and $\electoralroll = \{pd_1,\dots,pd_{|\electoralroll|}\}$ such that $pd_1<\allowbreak \dots <\allowbreak pd_{|\electoralroll|}$. Check $\VerMix{\pk_T,\allowbreak(b'_1[1],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[1]),\allowbreak{\bf C_1}}{\allowbreak\auxMix{1},\allowbreak k} =\allowbreak {1} \wedge
\VerMix{\pk_T,\allowbreak(b'_1[2],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[2]),\allowbreak{\bf C_2}}{\allowbreak\auxMix{2},\allowbreak k} =\allowbreak {1} \wedge
\VerMix{\pk_T,\allowbreak(pd_1,\allowbreak\dots,\allowbreak pd_{|\electoralroll|}),\allowbreak{\bf C_3}}{\allowbreak\auxMix{3},\allowbreak k} =\allowbreak {1}$.*
4. **Check removal of ineligible ballots:* Check that $\auxInelig$ is a vector of length $|{\bf C_2}|$ and that for all $1\leq i \leq |{\bf C_2}|$, either: i) $\auxInelig[i]$ parses as a vector $(j,\sigma)$, $\VerEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 1),\allowbreak\sigma,\allowbreak k) = 1$, and $j\in\{1,\dots,|{\bf C_3}|\}$, or ii) $\auxInelig[i]$ parses as a vector $(0,\sigma_1,\dots,\sigma_{|{\bf C_3}|})$ and for all $1 \leq j \leq |{\bf C_3}|$ we have $\VerEQSymb((\pk_T,\allowbreak {\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 0),\sigma_j,\allowbreak k) =\allowbreak 1$.*
5. **Check decryption:* *
*Compute ${\bf C_1'}$ as per Step [jcj:tally4] of the tallying algorithm. Check that $\auxDec$ parses as a vector $((\beta_1,\sigma_1),\dots,(\beta_{|{\bf C'_1}|},\sigma_{|{\bf C'_1}|}))$ such that for all $1\leq i \leq |{\bf C'_1}|$ we have $\VerDecSymb((\pk_T,{\bf C'_1}[i],\beta_i),\sigma_i,k) = 1$ and for all $1 \leq \beta \leq n_C$ we have $\exists^{={\bf X}[\beta]} j\in\{1,\dots,{|{\bf C'_1}|}\} :\beta = \beta_j$.*
*Output $1$ if all the above checks hold.*
The specification of algorithms $\SetupSymb$, $\RegisterSymb$ and $\VoteSymb$ follow from our informal descriptions (§[sec:civitas]). The tallying algorithm performs the following steps:
1. *Remove invalid ballots:* The tallier discards any ballots from the bulletin board for which proofs do not hold.
2. *Eliminating duplicates:* The tallier performs pairwise PETs on the encrypted credentials and discard any ballots for which a test holds, that is, ballots using the same credential are discarded. [^27]
3. *Mixing:* The tallier mixes the ciphertexts in the ballots (i.e., the encrypted choices and the encrypted credentials), using the same secret permutation for both mixes, hence, the mix preserves the relation between encrypted choices and credentials. Let $\bf C_1$ and $\bf C_2$ be the vectors output by these mixes. The tallier also mixes the public credentials published by the registrar. Let $\bf C_3$ be the vector output by this mix.
4. *Remove ineligible ballots:* The tallier discards ciphertexts ${\bf C_1}[i]$ from ${\bf C_1}$ if there is no ciphertext $c$ in ${\bf C_3}$ such that a PET holds for $c$ and ${\bf C_2}[i]$, that is, ballots cast using ineligible credentials are discarded.
5. *Decrypting:* The tallier decrypts the remaining encrypted choices in ${\bf C_1}$ and proves that decryption was performed correctly. The tallier identifies the winning candidate from the decrypted choices.
The $\VerifySymb$ algorithm checks that each of the above steps has been performed correctly.
Lemma 1 demonstrates that generalized JCJ is a construction for election schemes.
**Lemma 1**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma4$, $\Sigma_5$, $\Sigma_6$ and $\mathcal H$ satisfy the preconditions of Definition 2. We have $\mathsf{JCJ}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6, \allowbreak\mathcal H)$ satisfies Correctness.*
Let $\mathsf{JCJ}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6,\allowbreak \mathcal H) = (\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\Gamma = (\GGenSymb,\EEncSymb,\allowbreak\DDecSymb)$, $\sFS{\Sigma_1}{\allowbreak\mathcal H} = (\ProveKeySymb,\allowbreak \VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} = (\SignCiphSymb,\allowbreak \VerCiphSymb)$, and $\sFS{\Sigma_3}{\allowbreak\mathcal H} = (\ProveBindSymb,\allowbreak \VerBindSymb)$.
Suppose $k$ is a security parameter, $n_B$ and $n_C$ are integers, and $\beta_1,\dots,\beta_{n_B}\in\{1,\dots,n_C\}$ are choices. Further suppose $(\PKT,\SKT,m_B,m_C)$ is an output of $\SetupSymb(k)$. Moreover, for all $1\leq i\leq n_B$ suppose $(pd_i,d_i)$ is an output of $\RegisterSymb(\PKT,k)$ and $b_i$ is an output of $\VoteSymb(d_i,\PKT,n_C,\beta_i,k)$. Further suppose ${\bf Y}$ is derived by initializing ${\bf Y}$ as a zero-filled vector of length $n_C$ and computing . If $n_B\not\leq m_B \vee n_C\not\leq m_C$, then Correctness is trivially satisfied, otherwise ($n_B\leq m_B \wedge n_C\leq m_C$), we proceed as follows.
By definition of $\SetupSymb$, we have $\PKT=(\pk_T,\allowbreak{}\mathfrak m,\allowbreak{}\rho)$, $\SKT=(\pk_T,\sk_T)$, $m_B = \mathit{poly}(k)$, and $m_C=|\mathfrak m|$, where $(\pk_T,\allowbreak \sk_T,\allowbreak \mathfrak{m})=\GGen[k;\allowbreak r]$ and $\rho$ is an output of $\ProveKeySymb((k,\allowbreak\pk_T,\allowbreak\mathfrak m),\allowbreak(\sk_T,\allowbreak r),\allowbreak k)$ for some coins $r$ chosen uniformly at random by $\SetupSymb$. By completeness of $(\ProveKeySymb,\allowbreak \VerKeySymb)$, we have $\VerKey{k,\allowbreak\pk_T,\allowbreak\mathfrak m}{\allowbreak\rho} =\allowbreak {1}$. And, since $\Gamma$ has a message space over $\mathbb{Z}^*_{m}$ for some integer $m$ and since $n_C \leq |\mathfrak m|$, we have $\{1,\allowbreak\dots,\allowbreak n_C\}\subseteq\mathfrak m$. Therefore, by definition of $\VoteSymb$, we have for all $1\leq i\leq n_B$ that $b_i[1]=\EEnc[\pk_T]{\beta_i;r_{i,1}}$, $b_i[2]=\EEnc[\pk_T]{d_i;r_{i,2}}$, $b_i[3]$ is an output of $\SignCiphSymb((\pk_T,\allowbreak{}b_i[1],\allowbreak{}\{1,\allowbreak{}\dots,\allowbreak{}n_C\}),\allowbreak{}(\beta_i,r_{i,1}),k)$, and $b_i[4]$ is an output of $\ProveBindSymb((\pk_T,\allowbreak{}b_i[1],\allowbreak{}b_i[2]),(\beta_i,\allowbreak{}r_{i,1},\allowbreak{}d,\allowbreak{}r_{i,2}),k)$, where $r_{i,1}$ and $r_{i,2}$ are coins chosen uniformly at random by $\VoteSymb$. Let us consider the computation of $({\bf X},P)$ by $\TallySymb(\SKT,\allowbreak\{b_1,\allowbreak\dots,\allowbreak b_{n_B}\},\allowbreak\{pd_1,\allowbreak\dots,\allowbreak pd_{n_B}\},\allowbreak n_C,\allowbreak k)$.
Suppose a subset of $\{b_1,\allowbreak\dots,\allowbreak b_{n_B}\}$ is computed as per Step [jcj:tally1] of algorithm $\TallySymb$. By completeness of $(\SignCiphSymb,\allowbreak \VerCiphSymb)$ and $(\ProveBindSymb,\allowbreak \VerBindSymb)$, that subset is $\{b_{\pi(1)},\allowbreak\dots,\allowbreak b_{\pi(n_B)}\}$, where $\pi$ is a permutation on $\{1,\dots,n_B\}$ such that $b_{\pi(1)}<\dots[jcj:tally2] of algorithm $\TallySymb$. By definition of $\RegisterSymb$, we have $d_1,\dots,d_{n_B}$ are chosen uniformly at random from $\mathfrak{m}$, where $n_B \leq \mathit{poly}(k)$ and $|\mathfrak{m}|$ is super-polynomial in the security parameter. Thus, for all distinct integers $i,j\in\{1,\dots,n_B\}$ we have $d_i\not=d_j$, with overwhelming probability. It follows for all $1\leq i \leq \ell$, all $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak\allowbreak{i+1},\allowbreak\dots,\allowbreak\ell\}$, and outputs $\sigma$ of $\ProveEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sk_T,\allowbreak k)$ that $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sigma,\allowbreak k) \not=\allowbreak {1}$, with overwhelming probability. Thus, ${\bf BB} = (b_{\pi(1)},\dots,b_{\pi(n_B)})$.
Suppose ${\bf C_1}$, ${\bf C_2}$ and ${\bf C_3}$ are computed as per Step [jcj:tally3] of algorithm $\TallySymb$. We have for all $1 \leq i \leq n_B$ that ${\bf C_1}[i] = b'_{\chi(\pi(i))}[1] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_1}[i]}$ and ${\bf C_2}[i] = b'_{\chi(\pi(i))}[2] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_2}[i]}$. Moreover, since $\Gamma$ is a homomorphic asymmetric encryption scheme and $\mathfrak e$ is an identity element, we have for all $1 \leq i \leq n_B$ that $$\begin{aligned}
{\bf C_1}[i]&=\EEnc[\pk_T]{\beta_{\chi(\pi(i))};r_{\chi(\pi(i)),1}\oplus{\bf r_1}[i]}\\
{\bf C_2}[i]&=\EEnc[\pk_T]{d_{\chi(\pi(i))};r_{\chi(\pi(i)),2}\oplus{\bf r_2}[i]}
%
\intertext{Similarly, we have for all $1 \leq i \leq n_B$ that}
%
{\bf C_3}[i] &= \EEnc[\pk_T]{d_{\chi'(\pi'(i))};\allowbreak r_{\chi'(\pi'(i))}
\oplus
{\bf r_3}[i]}
\end{aligned}$$ where coins $r_1,\dots,r_{n_B}$ were used to construct $pd_1,\dots,pd_{n_B}$ and $\pi'$ is a permutation on $\{1,\dots,n_B\}$ such that $pd_{\pi'(1)} <\allowbreak \dots <\allowbreak pd_{\pi'(n_B)}$.
Suppose ${\bf C'_1}$ is computed as per Step [jcj:tally4] of algorithm $\TallySymb$. We have for all $1\leq i \leq n_B$ that there exists $j\in\{1,\dots,n_B\}$ such that $\VerEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],1),\allowbreak\sigma,\allowbreak k) =\allowbreak {1}$ for some output $\sigma$ of $\ProveEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 1), \sk_T,\allowbreak k)$, because ${\bf C_2}$, respectively ${\bf C_3}$, is a vector of ciphertexts on plaintexts $d_{\chi(\pi(1))},\dots,d_{\chi(\pi(n_B))}$, respectively $d_{\chi'(\pi'(1))},\dots,d_{\chi'(\pi'(n_B))}$, that is, ${\bf C_2}$ and ${\bf C_3}$ contain ciphertexts on the same plaintexts. Thus, ${\bf C'_1}= ({\bf C_1}[1],\dots,{\bf C_1}[n_B])$.
Suppose ${\bf X}$ is computed as per Step [jcj:tally5] of algorithm $\TallySymb$, namely, . By correctness of $\Gamma$, we have for all $1\leq i \leq n_B$ that $\DDec[\sk_T]{\allowbreak{\bf C'_1}[i]}=\beta_{\chi(\pi(i))}$. Hence, ${\bf X}$ can be equivalently computed as . And, since ${\bf Y}$ is derived by initializing ${\bf Y}$ as a zero-filled vector of length $n_C$ and computing , we have ${\bf X} = {\bf Y}$, concluding our proof.
# Proof: is not verifiable
Generalized JCJ can be instantiate to derive :
**Definition 1** ( (**JCJ10?**)). * is $\mathsf{JCJ}(\Gamma,\Sigma_1, \allowbreak\Sigma_2, \allowbreak\Sigma_3, \allowbreak\Sigma_4, \allowbreak\Sigma_5, \allowbreak\Sigma_6, \allowbreak\mathcal H)$, where $\Gamma$ is a modified version of El Gamal (**ElGamal85?**) invented by Juels et al. (**JCJ10?**) that can be seen as a simplified version of Cramer–Shoup (**Cramer98?**), $\Sigma_1$ is the proof of key construction by Gennaro et al. (**Gennaro99?**), $\Sigma_4$ is the conjunction (**Schoenmakers94:Proof-of-ciphertext?**) of two Schnorr proofs (**Schnorr89:ProofDLog?**), $\Sigma_5$ is the PET by MacKenzie et al. (**MacKenzie02?**), and $\mathcal H$ is a random oracle. Juels et al. leave $\Sigma_2$, $\Sigma_3$ and $\Sigma_6$ unspecified.*
Juels et al. (**JCJ10?**) do not mandate particular cryptographic primitives, so Definition 1 might be seen more as an instantiation of their scheme than an exact recollection of it. We assume that the primitives in Definition 1 satisfy the properties required by generalized JCJ. We leave formally proving this assumption as future work. Under this assumption, Lemma [lem:JCJ-is-correct] demonstrates that is an election scheme.
Let $\mathsf{JCJ}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6,\allowbreak \mathcal H) =\allowbreak (\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\sFS{\Sigma_1}{\allowbreak\mathcal H} =\allowbreak (\ProveKeySymb, \allowbreak\VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} =\allowbreak (\SignCiphSymb, \allowbreak\VerCiphSymb)$, $\sFS{\Sigma_3}{\allowbreak\mathcal H} =\allowbreak (\ProveBindSymb, \allowbreak\VerBindSymb)$, $\sFS{\Sigma_4}{\allowbreak\mathcal H} =\allowbreak (\ProveDecSymb, \allowbreak\VerDecSymb)$, $\sFS{\Sigma_5}{\allowbreak\mathcal H} =\allowbreak (\ProveEQSymb, \allowbreak\VerEQSymb)$, and $\sFS{\Sigma_6}{\allowbreak\mathcal H} =\allowbreak (\ProveMixSymb, \allowbreak\VerMixSymb)$. Moreover, let $\beta_1=1$ and $\beta_2=2$. We construct an adversary $\adv$ (Figure 1) against the universal verifiability experiment.
Given a security parameter k as input, adversary $\adv$ computes $(\PKT,\allowbreak \SKT,\allowbreak m_B,\allowbreak m_C) \leftarrow \Setup[k];n_V\leftarrow 1$ and outputs $(\PKT,\allowbreak n_V)$. Moreover, given a set of credentials $\electoralrollprivate$, adversary $\adv$ parses $\electoralrollprivate$ as set {(pd1, d1)}, $\PKT$ as a vector $(\pk_T,\mathfrak m, \rho)$, and $\SKT$ as a vector $(\pk_T,\sk_T)$, computes
selects permutation π on {1, 2} such that bπ(1) < bπ(2), initializes vectors ${\bf C_1}$, ${\bf C_2}$, ${\bf r_1}$ and ${\bf r_2}$ of length 2, initializes vectors ${\bf C_3}$ and ${\bf r_3}$ of length 1, fills ${\bf r_1}$, ${\bf r_2}$ and ${\bf r_3}$ with coins, selects permutations χ and χ′ on {1, 2} such that χ is the identity function and χ′ is not, be coins, computes
and outputs $(\bbb,n_C,{\bf X},\allowbreak{\bf P})$.
Adversary against JCJ
Let $k$ be a security parameter such that $\Gamma$ has a message space over $\mathbb{Z}^*_{m}$ for some integer $m$ such that $1,2\in\mathbb{Z}^*_{m}$. Suppose an execution of $\ExpUVVSymb$ computes
$(\PKT) \leftarrow \adv(k)$ $\electoralroll \leftarrow \{\pk_1,\dots,\pk_{n_V}\}$ $\electoralrollprivate \leftarrow \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}$ $(\bbb,n_C,{\bf X}, {\bf P}) \leftarrow \adv(\electoralrollprivate)$ ${\bf Y}\leftarrow \correcttally(\PKT,\bbb,\electoralrollprivate, n_C,k)$
By definition of function $\correcttally$, we have ${\bf Y} = (1,0)$. Thus, ${\bf X} \not= {\bf Y}$. Let us prove that $\Verify[\PKT,\allowbreak\bbb,\allowbreak\electoralroll,\allowbreak n_C,\allowbreak{\bf X},\allowbreak {\bf P},\allowbreak k] = 1$.
By definition of $\adv$, we have $\PKT$ parses as $(\pk_T,\allowbreak{}\mathfrak m,\allowbreak{}\rho)$, where $\rho$ is constructed by the adversary using algorithm $\ProveKeySymb$. It follows by completeness of $(\ProveKeySymb,\allowbreak \VerKeySymb)$ that $\VerKey{k,\allowbreak\pk_T,\allowbreak\mathfrak m}{\allowbreak\rho} =\allowbreak {1}$. By definition of $\adv$, we also have $n_C = 2$, and, since $1$ and $2$ are elements of $\Gamma$’s message space, we have $n_C \leq |\mathfrak m|$. Moreover, ${\bf X}$ parses as a vector of length $n_C$ and ${\bf P}$ parses as a vector $(\auxDupl,\allowbreak{\bf C_1},\allowbreak\auxMix{1},\allowbreak{\bf C_2},\allowbreak\auxMix{2},\allowbreak{\bf C_3},\allowbreak\auxMix{3},\allowbreak\auxInelig,\allowbreak\auxDec)$. Thus, the initial checks performed by algorithm $\VerifySymb$ succeed and we proceed by proving that checks performed in Steps [jcj:check1]–[jcj:check5] of $\VerifySymb$ also succeed.
By definition of $\adv$, we have $\bbb = \{b_{1}, b_{1}\}$, where $b_{1}$, respectively $b_{2}$, is computed using algorithm $\VoteSymb$ on inputs including private crendential $d_{1}$ and choice $\beta_{1}$, respectively $d_{2}$ and $\beta_{2}$, where $d_2$ is the private credential constructed by adversary $\adv$. Therefore, by definition of $\VoteSymb$, for all $i\in\{1,2\}$ we have: $$\begin{aligned}
b_{i}[1]&=\EEnc[\pk_T]{\beta_{i};r_{i,1}},\\
b_{i}[2]&=\EEnc[\pk_T]{\allowbreak{}d_{i};r_{i,2}},
\end{aligned}$$ $b_{i}[3]$ is an output of $\SignCiphSymb((\pk_T,\allowbreak{}b_{i}[1],\allowbreak{}\{1,\allowbreak 2\}),\allowbreak{}(\beta_{i},\allowbreak r_{i,1}),\allowbreak k)$, and $b[4]$ is an output of $\ProveBindSymb((\pk_T,\allowbreak{}b_{i}[1],\allowbreak{}b_{i}[2]),\allowbreak{}(\beta_{i},\allowbreak{}r_{i,1},\allowbreak{}d_{i},\allowbreak{}r_{i,2}),\allowbreak k)$, where $r_{i,1}$ and $r_{i,2}$ are coins chosen uniformly at random by $\VoteSymb$.
Suppose a subset of $\bbb$ is computed as per Step [jcj:tally1] of algorithm $\TallySymb$. By completeness of $(\SignCiphSymb,\allowbreak \VerCiphSymb)$ and $(\ProveBindSymb,\allowbreak \VerBindSymb)$, that subset is $\{b_{\pi(1)},b_{\pi(2)}\}$, where permutation $\pi$ is selected by adversary $\adv$. Thus, the check holds in Step [jcj:check1] of $\VerifySymb$.
We have $\auxDupl$ is a vector of length $2$ such that $\auxDupl[1]$ parses as a vector $(0,\sigma_1)$, where $\sigma_1$ is an output of $\ProveEQSymb((\pk_T,\allowbreak b_{\pi(1)}[2],\allowbreak b_{\pi(2)}[2],\allowbreak 0),\allowbreak \sk_T,\allowbreak k)$. By correctness of $\Gamma$, we have $\DDec[\sk_T]{b_{\pi(1)}[2]} = d_{\pi(1)}$ and $\DDec[\sk_T]{b_{\pi(2)}[2]} = d_{\pi(2)}$. And, since $d_{1}$ and $d_{2}$ were selected uniformly at random from $\mathfrak m$, we have $d_{1} \not=d_{2}$, with probability greater than negligible, because $n_C \leq |\mathfrak m|$. Hence, $\DDec[\sk_T]{b_{\pi(1)}[2]} \not=\DDec[\sk_T]{b_{\pi(2)}[2]}$, with probability greater than negligible. Moreover, by completeness of $(\ProveEQSymb,\VerEQSymb)$, we have $\VerEQSymb((\pk_T,\allowbreak b_{\pi(1)}[2],\allowbreak b_{\pi(2)}[2],\allowbreak 0),\allowbreak\sigma_1,\allowbreak k) = {1}$, with probability greater than negligible. Similarly, $\auxDupl[1]$ parses as a vector $(0,\sigma_2)$ and $\VerEQSymb((\pk_T,\allowbreak b_{\pi(2)}[2],\allowbreak b_{\pi(1)}[2],\allowbreak 0),\allowbreak\sigma_2,\allowbreak k) = {1}$, with probability greater than negligible. Thus, checks hold in Step [jcj:check2] of $\VerifySymb$, with probability greater than negligible.
Suppose ${\bf BB}$ is computed as per Step [jcj:tally2] of the tallying algorithm. Hence, ${\bf BB} = (b_{\pi(1)},b_{\pi(2)})$. By completeness of $(\ProveMixSymb,\allowbreak \VerMixSymb)$, we have $\VerMix{\pk_T,\allowbreak(b_{\pi(1)}[1],\allowbreak b_{\pi(2)}[1]),\allowbreak{\bf C_1}}{\allowbreak\auxMix{1},\allowbreak k} =\allowbreak {1}$, $\VerMix{\pk_T,\allowbreak(b_{\pi(1)}[2],\allowbreak b_{\pi(2)}[2]),\allowbreak{\bf C_2}}{\allowbreak\auxMix{2},\allowbreak k} =\allowbreak {1}$, and $\VerMix{\pk_T,\allowbreak(pd_1),\allowbreak{\bf C_3}}{\allowbreak\auxMix{3},\allowbreak k} =\allowbreak {1}$. Thus, checks hold in Step [jcj:check3] of $\VerifySymb$.
We have for all $i\in\{1,2\}$ that ${\bf C_2}[i] = b_{\chi'(\pi(i))}[2] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_2}[i]}$. And, since $\Gamma$ is homomorphic and $\mathfrak e$ is an identity element, we have ${\bf C_2}[i] = \EEnc[\pk_T]{d_{\chi'(\pi(i))};\allowbreak r_{\pi(i),1} \oplus {\bf r_2}[i]}$, hence, $\DDec[\sk_T]{{\bf C_2}[i]} = d_{\chi'(\pi(i))}$. Similarly, we have ${\bf C_3}[1] = pd_1 \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_2}[1]}$, where $pd_1$ is a ciphertext on $d_1\in\mathfrak m$ constructed by algorithm $\RegisterSymb$. Hence, $\DDec[\sk_T]{{\bf C_3}[1]} = d_1$. It follows that $\DDec[\sk_T]{{\bf C_2}[1]} \not= \DDec[\sk_T]{{\bf C_3}[1]} \wedge
\DDec[\sk_T]{{\bf C_2}[2]} = \DDec[\sk_T]{{\bf C_3}[1]}$ iff $\pi$ is an identity function. We have $\auxInelig = ((\pi(1)-1,\tau_1),(\pi(2)-1,\tau_2))$, where $\tau_1$ and $\tau_2$ are constructed by the adversary. It follows by completeness of $(\ProveEQSymb,\VerEQSymb)$ that $\VerEQSymb((\pk_T,\allowbreak {\bf C_2}[1],\allowbreak {\bf C_3}[1],\allowbreak \pi(1)-1),\tau_1,\allowbreak k) =\allowbreak 1$ and $\VerEQSymb((\pk_T,\allowbreak {\bf C_2}[2],\allowbreak {\bf C_3}[1],\allowbreak \pi(2)-1),\tau_2,\allowbreak k) =\allowbreak 1$. Thus, checks hold in Step [jcj:check4] of $\VerifySymb$.
Suppose ${\bf C_1'}$ is computed as per Step [jcj:tally4] of the tallying algorithm. Hence, ${\bf C_1'} = ({\bf C_1}[\pi(2)])$. We have $\auxDec =$ parses as a vector $((\beta_2,\sigma))$, where $\sigma$ is constructed by the adversary using algorithm $\ProveDecSymb$ on inputs including ${\bf C_1}[\pi(2)]$ and $\beta_2$. Moreover, since $\pi$ is a permutation on $\{1,2\}$ and $\chi$ is an identity function, we have $\chi(\pi(\pi(2))) = 2$, therefore, ${\bf C_1}[\pi(2)] = b_{2}[1] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_1}[2]}$. And, since $\Gamma$ is homomorphic and $\mathfrak e$ is an identity element, we have ${\bf C_1}[\pi(2)] = \EEnc[\pk_T]{\beta_2;\allowbreak r_{2,1} \oplus {\bf r_1}[2]}$, hence, $\DDec[\sk_T]{{\bf C_1}[\pi(2)]} = \beta_2$. Therefore, by completeness of $(\ProveDecSymb,\VerDecSymb)$, we have $\VerDecSymb((\pk_T,{\bf C_1}[\pi(2)],\beta_2),\sigma,k) = 1$. Furthermore, since ${\bf X} = (0,1)$, we have for all $1 \leq \beta \leq n_C$ that $\exists^{={\bf X}[\beta]} \beta = \beta_2$. Thus, checks hold in Step [jcj:check5] of $\VerifySymb$.
We have shown that checks performed in Steps [jcj:check1]–[jcj:check5] of algorithm $\VerifySymb$ all succeed, thus, $\Verify[\PKT,\allowbreak\bbb,\allowbreak\electoralroll,\allowbreak n_C,\allowbreak{\bf X},\allowbreak {\bf P},\allowbreak k] = 1$, concluding our proof.
# Proof: is Verifiable
We formalize a variant of the generic construction for JCJ-like election schemes that uses a mixnet capable of proving that the relation between encrypted choices and encrypted credentials is maintained.
**Definition 1**. *Let $(\GGenSymb,\EEncSymb,\DDecSymb)$ be a homomorphic asymmetric encryption scheme and $\Sigma$ be a sigma protocol for a binary relation $R$. Suppose $(\pk,\sk,\mathfrak m)=\GGen[k;r]$, for some security parameter $k$ and coins $r$. We say $\Sigma$ is a *mixnet on pairs* if $((\pk,\allowbreak{\bf c_1},\allowbreak{\bf c'_1},\allowbreak{\bf c_2},\allowbreak{\bf c'_2}),\allowbreak({\bf r_1},\allowbreak{\bf r_2},\allowbreak\chi)) \in R
\allowbreak\Leftrightarrow\allowbreak \bigwedge_{1\leq i \leq |{\bf c_1}|,{\bf j}\in\{1,2\}}
{\bf c'_j}[i] = {\bf c_j}[\chi(i)] \otimes \EEnc[\pk]{\allowbreak\mathfrak e;\allowbreak {\bf r_j}[i]}
\wedge |{\bf c_1}| = |{\bf c'_1}| = |{\bf c_2}| = |{\bf c'_2}| = |{\bf r_1}|= |{\bf r_2}|$, where ${\bf c_1}$, ${\bf c'_1}$, ${\bf c_2}$ and ${\bf c'_2}$ are vectors of ciphertexts encrypted under $\pk$, ${\bf r_1}$ and ${\bf r_2}$ are vectors of coins, $\chi$ is a permutation on $\{1,\dots,|{\bf c_1}|\}$, and $\mathfrak e$ is an identity element of the encryption scheme’s message space with respect to $\odot$.*
**Definition 2**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, and $\mathcal H$ satisfy the preconditions of Definition [def:elec:gjcj]. Further suppose $\Sigma_7$ is a mixnet on pairs. Let $\Gamma = (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$, $\sFS{\Sigma_6}{\allowbreak\mathcal H} = (\ProveMixSymb,\allowbreak \VerMixSymb)$, and $\sFS{\Sigma_7}{\allowbreak\mathcal H} = (\ProveMixPairSymb,\allowbreak \VerMixPairSymb)$. Moreover, let $\mathfrak e$ be an identity element of $\Gamma$’s message space with respect to $\odot$. We define $\JCJc(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6,\allowbreak\Sigma_7,\allowbreak \mathcal H)$ as $\mathsf{JCJ}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6,\allowbreak \mathcal H) =\allowbreak (\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$ after the following modifications. First, $\TallySymb$ computes $\auxMix{1}$ as $\auxMix{1} \leftarrow \ProveMixPairSymb((\pk_T,
(b'_1[1],\dots, b'_{|{\bf BB}|}[1]),
{\bf C_1}),
(b'_1[2],\dots,\allowbreak b'_{|{\bf BB}|}[2]),
{\bf C_2}),
({\bf r_1},{\bf r_2},\chi), k)$, and $\auxMix{2}$ as $\auxMix{2} \leftarrow\allowbreak {\perp}$. Secondly, $\VerifySymb$ replaces checks using $\VerMixSymb$ with the following check $\VerMixPair{\pk_T,\allowbreak(b'_1[1],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[1]),\allowbreak{\bf C_1},\allowbreak(b'_1[2],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[2]),\allowbreak{\bf C_2}}{\allowbreak\auxMix{1},\allowbreak k} =\allowbreak {1} \wedge
\VerMix{\pk_T,\allowbreak\allowbreak(pd_1,\allowbreak\dots,\allowbreak pd_{|\electoralroll|}),\allowbreak{\bf C_3}}{\auxMix{3},\allowbreak k} =\allowbreak {1}$.*
Lemmata [lem:JCJ-is-correct] can be adapted to show that $\JCJc$ is a construction for election schemes.
Election schemes constructed from $\JCJc$ satisfy individual (§1.1), universal (§1.2) and eligibility (§1.3) verifiability, hence, such schemes satisfy election verifiability with internal authentication (§1.4), assuming that the cryptographic primitives satisfy certain properties that we identify.
## Individual verifiability
**Proposition 1**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$ and $\mathcal H$ satisfy the preconditions of Definition 2. Further suppose that $\Gamma$ is collision-free for its message space. We have $\JCJc(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \mathcal H)$ satisfies individual verifiability.*
Let $\JCJc(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \mathcal H)\allowbreak=\allowbreak(\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\Gamma = (\GGenSymb,\allowbreak\EEncSymb,\allowbreak\DDecSymb)$, and $\sFS{\allowbreak\Sigma_1}{\mathcal H} = (\ProveKeySymb, \allowbreak\VerKeySymb)$. Suppose $k$ is a security parameter, $\PKT$ is a public key, $n_C$ is an integer, and $\beta$ and $\beta'$ are choices. Further suppose $(\pk,\allowbreak\sk)$ and $(\pk',\sk')$ are outputs of $\RegisterSymb(\PKT,k)$, $b$ is an output of $\Vote[\sk,\PKT,n_C,\beta,k]$, and $b'$ is an output of $\Vote[\sk',\allowbreak\PKT,\allowbreak n_C,\allowbreak \beta',\allowbreak k]$, such that $b\neq{\perp}$ and $b'\neq{\perp}$. By definition of $\VoteSymb$, we have $\PKT$ is a vector $(\pk_T,\mathfrak m,\rho)$ and $\VerKeySymb((k,\allowbreak\pk_T,\allowbreak\mathfrak m),\allowbreak\rho,k) = 1$. Moreover, $b[2]$ is an output of $\EEnc[\pk_T]{\sk}$ and $b'[2]$ is an output of $\EEnc[\pk_T]{\sk'}$, where $\sk,\sk'\in\mathfrak m$. Furthermore, the ciphertexts are constructed using coins chosen uniformly at random—i.e., the coins used by $b[2]$ and $b'[2]$ will be distinct with overwhelming probability. Since $\Gamma$ is collision-free for $\mathfrak m$, we have $b[2]\not=b'[2]$ and $b\not= b'$ with overwhelming probability, concluding our proof.
## Universal verifiability.
**Lemma 2**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$, and $\mathcal H$ satisfy the preconditions of Definition [def:elec:gjcj]. Further suppose $\Gamma$ is collision-free for its message space. We have $\mathsf{JCJ}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6, \allowbreak\Sigma_7, \allowbreak\mathcal H)$ satisfies Injectivity.*
The proof of Lemma 2 is similar to the proof of Lemma [lem:Helios-is-an-election-schemeII].
Generalized JCJ ballots contain encrypted choices, hence, collision-freeness of the encryption scheme ensures that distinct choices are not mapped to the same ballot.
**Proposition 3**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$, and $\mathcal H$ satisfy the preconditions of Definition 2. Further suppose that $\Gamma$ is perfectly correct, perfectly homomorphic, and collision-free for its message space, the sigma protocols satisfy special soundness and special honest verifier zero-knowledge, and $\mathcal H$ is a random oracle. We have $\JCJc(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \mathcal H)$ satisfies universal verifiability.*
Let $\JCJc(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \mathcal H)\allowbreak=\allowbreak(\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\sFS{\Sigma_1}{\allowbreak\mathcal H} =\allowbreak (\ProveKeySymb,\allowbreak \VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} =\allowbreak (\SignCiphSymb,\allowbreak \VerCiphSymb)$, $\sFS{\Sigma_3}{\allowbreak\mathcal H} = (\ProveBindSymb,\allowbreak \VerBindSymb)$, $\sFS{\Sigma_4}{\allowbreak\mathcal H} =\allowbreak (\ProveDecSymb,\allowbreak \VerDecSymb)$, $\sFS{\Sigma_5}{\allowbreak\mathcal H} =\allowbreak (\ProveEQSymb,\allowbreak \VerEQSymb)$, $\sFS{\Sigma_6}{\allowbreak\mathcal H} =\allowbreak (\ProveMixSymb,\allowbreak \VerMixSymb)$, and $\sFS{\Sigma_7}{\allowbreak\mathcal H} =\allowbreak (\ProveMixPairSymb,\allowbreak \VerMixPairSymb)$.
Suppose an execution of $\ExpUVV$ computes $$\begin{aligned}
&(\PKT, n_V)\leftarrow \adv(k);\\
&\mathbf{for}\text{ }1 \leq i \leq n_V\text{ }\mathbf{ do }\text{ }(pd_i,d_i) \leftarrow \Register[\PKT,k];\\
&\electoralroll \leftarrow \{pd_1,\dots,pd_{n_V}\};\\
&\electoralrollprivate \leftarrow \{(pd_1,d_1),\dots,(pd_{n_V}, d_{n_V})\};\\
&(\bbb, n_C, {\bf X}, {\bf P})\leftarrow \adv(\electoralrollprivate);\\
&{\bf Y}\gets \correcttally(\PKT,\bbb,\allowbreak\electoralrollprivate,n_C,k);
\end{aligned}$$ such that $\VerifySymb(\PKT, \allowbreak \bbb, \electoralroll, n_C, {\bf X}, {\bf P},k)=1$. By definition of algorithm $\VerifySymb$, we have $\PKT$ parses as a vector $(\pk_T,\mathfrak{m},\rho)$, ${\bf X}$ parses as a vector of length $n_C$, and ${\bf P}$ parses as a vector $(\auxDupl,\allowbreak{\bf C_1},\allowbreak\auxMix{1},\allowbreak{\bf C_2},\allowbreak\auxMix{2},\allowbreak{\bf C_3},\allowbreak\auxMix{3},\allowbreak\auxInelig,\allowbreak\auxDec)$. Moreover, $\VerKeySymb(\allowbreak(k,\pk_T,\mathfrak{m}),\rho,k)=1$ and $n_C \leq |\mathfrak m|$. By simulation sound extractability, we are assured that $\pk_T$ is an output of $\GGenSymb$ with overwhelming probability—i.e., there exists $r$ and $\SKT$ such that $(\pk_T, \SKT, \mathfrak{m})=\GGenSymb(k;r)$. By definition of $\RegisterSymb$, we have for all $1\leq i\leq n_V$ that $d_i$ is chosen uniformly at random from $\mathfrak{m}$ and there exists coins $s_i$ such that $pd_i=\EEncSymb(\pk_T,d_i;s_i)$.
Let $\{b_1, \dots, b_\ell\}$ be the largest subset of $\bbb$ such that for all $1 \leq i \leq \ell$ we have $b_i$ is a vector of length $4$ and $\VerCiphSymb((\pk_T, b_i[1]\{1,\dots,n_C\}),b_i[3],k) = 1 \wedge \VerBindSymb((\pk_T,$ $b_i[1],b_i[2]),\allowbreak b_i[4],k) = 1$. We have for all choices $\beta\in\{1,\dots,n_C\}$, private credentials $d$, coins $r$, and ballots $b=\VoteSymb(d,\allowbreak\PKT,n_C,\beta,k;r)$ that $b\not\in\bbb\backslash\{b_1,\dots,b_\ell\}$ with overwhelming probability, since such an occurence would imply a contradiction: $\{b_1,\dots,b_\ell\}$ is not the largest subset of $\bbb$ satisfying the conditions of the $\TallySymb$ algorithm. It follows that: $$\begin{gathered}
\label{eq:correctTally2}
\correcttally(\PKT,\electoralrollprivate,\bbb,n_C,k)\\
\mathrel= \correcttally(\PKT,\electoralrollprivate,\{b_1, \dots, b_\ell\},n_C,k)
\end{gathered}$$ A proof of ([eq:correctTally2]) follows from the definition of function $\correcttally$.
By Step [jcj:check1] of algorithm $\VerifySymb$, if $\{b_1, \dots, b_\ell\}=\emptyset$, then ${\bf X}$ is a zero-filled vector. And, by definition of function $\correcttally$ and ([eq:correctTally2]), ${\bf Y}$ is a vector of length $n_C$ such that $\bigwedge_{j=1}^{n_C}{\bf Y}[j] = 0$. Thus, ${\bf X} = {\bf Y}$, concluding our proof. Otherwise ($\{b_1,\allowbreak \dots,\allowbreak b_\ell\}\neq\allowbreak\emptyset$), we proceed as follows.
By simulation sound extractability, we have, with overwhelming probability, that for all $1 \leq i \leq \ell$ there exists choice $\beta_i\in\{1,\dots,n_C\}$, message $d'_i\in\mathfrak{m}$, and coins $r_{i,1}$ and $r_{i,2}$, such that $$\begin{aligned}
b_i[1] &= \EEnc[\pk_T]{\allowbreak \beta_i;\allowbreak r_{i,1}},\\
b_i[2] &= \EEnc[\pk_T]{\allowbreak d'_i;\allowbreak r_{i,2}},
\end{aligned}$$ $b_i[3]$ is an output of $\SignCiphSymb((\pk_T,\allowbreak b_i[1],\allowbreak\{1,\allowbreak\dots,\allowbreak n_C\}),\allowbreak(\beta_i,\allowbreak r_{i,1}),\allowbreak k)$, and $b_i[4]$ is an output of $\ProveBindSymb((\pk_T,\allowbreak b_i[1],\allowbreak b_i[2]),(\beta_i,\allowbreak r_{i,1},\allowbreak d'_i,\allowbreak r_{i,2}),\allowbreak k)$. Moreover, by inspection of $\VoteSymb$, we have $$\label{eq:jcj:UV}
\forall i\in\{1,\dots,\ell\}, \exists r \mathrel : b_i=\Vote[d'_i,\PKT,n_C,\beta_i,k;r]$$ Thus, $\{b_1,\dots,b_\ell\}$ is a set of ballots, and we will now consider which ballots are authorized.
By Step [check:duplicateElim] of algorithm $\VerifySymb$, we have $\auxDupl$ is a vector of length $\ell$ and for all $1 \leq i \leq \ell$ either: i) $\auxDupl[i]$ parses as a vector $(j,\sigma)$, $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak\sigma,\allowbreak k) = {1}$, and $j\in\{1,\dots,i-1,i+1,\dots,\ell\}$, therefore, by simulation sound extractability, we have $\DDec[\sk_T]{\allowbreak b_i[2]} = \DDec[\sk_T]{\allowbreak b_j[2]}$, or ii) $\auxDupl[i]$ parses as a vector $(0,\sigma_1,\dots,\sigma_{i-1},\sigma_{i+1},\dots,\sigma_{\ell})$ and for all $j\in\{1,\dots,i-1,i+1,\dots,\ell\}$ we have $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 0),\allowbreak\sigma_j,\allowbreak k) = {1}$ and, by simulation sound extractability, we have $\DDec[\sk_T]{\allowbreak b_i[2]} \not=\allowbreak \DDec[\sk_T]{\allowbreak b_j[2]}$. Although, key pair $\pk_T$ and $\sk_T$ may not have been constructed with coins chosen uniformly at random, and similarly ciphertexts $b_1[2],\dots,b_\ell[2]$ may not have been constructed with coins chosen uniformly at random, we nevertheless have for all $1 \leq i \leq \ell$ that if $\auxDupl[i]$ parses as a vector $(j,\sigma)$ such that $j\in\{1,\dots,i-1,i+1,\dots,\ell\}$, then $d'_i = d'_j$, otherwise, $d'_i \not= d'_j$ for all $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak{i+1},\allowbreak\dots,\allowbreak \ell\}$, with overwhelming probability, because $\Gamma$ is perfectly correct. Let ${\bf BB}$ be computed as per Step [jcj:tally2] of the tallying algorithm. Suppose ${\bf BB} = (b'_1,\allowbreak\dots,\allowbreak b'_{|{\bf BB}|})$. Hence, there trivially exists an injective function $\lambda:\{1,\dots,|{\bf BB}|\}\rightarrow\{1,\dots,\ell\}$ such that for all $1\leq i \leq |{\bf BB}|$ we have $b'_i = b_{\lambda(i)}$, moreover, for all $j\in \{1,\allowbreak\dots,i-1,i+1,\dots,\allowbreak |{\bf BB}|\}$ we have $d'_{\lambda(i)}\not= d'_{\lambda(j)}$. It follows that $$\begin{gathered}
\label{eq:jcj:UV2}
\forall i\in \lambda(\{1,\dots,|{\bf BB}|\}) : \\
\neg \exists j,\beta,r \mathrel : b_j=\Vote[d_i,\PKT,n_C,\beta,k;r]\\
\wedge j\in\{1,\dots,i-1,i+1,\dots,\ell\}
\end{gathered}$$ Moreover, $$\begin{gathered}
\label{eq:jcj:UV3}
\forall i\in \{1,\dots,\ell\} \setminus \lambda(\{1,\dots,|{\bf BB}|\}) : \\
\exists j,\beta,r \mathrel : b_j=\Vote[d_i,\PKT,n_C,\beta,k;r]\\
\wedge j\in\{1,\dots,i-1,i+1,\dots,\ell\}
\end{gathered}$$
Thus, $\{b_i \mid i\in\lambda(\{1,\dots,|{\bf BB}|\})\}$ is the largest subset of ballots from $\{b_1,\dots,b_\ell\}$ such that each ballot was constructed using a distinct private credential.
By Step [jcj:check3] of algorithm $\VerifySymb$, we have $\VerMixPair{\pk_T,\allowbreak(b'_1[1],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[1]),\allowbreak{\bf C_1},\allowbreak(b'_1[2],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[2]),\allowbreak{\bf C_2}}{\allowbreak\auxMix{1},\allowbreak k} =\allowbreak {1} \wedge
\VerMix{\pk_T,\allowbreak(pd_{\pi(1)},\dots,pd_{\pi(|\electoralroll|)}),\allowbreak{\bf C_3}}{\auxMix{3},\allowbreak k} =\allowbreak {1}$, where $\pi$ is a permutation on $\{1,\dots,|\electoralroll|\}$ such that $pd_{\pi(1)}<\allowbreak \dots <\allowbreak pd_{\pi(|\electoralroll|)}$. And, by simulation sound extractability, there exists vectors ${\bf r_1},{\bf r_2},{\bf r_3}$, a permutation $\chi$ on $\{1,\dots,|{\bf BB}|\}$, and a permutation $\chi'$ on $\{1,\dots,n_V\}$, such that for all $1\leq i \leq |{\bf BB}|$ we have ${\bf C_1}[i] = b'_{\chi(i)}[1] \otimes \EEnc[\pk_T]{\mathfrak e; {\bf r_1}[i]}$ and ${\bf C_2}[i] = b'_{\chi(i)}[2] \otimes \EEnc[\pk_T]{\mathfrak e; {\bf r_2}[i]}$, and for all $1\leq i \leq n_V$ we have ${\bf C_3}[i] = pd_{\chi'(\pi(i))} \otimes \EEnc[\pk_T]{\mathfrak e; {\bf r_3}[i]}$. Although, key pair $\pk_T$ may not have been constructed with coins chosen uniformly at random, we nevertheless have for all $1\leq i \leq |{\bf BB}|$ that
$$\begin{aligned}
{\bf C_1}[i] &= \EEnc[\pk_T]{\allowbreak \beta_{\lambda(\chi(i))};\allowbreak r_{{\lambda(\chi(i))},1} \oplus {\bf r_1}[i]} \\
{\bf C_2}[i] &= \EEnc[\pk_T]{\allowbreak d'_{\lambda(\chi(i))};\allowbreak r_{{\lambda(\chi(i))},2} \oplus {\bf r_2}[i]}
\intertext{
and for all $1\leq i \leq n_V$ that
}
{\bf C_3}[i] &= \EEncSymb(\pk_T,d_{\chi'(\pi(i))};s_{\chi'(\pi(i))} \oplus {\bf r_3}[i])
\end{aligned}$$ because $\Gamma$ is perfectly homomorphic, and $\mathfrak e$ is an identity element.
By Step [check:ineligible] of algorithm $\VerifySymb$, we have $\auxInelig$ is a vector of length $|{\bf C_2}|$ and for all $1 \leq i \leq |{\bf C_2}|$ either: i) $\auxInelig[i]$ parses as a vector $(j,\sigma)$, $\VerEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 1),\allowbreak\sigma,\allowbreak k) = {1}$, and $j\in\{1,\dots,|{\bf C_3}|\}$, therefore, by simulation sound extractability, we have $\DDec[\sk_T]{\allowbreak {\bf C_2}[i]} = \DDec[\sk_T]{\allowbreak {\bf C_3}[j]}$, or ii) $\auxInelig[i]$ parses as a vector $(0,\sigma_1,\dots,\sigma_{|{\bf C_3}|})$ and for all $1 \leq j \leq |{\bf C_3}|$ we have $\VerEQSymb((\pk_T,\allowbreak {\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 0),\sigma_j,\allowbreak k) =\allowbreak {1}$, therefore, by simulation sound extractability, we have $\DDec[\sk_T]{\allowbreak {\bf C_2}[i]} \not=\allowbreak \DDec[\sk_T]{\allowbreak {\bf C_3}[j]}$. Although, key pair $\pk_T$ and $\sk_T$ may not have been constructed with coins chosen uniformly at random, and similarly ciphertexts ${\bf C_2}[1],\allowbreak\dots,\allowbreak{\bf C_2}[|{\bf BB}|],\allowbreak
{\bf C_3}[1],\allowbreak\dots,\allowbreak{\bf C_3}[n_V]$ may not have been constructed with coins chosen uniformly at random, we nevertheless have for all $1 \leq i \leq |{\bf C_2}|$ that if $\auxInelig[i]$ parses as a vector $(j,\sigma)$ such that $j\in\{1,\dots,|{\bf C_3}|\}$, then $d'_{\lambda(\chi(i))} = d_{\chi'(\pi(j)}$, otherwise, $d'_{\lambda(\chi(i))}\not\in\{d_1,\dots,d_{n_V}\}$, with overwhelming probability, because $\Gamma$ is perfectly correct. Let ${\bf C'_1}$ be computed as per Step [jcj:tally4] of algorithm $\TallySymb$. Hence, there trivially exists an injective function $\lambda' : \{1,\dots,|{\bf C'_1}|\} \rightarrow \{1,\dots,|{\bf C_1}|\}$ such that for all $1\leq i \leq |{\bf C'_1}|$ we have ${\bf C'_1}[i] = {\bf C_1}[\lambda'(i)]$, moreover, $d'_{\lambda(\chi(\lambda'(i)))} \in \{d_1,\dots,d_{n_V}\}$ It follows that $$\label{eq:jcj:UV5}
\forall i\in\lambda\Big(\chi\big(\lambda'(\{1,\dots,|{\bf C'_1}|\})\big)\Big) : d_i\in\{d_1,\dots,d_{n_V}\}$$ Moreover, $$\begin{gathered}
\label{eq:jcj:UV6}
\forall i\in\{1,\dots,\ell\}\setminus\lambda\Big(\chi\big(\lambda'(\{1,\dots,|{\bf C'_1}|\})\big)\Big) :\\ d_i\not\in\{d_1,\dots,d_{n_V}\}
\end{gathered}$$ Thus, $\Big\{b_i \mid i\in\lambda\Big(\chi\big(\lambda'(\{1,\dots,|{\bf C'_1}|\})\big)\Big)\Big\}$ is the largest subset of ballots from $\{b_1,\dots,b_\ell\}$ such that each ballot was constructed using a distinct private credential from $\electoralrollprivate$.
By ([eq:jcj:UV]) – ([eq:jcj:UV6]), the set of authorized ballots in $\{b_1,\dots,b_\ell\}$ is $$\bbb^* =
\Big\{b_i \mid i\in\lambda\Big(\chi\big(\lambda'(\{1,\dots,|{\bf C'_1}|\})\big)\Big)\Big\}$$ therefore, since ${\perp}\not\in\{b_1,\dots,b_\ell\}$, we have $$\begin{aligned}
&\authorized(\PKT,\{b_1,\allowbreak\dots,\allowbreak b_\ell\}\setminus\{\perp\},\electoralrollprivate, n_C,k) \\
&\mathrel= \authorized(\PKT,\{b_1,\allowbreak\dots,\allowbreak b_\ell\},\allowbreak\electoralrollprivate,\allowbreak n_C,\allowbreak k)\\
&\mathrel= \authorized(\PKT,\bbb^*,\electoralrollprivate, n_C,k)\\
%= \authorized(\PKT,\bbb^*\setminus\{\perp\},\electoralrollprivate, n_C,k)
&\mathrel=\bbb^*
\end{aligned}$$
Hence, by ([eq:correctTally2]) and definition of $\correcttally$, and since ${\bf Y}=\correcttally(\allowbreak\PKT,\allowbreak\bbb,\allowbreak\electoralrollprivate,\allowbreak n_C,\allowbreak k)$, it follows for all $\beta \in \{1,\allowbreak \dots,\allowbreak n_C\}$ that $\exists^{={\bf Y}[\beta]} b\in\bbb^* : \exists \sk, r : b=\Vote[\sk,\allowbreak\PKT,\allowbreak n_C,\allowbreak\beta,\allowbreak k;\allowbreak r]$, therefore, $\exists^{={\bf Y}[\beta]} i\in
\lambda\Big(\chi\big(\lambda'(\{1,\allowbreak\dots,\allowbreak|{\bf C'_1}|\})\big)\Big) : \beta =\allowbreak \beta_i$ and, equivalently, $$\label{eq:jcj:UV7}
\exists^{={\bf Y}[\beta]} i\in
\{1,\dots,|{\bf C'_1}|\} : \beta = \beta_{\lambda(\chi(\lambda'(i)))}$$ Thus, $\beta_{\lambda(\chi(\lambda'(1)))},\dots,\beta_{\lambda(\chi(\lambda'(|{\bf C'_1}|)))}$ are the choices used to construct authorized recorded ballots.
By Step [check:decryption] of algorithm $\VerifySymb$, we have $\auxDec$ is a vector $((\beta'_1,\sigma_1),\dots,(\beta'_{|{\bf C'_1}|},\sigma_{|{\bf C'_1}|}))$ such that for all $1\leq i \leq |{\bf C'_1}|$ we have $\VerDecSymb((\pk_T,{\bf C'_1}[i],\beta'_i),\sigma_i,k) = 1$ and for all $1 \leq \beta \leq n_C$ we have $\exists^{={\bf X}[\beta]} j\in\{1,\dots,{|{\bf C'_1}|}\} :\beta = \beta'_j$. And, by simulation sound extractability, we have $\beta'_j = \beta_{\lambda(\chi(\lambda'(j)))}$. Thus, we have ${\bf X} = {\bf Y}$ by ([eq:jcj:UV7]), concluding our proof.
**Proposition 4**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$ and $\mathcal H$ satisfy the preconditions of Definition [def:elec:gjcj]. Further suppose $\Gamma$ is perfectly correct and $\Sigma_2$ and $\Sigma_5$ satisfy special soundness and special honest verifier zero-knowledge. We have $\mathsf{JCJ}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6, \allowbreak\Sigma_7, \allowbreak\mathcal H)$ satisfies Completeness.*
Let $\mathsf{JCJ}(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \allowbreak\mathcal H) = (\SetupSymb,\allowbreak\RegisterSymb,\allowbreak\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb)$, $\sFS{\Sigma_1}{\allowbreak\mathcal H} =\allowbreak (\ProveKeySymb, \allowbreak\VerKeySymb)$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} =\allowbreak (\SignCiphSymb, \allowbreak\VerCiphSymb)$, $\sFS{\Sigma_4}{\allowbreak\mathcal H} =\allowbreak (\ProveDecSymb, \allowbreak\VerDecSymb)$, $\sFS{\Sigma_5}{\allowbreak\mathcal H} =\allowbreak (\ProveEQSymb, \allowbreak\VerEQSymb)$, $\sFS{\Sigma_6}{\allowbreak\mathcal H} =\allowbreak (\ProveMixSymb, \allowbreak\VerMixSymb)$, and $\sFS{\Sigma_7}{\allowbreak\mathcal H} =\allowbreak (\ProveMixPairSymb, \allowbreak\VerMixPairSymb)$.
Suppose $k$ is a security parameter and $\adv$ is a PPT adversary. Further suppose $(\PKT,\allowbreak\SKT,\allowbreak m_B,\allowbreak m_C)$ is an output of $\Setup[k]$, $n_V$ is an output of $\adv(\PKT,k)$, $(pd_1,d_1),\dots,(pd_{n_V},d_{n_V})$ are outputs of $\Register[\PKT,k]$, $\electoralroll = \{pd_1,\dots,pd_{n_V}\}$, $\electoralrollprivate = \{(\pk_1,\sk_1),\dots,(\pk_{n_V},\sk_{n_V})\}$, $(\bbb,n_C)$ is an output of $\adv(\electoralrollprivate)$, and $({\bf X}, {\bf P})$ is an output of $\Tally[\SKT, \allowbreak\bbb,\electoralroll,n_C,k]$. If $|\bbb| \not\leq m_B \vee n_C\not\leq m_C$, then we conclude immediately, otherwise ($|\bbb| \leq m_B \wedge n_C\leq m_C$), we proceed as follows.
By definition of $\SetupSymb$, $\PKT=(\pk,\allowbreak\mathfrak m,\allowbreak\rho)$, $\SKT=(\pk,\sk)$, and $m_C=|\mathfrak m|$, where $(\pk,\allowbreak\sk,\allowbreak\mathfrak m) = \GGen[k;r]$ and $\rho$ is an output of $\ProveKeySymb((k,\allowbreak\pk,\allowbreak\mathfrak m),\allowbreak(\sk,\allowbreak r),\allowbreak k)$ for some coins $r$ chosen uniformly at random by algorithm $\SetupSymb$. By definition of algorithm $\TallySymb$, ${\bf X}$ is a vector of length $n_C$ and ${\bf P}$ is a vector $(\auxDupl,{\bf C_1},\auxMix{1},{\bf C_2},\auxMix{2},{\bf C_3},\allowbreak\auxMix{3},\auxInelig,\auxDec)$. It follows that algorithm $\VerifySymb$ can parse $\PKT$, ${\bf X}$ and ${\bf P}$ successfully. Moreover, by completeness of $(\ProveKeySymb,\allowbreak \VerKeySymb)$, we have $\VerKeySymb((k,\pk,\mathfrak m),\rho,k) \allowbreak= 1$, with overwhelming probability.
Suppose subset $\{b_1,\allowbreak\dots,\allowbreak b_l\}$ is computed as per Step [jcj:tally1] of algorithm $\TallySymb$. Hence, $\{b_1,\allowbreak \dots,\allowbreak b_\ell\}$ is the largest subset of $\bbb$ such that $b_1<\allowbreak\dots<\allowbreak b_l$ and for all $1 \leq\allowbreak i \leq\allowbreak \ell$ we have $b_i$ is a vector of length $4$, $\VerCiphSymb((\pk_T,\allowbreak b_i[1],\allowbreak\{1,\allowbreak\dots,\allowbreak n_C\}),\allowbreak b_i[3],\allowbreak k) =\allowbreak 1$, and $\VerBindSymb((\pk_T,\allowbreak b_i[1],\allowbreak b_i[2]),\allowbreak b_i[4],\allowbreak k) =\allowbreak 1$. (Condition $b_1<\allowbreak\dots<\allowbreak b_l$ ensures that algorithms $\TallySymb$ and $\VerifySymb$ compute $b_1,\dots,b_l$ in the same order, which is necessary to ensure that proofs constructed by $\TallySymb$ in relation to a particular ballot, are checked by $\VerifySymb$ in relation to that ballot.) We have $\{b_1,\allowbreak \dots,\allowbreak b_\ell\} =\allowbreak \emptyset$ implies ${\bf X}$ is a zero-filled vector, because ${\bf X}$ is initialized as a zero-filled vector. Thus, the check holds in Step [jcj:check1] of $\VerifySymb$.
Since $\Sigma_2$ satisfies special soundness and special honest verifier zero-knowledge, we have by simulation sound extractability that for all $1 \leq i \leq \ell$ there exists messages $\beta_i,d'_i\in\mathfrak{m}$ and coins $r_{i,1}$ and $r_{i,2}$, such that $$\begin{aligned}
b_i[1] &= \EEnc[\pk_T]{\allowbreak \beta_i;\allowbreak r_{i,1}}\\
b_i[2] &= \EEnc[\pk_T]{\allowbreak d'_i;\allowbreak r_{i,2}}
\end{aligned}$$ with overwhelming probability.
Suppose $\auxDupl$ is computed as per Step [jcj:tally2] of algorithm $\TallySymb$. Hence, $\auxDupl$ is a vector of length $\ell$ such that for all $1 \leq i \leq \ell$ we have either: i) $\auxDupl[i]$ is a vector $(j,\sigma)$, $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sigma,\allowbreak k) =\allowbreak {1}$, and $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak\allowbreak{i+1},\allowbreak\dots,\allowbreak\ell\}$ or ii) for all $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak\allowbreak{i+1},\allowbreak\dots,\allowbreak\ell\}$ we have $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sigma,\allowbreak k) \not=\allowbreak {1}$ for some output $\sigma$ of $\ProveEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 1),\allowbreak \sk_T,\allowbreak k)$, and $\auxDupl[i]$ is a vector $(0,\allowbreak\sigma_1,\allowbreak\dots,\allowbreak\sigma_{i-1},\allowbreak\sigma_{i+1},\allowbreak\dots,\allowbreak\sigma_{\ell})$ such that $\sigma_j$ is an output of $\ProveEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 0),\allowbreak \sk_T,\allowbreak k)$ for all $j\in\{1,\allowbreak\dots,\allowbreak{i-1},\allowbreak\allowbreak{i+1},\allowbreak\dots,\allowbreak\ell\}$. In the former case, relevant checks trivially hold in Step [check:duplicateElim] of $\VerifySymb$. Let us show that relevant checks hold in the latter case too. Although ciphertexts $b_1[2],\dots,b_\ell[2]$ may not have been constructed with coins chosen uniformly at random, we nevertheless have for all $1\leq i \leq \ell$ that $\DDec[\sk]{b_i[2]} \not= {\perp}$, because $\Gamma$ is perfectly correct. Suppose $\auxDupl[i] = (0,\sigma_1,\dots,\sigma_{i-1},\sigma_{i+1},\dots,\sigma_{\ell})$ in the latter case. Since $\Sigma_5$ satisfies special soundness and special honest verifier zero-knowledge, we have by simulation sound extractability that $\DDec[\sk]{b_i[2]} \not= \DDec[\sk]{b_j[2]}$ for all integers $j\in\{1,\allowbreak\dots,\allowbreak i-1,\allowbreak i+1,\allowbreak\dots,\allowbreak\ell\}$, with overwhelming probability. Therefore, by completeness of $(\ProveEQSymb,\VerEQSymb)$, we have $\VerEQSymb((\pk_T,\allowbreak b_i[2],\allowbreak b_j[2],\allowbreak 0),\allowbreak\sigma_j,\allowbreak k) = {1}$ for all $j\in\{1\dots,i-1,i+1,\dots,\ell\}$, with overwhelming probability. Thus, the relevant checks hold in Step [check:duplicateElim] of $\VerifySymb$, with overwhelming probability.
Suppose ${\bf BB}$ is computed as per Step [jcj:tally2] of algorithm $\TallySymb$. Moreover, suppose ${\bf BB} = (b'_1,\dots,b'_{|{\bf BB}|})$. Further suppose vectors ${\bf C_1}$ and ${\bf C_2}$ are computed as per Step [jcj:tally3] of algorithm $\TallySymb$. Hence, for all $1 \leq i \leq |{\bf BB}|$ we have $$\begin{aligned}
{\bf C_1}[i] &= b'_{\chi(i)}[1] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_1}[i]} \textrm{ and }\\
{\bf C_2}[i] &= b'_{\chi(i)}[2] \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_2}[i]},
\end{aligned}$$ where $\chi$ is a permutation on $\{1,\dots,|{\bf BB}|\}$, and ${\bf r_1}$ and ${\bf r_2}$ are vectors of coins.
Let ${\bf BB_1} = (b'_1[1],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[1])$ and ${\bf BB_2} = (b'_1[2],\allowbreak\dots,\allowbreak b'_{|{\bf BB}|}[2])$. Suppose $\auxMix{1}$ is computed as per Step [jcj:tally3] of algorithm $\TallySymb$. Hence, $\auxMix{1}$ is an output of $\ProveMixPairSymb((\pk_T,\allowbreak{\bf BB_1},\allowbreak{\bf C_1},\allowbreak{\bf BB_2},\allowbreak{\bf C_2}),\allowbreak({\bf r_1},\allowbreak{\bf r_2},\allowbreak\chi),\allowbreak k)$. By the completeness of $(\ProveMixPairSymb,\VerMixPairSymb)$, we have $\VerMixPairSymb((\pk_T,{\bf BB_1},{\bf C_1},\allowbreak{\bf BB_2},\allowbreak{\bf C_2}),\auxMix{1},k) = {1}$, with overwhelming probability. Similarly, suppose $\electoralroll = \{pd_1,\allowbreak\dots,\allowbreak pd_{|\electoralroll|}\}$ such that $pd_1<\dots[jcj:tally3] of algorithm $\TallySymb$. Hence, for all $1 \leq i \leq |\electoralroll|$ we have $${\bf C_3}[i] = pd_{\chi'(i)} \otimes\allowbreak \EEnc[\pk_T]{\mathfrak e;\allowbreak {\bf r_3}[i]},$$ where $\chi'$ is a permutation on $\{1,\dots,|\electoralroll|\}$ and ${\bf r_3}$ is a vector of coins chosen uniformly at random by algorithm $\TallySymb$.
Suppose $\auxMix{3}$ is also computed as per Step [jcj:tally3] of algorithm $\TallySymb$. Hence, $\auxMix{3}$ is an output of $\ProveMix{\pk_T,\allowbreak(pd_1,\dots,pd_{|\electoralroll|}),{\bf C_3}}{{\bf r_3},\allowbreak\chi'}$. By the completeness of $(\ProveMixSymb,\VerMixSymb)$, we have $\VerMixSymb((\pk_T,(pd_1,\dots,pd_{|\electoralroll|}),{\bf C_3}),\auxMix{3},k) = {1}$, with overwhelming probability. It follows that checks hold in Step [jcj:check3] of $\VerifySymb$, with overwhelming probability.
Suppose $\auxInelig$ is computed as per Step [jcj:tally4] of algorithm $\TallySymb$. Hence, $\auxInelig$ is a vector of length $|{\bf C_2}|$ such that for all $1\leq i \leq|{\bf C_2}|$ we have either: i) $\auxInelig[i]$ is a vector $(j,\sigma)$, $\VerEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],1),\allowbreak\sigma,\allowbreak k) =\allowbreak {1}$, and $j\in\{1,\dots,|{\bf C_3}|\}$, or ii) for all $j\in\{1,\dots,|{\bf C_3}|\}$ we have $\VerEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],1),\allowbreak\sigma,\allowbreak k) \not=\allowbreak {1}$ for some output $\sigma$ of $\ProveEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 1), \sk_T,\allowbreak k)$, and $\auxInelig[i]$ is a vector $(0,\sigma_1,\allowbreak\dots,\allowbreak\sigma_{|{\bf C_3}|})$ such that for all $j\in\{1,\dots,|{\bf C_3}|\}$ we have $\sigma_j$ is an output of $\ProveEQSymb((\pk_T,\allowbreak{\bf C_2}[i],\allowbreak{\bf C_3}[j],\allowbreak 0),\allowbreak \sk_T,\allowbreak k)$. In the former case, relevant checks trivially hold in Step [jcj:check4] of $\VerifySymb$. Let us show that relevant checks hold in the latter case too. We have for all $1 \leq i \leq |\electoralroll|$ that $pd_{\chi'(i)}$ is a ciphertext on $d_{\chi'(i)}\in\mathfrak{m}$ constructed using some coins $r_i$ chosen uniformly at random by algorithm $\RegisterSymb$. Thus, for all $1\leq i \leq |\electoralroll|$ we have ${\bf C_3}[i] = \EEnc[\pk_T]{d_{\chi'(i)};\allowbreak r_i \oplus {\bf r_3}[i]}$, therefore, $\DDec[\sk]{{\bf C_3}[j]} \not= {\perp}$, with overwhelming probability, because $\Gamma$ is homomorphic and $\mathfrak e$ is an identity element. Moreover, we have for all $1\leq i \leq |{\bf BB}|$ that ${\bf C_2}[i] = \EEnc[\pk_T]{\allowbreak d'_{\lambda(\chi(i))};\allowbreak r_{{\lambda(\chi(i))},2} \oplus {\bf r_2}[i]}$, with overwhelming probability, because $\Gamma$ is homomorphic and $\mathfrak e$ is an identity element. And, since $\Gamma$ is perfectly correct, we have $\DDec[\sk]{{\bf C_2}[i]} \not= {\perp}$ for all $1\leq i \leq |{\bf BB}|$. (The homomorphic property of $\Gamma$ is insufficient to infer $\DDec[\sk]{{\bf C_2}[i]} \not= {\perp}$, because ciphertext $b'_{\chi(i)}[2]$ may not have been constructed using coins chosen uniformly at random.) Suppose $\auxInelig[i] = (0,\sigma_1,\allowbreak\dots,\allowbreak\sigma_{|{\bf C_3}|})$ in the latter case. Since $\Sigma_5$ satisfies special soundness and special honest verifier zero-knowledge, we have by simulation sound extractability that $\DDec[\sk]{{\bf C_2}[i]} \not= \DDec[\sk]{{\bf C_3}[j]}$ for all $1\leq j \leq |\electoralroll|$, with overwhelming probability. Therefore, by completeness of $(\ProveEQSymb,\VerEQSymb)$, we have $\VerEQSymb((\pk_T,\allowbreak {\bf C_2}[i],\allowbreak {\bf C_3}[j],\allowbreak 0),\allowbreak\sigma_j,\allowbreak k) =\allowbreak 1$ for all $1\leq j \leq |\electoralroll|$, with overwhelming probability. Thus, the relevant checks hold in Step [check:ineligible] of $\VerifySymb$, with overwhelming probability.
Suppose ${\bf C_1'}$ is computed as per Step [jcj:tally4] of algorithm $\TallySymb$. And $\auxDec$ is computed as per Step [jcj:tally5] of algorithm $\TallySymb$. Hence, $\auxDec$ is a vector $((\beta_1,\sigma_1),\dots,(\beta_{|{\bf C'_1}|},\sigma_{|{\bf C'_1}|}))$ such that for all $1\leq i \leq |{\bf C'_1}|$ we have $\beta_i=\DDec[\sk_T]{\allowbreak{\bf C'_1}[i]}$ and $\sigma_i$ is an output of $\ProveDecSymb(\pk_T,\allowbreak{\bf C'_1}[i],\allowbreak\beta_i),\allowbreak\sk_T,\allowbreak k)$, therefore, by completeness of $(\ProveDecSymb,\VerDecSymb)$, we have $\VerDecSymb((\pk_T,{\bf C'_1}[i],\beta_i),\sigma_i,k) = 1$, with overwhelming probability. Moreover, since ${\bf X}$ is derived by initializing ${\bf X}$ as a zero-filled vector of length $n_C$ and computing , we have for all $1 \leq \beta \leq n_C$ that $\exists^{={\bf X}[\beta]} j\in\{1,\dots,{|{\bf C'_1}|}\} :\beta = \beta_j$. It follows that checks hold in Step [check:decryption] of $\VerifySymb$, with overwhelming probability.
Since all the above checks succeed, $\VerifySymb$ outputs $1$, with overwhelming probability, concluding our proof.
## Eligibility Verifiability
We derive an asymmetric encryption scheme from generalized JCJ (Definition 3) which satisfies $\gameShortINDPA$ (Proposition 5), and prove that eligibility verifiability follows (Proposition 6).
**Definition 3**. *Suppose $\Gamma=(\GGenSymb, \EEncSymb, \DDecSymb)$ is a multiplicatively homomorphic asymmetric encryption scheme, $\Sigma_3$ proves conjunctive plaintext knowledge, and $\mathcal H$ is a random oracle. Let $\sFS{\Sigma_3}{\mathcal H}=(\ProveBindSymb,\allowbreak\VerBindSymb)$. We define $\Gamma\textsf{-}\mathsf{JCJ}(\Gamma,%\Sigma_1,
\allowbreak\Sigma_3,\mathcal H) =(\GGenSymb', \allowbreak \EEncSymb', \allowbreak \DDecSymb')$ as follows:*
- *$\GGenSymb'(k)$ selects coins $r$ uniformly at random, computes $(\pk,\allowbreak\sk,\allowbreak\mathfrak{m})\leftarrow\allowbreak\GGenSymb(k;\allowbreak r);{\mathfrak m}'\leftarrow\{(m_1,m_2) \mid m_1,\allowbreak m_2\in\mathfrak{m}\}$, and outputs $(\pk,\allowbreak\sk,\allowbreak {\mathfrak m}')$.*
- *$\EEncSymb'(\pk,{\bf m})$ parses ${\bf m}$ as a vector of length 2, outputting $\bot$ if parsing fails; selects coins $r_1$ and $r_2$ uniformly at random; computes $c_1\leftarrow\allowbreak \EEncSymb(\pk,\allowbreak{\bf m}[1];\allowbreak r_1);\allowbreak c_2\leftarrow\allowbreak\EEncSymb(\pk,\allowbreak {\bf m}[2];\allowbreak r_2);\allowbreak \tau\leftarrow\allowbreak\ProveBindSymb((\pk,\allowbreak c_1,\allowbreak c_2),\allowbreak ({\bf m}[1],\allowbreak r_1,\allowbreak {\bf m}[2],\allowbreak r_2),\allowbreak k)$; and outputs $(c_1,c_2,\tau)$.*
- *$\DDecSymb'(\sk,c)$ parses $c$ as $(c_1, c_2, \tau)$, outputting $\bot$ if parsing fails or $\VerBindSymb((\pk,\allowbreak c_1,c_2),\tau,k)\neq1$; computes $m_1\leftarrow\DDecSymb(\allowbreak\sk,c_1); m_2\leftarrow\DDecSymb(\sk,\allowbreak c_2)$; and outputs $(m_1,m_2)$.*
**Proposition 5**. *Let $\Gamma$ be a multiplicatively homomorphic asymmetric encryption scheme, $\Sigma_3$ be a sigma protocol that proves conjunctive plaintext knowledge, and $\mathcal H$ be a random oracle. Suppose $\Gamma$ satisfies $\gameShort$ and $\Sigma_3$ satisfies special soundness and special honest verifier zero-knowledge. We have $\Gamma\textsf{-}\mathsf{JCJ}(\Gamma,%\Sigma_1,
\allowbreak\Sigma_3,\mathcal H)$ satisfies $\gameShortINDPA$.*
A proof of Proposition 5 is similar to the proof of (**Bernhard11:Helios?**, Theorem 5.1), so we omit formalizing a proof.
**Proposition 6**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$ and $\mathcal H$ satisfy the preconditions of Definition 2. Further suppose that satisfies $\gameShort$, and $\Sigma_1$ and $\Sigma_3$ satisfy special soundness and special honest verifier zero-knowledge. We have $\mathsf{JCJ}(\Gamma,\allowbreak\Sigma_1,\allowbreak \Sigma_2,\allowbreak \Sigma_3,\allowbreak \Sigma_4,\allowbreak \Sigma_5,\allowbreak \Sigma_6,\allowbreak \Sigma_7,\allowbreak \mathcal H)$ satisfies $\ExpEVVWeakSymb$.*
Let $\Gamma=(\GGenSymb, \EEncSymb, \DDecSymb)$, $\Gamma\textsf{-}\mathsf{JCJ}(\Gamma,%\Sigma_1,
\allowbreak\Sigma_3,\mathcal H) =(\GGenSymb', \allowbreak \EEncSymb', \allowbreak \DDecSymb')$, $\sFS{\Sigma_2}{\allowbreak\mathcal H} = (\SignCiphSymb,\allowbreak \VerCiphSymb)$, and $\sFS{\Sigma_3}{\allowbreak\mathcal H} = (\ProveBindSymb,\allowbreak \VerBindSymb)$. By Theorem [thm:sigma], there exists a simulator for proof system $(\ProveBindSymb,\allowbreak \VerBindSymb)$. Let $\SimProveBindSymb$ be such a simulator. Similarly, let $\SimProveKeySymb$ be a simulator for $\sFS{\Sigma_1}{\allowbreak\mathcal H}$. Moreover, let $\mathfrak e$ be an identity element of $\Gamma$’s message space with respect to $\odot$.
By Lemma [lem:ev1], it suffices to show that $\ExpEVVVWeak$ is satisfied. We proceed by contradiction. Suppose $\ExpEVVVWeak$ is not satisfied, hence, there exists a PPT adversary $\adv$ that wins $\ExpEVVVWeak$ with non-negligible probability. We construct an adversary $\Adv$ against $\Gamma\textsf{-}\mathsf{JCJ}(\Gamma,\allowbreak\Sigma_3,\mathcal H)$.
- $\Adv(\pk,\mathfrak m,k)$ computes $d_{0}\leftarrow_R \mathfrak m;\allowbreak d_{1}\leftarrow_R \mathfrak m$ and outputs $((\mathfrak e,d_{0}),(\mathfrak e,d_{1}))$.
- $\Adv({\bf c} )$ parses ${\bf c}$ as a vector of length $3$, computes $\rho \leftarrow\allowbreak \SimProveKeySymb((k,\allowbreak\pk,\allowbreak\mathfrak m),\allowbreak k);\allowbreak
\PKT\leftarrow\allowbreak(\pk,\allowbreak\mathfrak{m},\allowbreak\rho);\allowbreak
% pd \leftarrow\allowbreak \EEnc[\pk]{\allowbreak \epsilon} \otimes {\bf c}[2];\allowbreak
(n_C,\beta,b)\leftarrow\allowbreak \adv(\PKT,{\bf c}[2],\allowbreak k)$, and outputs $((b[1],\allowbreak b[2],\allowbreak b[4]))$, responding to $\adv$’s oracle calls $\revealOracle'(\beta, \allowbreak n_C)$ as follows, namely, if $\beta\not\in\{1,\allowbreak\dots,\allowbreak n_C\}\allowbreak\vee\allowbreak \{1,\allowbreak\dots,\allowbreak n_C\}\not\subseteq\mathfrak m$, then return $\perp$, otherwise, select coins $r_1$ uniformly at random, compute
$c_1 \leftarrow \EEnc[\pk]{\allowbreak\beta;\allowbreak r_1}$ $c_2 \leftarrow \EEnc[\pk]{\allowbreak \epsilon} \otimes {\bf c}[2]$ $\sigma\leftarrow \SignCiphSymb((\pk,\allowbreak c_1,\allowbreak\{1,\allowbreak\dots,\allowbreak n_C\}),\allowbreak(\beta,\allowbreak r_1),\allowbreak k)$ $\tau \leftarrow \SimProveBindSymb((\pk,\allowbreak c_1,\allowbreak {\bf c}[2]),\allowbreak k)$ $b\leftarrow (c_1,c_2,\sigma,\tau)$
and return $b$.
- $\Adv( {\bf m} )$ parses ${\bf m}[1]$ as a vector $(\beta,d)$ and if $d=d_0$, then outputs $0$, otherwise, outputs $1$.
We prove $\Adv$ wins $\gameShortINDPA$ with non-negligible probability.
Suppose $(\pk,\sk,\mathfrak m)$ is an output of $\GGen[k]$, $({\bf m}_0,{\bf m}_1)$ is an output of $\Adv(\pk,\mathfrak m,k)$, and ${\bf c}$ is an output of $\EEncSymb'(\pk,{\bf m}_\alpha)$, for some bit $\alpha$ chosen uniformly at random. By definition of $\Adv$ and $\EEncSymb'$, we have ${\bf c}$ is a vector such that ${\bf c}[2]$ is an output of $\EEncSymb'(\pk,{\bf m}_\alpha[2])$, where ${\bf m}_\alpha[2]\in\mathfrak m$ was chosen uniformly at random by $\Adv$. Further suppose we run $\Adv({\bf c})$. Hence, we compute $\rho \leftarrow\allowbreak \SimProveKeySymb((k,\allowbreak\pk,\allowbreak\mathfrak m),\allowbreak k);\allowbreak
\PKT\leftarrow\allowbreak(\pk,\allowbreak\mathfrak{m},\allowbreak\rho);\allowbreak
(n_C,\beta,b)\leftarrow\allowbreak \adv(\PKT,{\bf c}[2],\allowbreak k)$. It is straightforward to see that $\Adv$ simulates $\adv$’s challenger to $\adv$, because proofs output by $\SimProveKeySymb$ are indistinguishable from proofs produced by proof system $\sFS{\Sigma_1}{\allowbreak\mathcal H}$ and ${\bf c}[2]$ corresponds to a public credential. Let us assume that $\Adv$ simulates $\adv$’s oracle to $\adv$ too. Hence, since $\adv$ is a winning adversary, we have $b$ is an output of $\VoteSymb({\bf m}_\alpha[2],\PKT,n_C,\beta,k)$ such that $b \not= {\perp}$ and $b$ was not simulated by $\Adv$ in response to an oracle call by $\adv$. By definition of $\VoteSymb$, we have $b[1] = \EEncSymb'(\pk,\allowbreak\beta;\allowbreak r_1)$, $b[2] = \EEncSymb'(\pk,\allowbreak {\bf m}_\alpha[2];\allowbreak r_2)$, and $b[4]$ is an output of $\ProveBindSymb((\pk,\allowbreak {\bf c}[1],\allowbreak {\bf c}[2]),(\beta,\allowbreak r_1,\allowbreak {\bf m}_\alpha[2],\allowbreak r_2),\allowbreak k)$, for some coins $r_1$ and $r_2$. Moreover, we have $\beta\in\{1,\allowbreak\dots,\allowbreak n_C\}$ and $\{1,\allowbreak\dots,\allowbreak n_C\}\not\subseteq\mathfrak m$, hence, $\beta\in\mathfrak m$. Suppose the run of $\Adv({\bf c})$ concludes by outputting $((b[1],\allowbreak b[2],\allowbreak b[4]))$. By completeness of $(\ProveBindSymb,\allowbreak \VerBindSymb)$, we have $\VerBindSymb((\pk,\allowbreak b[1],b[2]),b[4],k)=1$. Hence, $\DDec[\sk]{(b[1],b[2],b[4])} = (\beta,{\bf m}_\alpha[2])$. Further suppose $g$ is an output of $\adv(((\beta,{\bf m}_\alpha[2])))$. Thus, by definition of $\adv$, we have $g=\alpha$. Moreover, we have ${\bf c}\not=(b[1],\allowbreak b[2],\allowbreak b[4])$, because ${\bf c}[1]$ is not revealed to $\adv$, hence, $\adv$ cannot construct ${\bf c}[1]$, due to the precondition that $\Gamma$ satisfies $\gameShort$. It remains to prove that $\Adv$ simulates $\adv$’s oracle to $\adv$.
An oracle call $\revealOracle'(\beta,n_C)$ outputs $\perp$ if $\beta\not\in\{1,\allowbreak\dots,\allowbreak n_C\}\allowbreak\vee\allowbreak
\{1,\allowbreak\dots,\allowbreak n_C\}\not\subseteq\mathfrak m$, and it is trivial to see that $\Adv$ simulates $\adv$’s oracle to $\adv$ in this case. Otherwise, $\revealOracle'(\beta,n_C)$ computes $b \leftarrow \VoteSymb({\bf m}_\alpha[2],\PKT,n_C,\beta,k)$ and outputs $b$. By definition of $\VoteSymb$, we have $b$ is a vector of length $4$. It is trivial to see that $\Adv$ simulates the computation of $b[1]$ and $b[3]$. Moreover, if $\Adv$ simulates the computation of $b[2]$, then $\Adv$ simulates the computation of $b[4]$ too, because proofs output by $\SimProveBindSymb$ are indistinguishable from proofs output by $\ProveBindSymb$. Thus, it remains to prove that $\Adv$ simulates the computation of $b[2]$. It suffices to show that selecting coins $r_2$ uniformly at random and computing $c_2 \leftarrow \EEncSymb'(\pk,\allowbreak {\bf m}_\alpha[2];\allowbreak r_2)$ is indistinguishable from computing $c_2 \leftarrow \EEncSymb'(\pk,\allowbreak \epsilon) \otimes {\bf c}[2]$, i.e., $c_2 \leftarrow\EEncSymb'(\pk,\allowbreak \epsilon;r'_2) \otimes \EEncSymb'(\pk,{\bf m}_\alpha[2]; r)$, where coins $r'_2$ and $r$ are selected uniformly at random. Since $\Gamma$ is a homomorphic asymmetric encryption scheme and $\mathfrak e$ is an identity element, we have $c_2 \leftarrow \EEncSymb'(\pk,\allowbreak \epsilon;r'_2) \otimes \EEncSymb'(\pk,{\bf m}_\alpha[2]; r)$ is indistinguishable from $c_2 \leftarrow \EEncSymb'(\pk,\allowbreak {\bf m}_\alpha[2];r'_2 \oplus r)$, which is indistinguishable from $c_2 \leftarrow \EEncSymb'(\pk,\allowbreak {\bf m}_\alpha[2];\allowbreak r_2)$, because coins $r'_2 \oplus r$ are indistinguishable from coins (e.g., $r_2$) selected uniformly at random, thereby concluding our proof.
## Proof: Theorem [thm:jcj]
By Propositions 1, 3, 4, & 6 and Lemma 2, election schemes constructed from $\JCJc$ satisfy election verifiability with internal authentication:
**Corollary 7**. *Suppose $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$ and $\mathcal H$ satisfy the preconditions of Definition 2. Further suppose that $\Gamma$ is perfectly correct, perfectly homomorphic, and collision-free for its message space. Moreover, suppose $\Gamma$ satisfies $\gameShort$. Furthermore, suppose the sigma protocols satisfy special soundness and special honest verifier zero-knowledge, and $\mathcal H$ is a random oracle. We have $\JCJc(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \mathcal H)$ satisfies election verifiability with internal authentication.*
Let be the set of election schemes derived from $\JCJc(\Gamma,\Sigma_1, \Sigma_2, \Sigma_3, \Sigma_4, \Sigma_5, \Sigma_6, \Sigma_7, \mathcal H)$, where primitives $\Gamma$, $\Sigma_1$, $\Sigma_2$, $\Sigma_3$, $\Sigma_4$, $\Sigma_5$, $\Sigma_6$, $\Sigma_7$ and $\mathcal H$ satisfy the conditions identified in Corollary 7. Hence, Theorem [thm:jcj] is an immediate consequence of Corollary 7.
# Juels et al. Definitions
Juels et al. (**JCJ10?**) define an election scheme as a tuple of $(\RegisterSymb,\VoteSymb,\TallySymb,\VerifySymb)$ PPT algorithms:
- **Register**, denoted $(\pk,\sk) \leftarrow \Register$, is executed by the registrars. $\RegisterSymb$ takes as input the private key $\SKR$ of the registrars, a voter’s identity $i$, and security parameter $k_1$. It outputs a credential pair $(\pk,\sk)$.
- **Vote**, denoted $b \leftarrow \Vote$, is executed by voters. $\VoteSymb$ takes as input a voter’s private credential $\sk$, the public key $\PKT$ of the tallier, the number of candidates $n_C$, the voter’s choice $\beta$, and security parameter $k_2$. It outputs a ballot $b$.
- **Tally**, denoted $({\bf X},P) \leftarrow \Tally$, is executed by the tallier. $\TallySymb$ takes as input the private key $\SKT$ of the tallier, the bulletin board $\bbb$, the number of candidates $n_C$, the set containing voters’ public credentials, and security parameter $k_3$. It outputs the tally ${\bf X}$ and a proof $P$ that the tally is correct.
- **Verify**, denoted $v \leftarrow \Verify$, can be executed by anyone to audit the election. $\VerifySymb$ takes as input the public key $\PKR$ of the registrars, the public key $\PKT$ of the tallier, the bulletin board $\bbb$, the number of candidates $n_C$, and a candidate proof $P$ of correct tallying. It outputs a bit $v$, which is $1$ if the tally successfully verifies and $0$ on failure.
The above definition fixes an apparent oversight in JCJ’s presentation: we supply the registrars’ public key as input to the verification algorithm, because that key would be required by $\VerifySymb$ to check the signature on the electoral roll.
Juels et al. (**JCJ10?**) formalize *correctness* and *verifiability* to capture their notion of election verifiability. We rename those to *JCJ-correctness* and *JCJ-verifiability* to avoid ambiguity. For readability, the definitions we give below contain subtle differences from the original presentation. For example, we sometimes use for loops instead of pattern matching.
JCJ-correctness asserts that an adversary cannot modify or eliminate votes of honest voters, and stipulates that at most one ballot is tallied per voter. Intuitively, the security definition challenges the adversary to ensure that verification succeeds and the tally[^28] does not include some honest votes or contains too many votes. The definition of JCJ-correctness fixes apparent errors in the original presentation: the adversary is given the credentials for corrupt voters and distinct security parameters are supplied to the $\RegisterSymb$ and $\VoteSymb$ algorithms. An implicit assumption is also omitted: $\{\beta_i\}_{i\in \mathcal V\setminus\mathcal V'}$ is a multiset of valid votes, that is, for all $\beta \in \{\beta_i\}_{i\in \mathcal V\setminus\mathcal V'}$ we have $1\leq\beta\leq n_C$. Without this assumption the security definition cannot be satisfied by many election schemes, including the election scheme by Juels et al.
**Definition 1** (JCJ-correctness). *An election scheme $\Pi = (\RegisterSymb,\VoteSymb,\allowbreak\TallySymb,\VerifySymb)$ satisfies *JCJ-correctness* if for all PPT adversary $\adv$, there exists a negligible function $\mu$, such that for all positive integers $n_C$ and $n_V$, and security parameters $k_1$, $k_2$, and $k_3$, we have $\SuccCor\leq \mu(k_1,k_2,k_3)$, where $\ExpCorNoParam$ is defined as follows:[^29] *
* $\;=$
$\mathcal V \leftarrow \{1,\dots,n_V\}$ $\mathcal V' \leftarrow \adv(\{\pk_i\}_{i=1}^{n_V})$ $\bbb \leftarrow \{\Vote[\sk_i,\PKT,n_C,\beta_i,k_2]\}_{i\in\mathcal V\setminus \mathcal V'}$ $({\bf X},P) \leftarrow \Tally$ $\bbb\leftarrow \bbb\cup \adv(\bbb,\{(\pk_i,\sk_i)\}_{i\in\mathcal V\cap\mathcal V'})$ $({\bf X}',P') \leftarrow \Tally$ *
The JCJ-correctness definition implicitly assumes that the tally and associated proof are honestly computed using the $\TallySymb$ algorithm. By comparison, the definition of JCJ-verifiability (Definition 2) does not use this assumption, hence, JCJ-verifiability is intended to assert that voters and auditors can check whether votes have been recorded and tallied correctly. Intuitively, the adversary is assumed to control the tallier and voters, and the security definition challenges the adversary to concoct an election (that is, the adversary generates a bulletin board $\bbb$, a tally ${\bf X}$, and a proof of tallying $P$) such that verification succeeds and tally ${\bf X}$ differs tally ${\bf X}'$ derived from honestly tallying the bulletin board $\bbb$. It follows that there is at most one verifiable tally that can be derived.
**Definition 2** (JCJ-verifiability). *An election scheme $\Pi = (\RegisterSymb,\VoteSymb,\allowbreak\TallySymb,\VerifySymb)$ satisfies *JCJ-verifiability* if for all PPT adversary $\adv$, there exists a negligible function $\mu$, such that for all positive integers $n_C$ and $n_V$, and security parameters $k_1$ and $k_3$, we have $\SuccVerif\leq \mu(k_1,k_2,k_3)$, where $\ExpVerifNoParam$ is defined as follows:*
* $\;=$
$(\bbb,{\bf X}, P) \leftarrow \adv(\SKT,\{(\pk_i,\sk_i)\}_{i=1}^{n_V})$ $({\bf X}',P') \leftarrow \Tally$ *
# Proofs: Juels et al. Admit Attacks
This appendix contains proofs demonstrating that the definition of election verifiability by Juels et al. (**JCJ10?**) admits collusion and biasing attacks (§[sec:newAttacks]). We have reported these findings to the original authors.[^30],[^31]
## Proof: Proposition [prop:stuff]
Suppose $\Pi = (\RegisterSymb,\allowbreak \VoteSymb,\allowbreak \TallySymb,\allowbreak \VerifySymb)$ is an election scheme satisfying JCJ-correctness and JCJ-verifiability. Further suppose $\mathsf{Stuff}(\Pi,\beta,\kappa) = (\RegisterSymb,\allowbreak \VoteSymb,\allowbreak \TallySymb_S,\allowbreak \VerifySymb_S)$, for some integers $\beta,\kappa\in\mathbb N$. We prove that $\mathsf{Stuff}(\Pi,\beta,\kappa)$ satisfies JCJ-correctness and JCJ-verifiability.
We show that $\mathsf{Stuff}(\Pi,\beta,\kappa)$ satisfies JCJ-correctness by contradiction. Suppose $\SuccCor[\mathsf{Stuff}(\Pi,\beta,\kappa),\adv]$ is non-negligible for some $k_1$, $k_2$, $k_3$, $n_C$, $n_V$, and $\adv$. Hence, there exists an execution of the experiment $$\ExpCor[\mathsf{Stuff}(\Pi,\beta,\kappa),\adv]$$ that satisfies $$\begin{gathered}
\VerifySymb_S(\PKR,\PKT,\bbb,n_C,{\bf X}',P') = 1 \\
\wedge \left(\{\beta_i\}_{i\in \mathcal V\setminus\mathcal V'}\not\subset \langle{\bf X}'\rangle \vee |\langle{\bf X}'\rangle| - |\langle{\bf X}\rangle| > |\mathcal V'|\right)
\end{gathered}$$ with non-negligible probability, where $\{\beta_i\}_{i\in \mathcal V\setminus\mathcal V'}$ is the set of honest votes, $({\bf X},P)$ is the tally of honest votes, $({\bf X}',P')$ is the tally of all votes, $\mathcal V'$ is a set of corrupt voter identities, and $\bbb$ is the bulletin board. Further suppose $\bbb_0$ is the bulletin board $\bbb$ before adding stuffed ballots. By definition of $\TallySymb_S$, there exist computations $$({\bf Y},Q) \leftarrow \TallySymb(\SKT,\bbb_0,n_C,\{\pk_i\}_{i=1}^{n_V},k_3)$$ and $$({\bf Y}',Q') \leftarrow \TallySymb(\SKT,\bbb,n_C,\{\pk_i\}_{i=1}^{n_V},k_3)$$ such that ${\bf X} = \Add{{\bf Y}}$, ${\bf X}' = \Add{{\bf Y}'}$, and $P' = Q'$. Since $\kappa\in\mathbb N$, we have $\langle{\bf Y}'\rangle \subseteq \langle{\bf X}'\rangle$. Moreover, $|\langle{\bf X}\rangle| = |\langle{\bf Y}\rangle| + \kappa$ and $|\langle{\bf X}'\rangle| = |\langle{\bf Y}'\rangle| +\kappa$, hence, $$|\langle{\bf Y}'\rangle| - |\langle{\bf Y}\rangle| = |\langle{\bf X}'\rangle| - |\langle{\bf X}\rangle|.$$ By definition of $\VerifySymb_S$ and since ${\bf Y}' = \Sub{{\bf X}'}$, there exists a computation $$v\leftarrow\VerifySymb_0(\PKR,\PKT,\bbb,n_C,{\bf Y}',Q')$$ such that $v = 1$. It follows that $$\begin{gathered}
\VerifySymb(\PKR,\PKT,\bbb,n_C,{\bf Y}',Q') = 1 \\
\mathrel\wedge \left(\{\beta_i\}_{i\in \mathcal V\setminus\mathcal V'}\not\subset \langle{\bf Y}'\rangle \vee |\langle{\bf Y}'\rangle| - |\langle{\bf Y}\rangle| > |\mathcal V'|\right)
\end{gathered}$$ with non-negligible probability and, furthermore, we have $\SuccCor[\Pi,\adv]$ is non-negligible, thereby deriving a contradiction.
We show that $\mathsf{Stuff}(\Pi,\beta,\kappa)$ satisfies JCJ-verifiability by contradiction. Suppose $\SuccVerif[\mathsf{Stuff}(\Pi,\beta,\kappa),\adv]$ is non-negligible for some $k_1$, $k_3$, $n_C$, $n_V$, and $\adv$. Hence, there exists an execution of the experiment $\ExpVerif[\mathsf{Stuff}(\Pi,\beta,\kappa),\adv]$ which satisfies $$\Verify = 1 \wedge {\bf X} \not= {\bf X}'$$ with non-negligible probability, where $(\bbb,{\bf X},P)$ is an election concocted by the adversary and $({\bf X}',P')$ is produced by tallying $\bbb$. By definition of $\TallySymb_S$, there exists a computation $$({\bf Y}',Q') \leftarrow \TallySymb(\SKT,\bbb,n_C,\{\pk_i\}_{i=1}^{n_V},k_3)$$ such that ${\bf X}' = \Add{{\bf Y}'}$ and $P' = Q'$. By definition of $\VerifySymb_S$, there exists a computation $$v\leftarrow\VerifySymb(\PKR,\PKT,\bbb,n_C,\Sub{{\bf X}},P)$$ such that $v = 1$. Let the adversary $\Adv$ be defined as follows: given input $K$ and $S$, the adversary $\Adv$ computes $$(\bbb,{\bf X}, P) \leftarrow \adv(K, S)$$ and outputs $(\bbb,\Sub{{\bf X}}, P)$. We have an execution of the experiment $\ExpVerif[\mathsf{Stuff}(\Pi,\beta,\kappa),\Adv]$ that concocts the election $(\bbb,\allowbreak\Sub{{\bf X}}, P)$ and tallying $\bbb$ produces $({\bf Y}',Q')$ such that $$\VerifySymb(\PKR,\PKT,\bbb,n_C,\Sub{{\bf X}},P) = 1$$ with non-negligible probability. Moreover, since ${\bf X} \not= {\bf X}'$ and ${\bf Y}' = \Sub{{\bf X}'}$, we have $\Sub{{\bf X}} \not= {\bf Y}'$ with non-negligible probability. It follows immediately that $\SuccCor[\Pi,\Adv]$ is non-negligible, thus deriving a contradiction and concluding our proof.
## Proof: Proposition [prop:backdoor]
We define key leakage before proving Proposition [prop:backdoor].
**Definition 1** (Key leakage). *An election scheme $\Pi = (\RegisterSymb,\VoteSymb,\TallySymb,\allowbreak\VerifySymb)$ *does not leak the tallier’s private key* if for all positive integers $n_C$ and $n_V$, security parameters $k_1$ and $k_3$, and PPT adversary $\adv$, we have $\SuccLeak$ is negligible, where $\ExpLeakNoParam$ is defined as follows:*
*$\;=$
$\bbb\leftarrow\adv(\sk_1,\dots,\sk_{n_V})$ $({\bf X},P) \leftarrow \Tally$ *
Suppose $\Pi = (\RegisterSymb,\allowbreak \VoteSymb,\allowbreak \TallySymb,\allowbreak \VerifySymb)$ is an election scheme satisfying JCJ-correctness and JCJ-verifiability that does not leak the tallier’s private key, and $\mathsf{Backdoor}(\Pi) = (\RegisterSymb,\allowbreak \VoteSymb,\allowbreak \TallySymb_B,\allowbreak \VerifySymb_B)$. Since $\Pi$ does not leak the tallier’s private key, the experiment $\ExpCor[\Pi,\adv]$ produces a bulletin board $\bbb$ such that $\SKT \in \bbb$ with negligible probability, for all $k_1$, $k_2$, $k_3$, $n_C$, $n_V$ and $\adv$. It follows that an execution of the experiment $\ExpCor[\mathsf{Backdoor}(\Pi),\adv]$ is an execution of the experiment $\ExpCor[\Pi,\adv]$ with non-negligible probability and, hence, $\mathsf{Backdoor}(\Pi)$ satisfies JCJ-correctness.
We show that $\mathsf{Backdoor}(\Pi)$ satisfies JCJ-verifiability by contradiction. Suppose $\SuccVerif[\mathsf{Backdoor}(\Pi),\adv]$ is non-negligible for some $k_1$, $k_3$, $n_C$, $n_V$, and $\adv$. Hence, there exists an execution of the experiment $\ExpVerif[\mathsf{Backdoor}(\Pi),\adv]$ which satisfies $$\Verify = 1 \wedge {\bf X} \not= {\bf X}'$$ with non-negligible probability, where $(\bbb,{\bf X},P)$ is an election concocted by the adversary and $({\bf X}',P')$ is produced by tallying $\bbb$. If there is one and only one ${\bf Y}$ such that $(\SKT,{\bf Y})\in\bbb$, then ${\bf X}' = {\bf Y}$ by definition of $\TallySymb$ and ${\bf X} = {\bf Y}$ by definition of $\VerifySymb$, otherwise, the execution of the experiment $\ExpCor[\mathsf{Backdoor}(\Pi),\adv]$ is an execution of the experiment $\ExpCor[\Pi,\adv]$ and, hence, $$\begin{gathered}
\SuccVerif[\mathsf{Backdoor}(\Pi),\adv] \\\mathrel= \SuccVerif[\Pi,\adv].
\end{gathered}$$ In both cases we derive a contradiction, thereby concluding our proof.
## Proof sketch: Proposition [prop:biased]
Suppose $\Pi = (\RegisterSymb,\VoteSymb,\TallySymb,\VerifySymb)$ is an election scheme satisfying JCJ-correctness and JCJ-verifiability. Further suppose $\mathsf{Bias}(\Pi, Z) = (\RegisterSymb,\VoteSymb,\allowbreak\TallySymb,\allowbreak\VerifySymb_{\subscriptReject})$, for some set of vectors $Z$. By definition of $\VerifySymb_{\subscriptReject}$, we have $$\VerifySymb_{\subscriptReject}(\PKR,\allowbreak \PKT,\allowbreak \bbb,\allowbreak n_C,{\bf X},\allowbreak P) = 1$$ implies the existence of a computation $$v\leftarrow \VerifySymb(\PKR,\allowbreak \PKT,\allowbreak \bbb,\allowbreak n_C,{\bf X},\allowbreak P)$$ such that $v=1$ with non-negligible probability, for all $\PKT$, $\bbb$, $n_C$, ${\bf X}$, and $P$. It follows that $$\begin{gathered}
\SuccCor[\mathsf{Bias}(\Pi),\adv] \\\leq \SuccCor[\Pi,\adv]
\end{gathered}$$ and $$\begin{gathered}
\SuccVerif[\mathsf{Bias}(\Pi),\adv] \\\leq \SuccVerif[\Pi,\adv]
\end{gathered}$$ for all $k_1$, $k_2$, $k_3$, $n_C$, $n_V$, and $\adv$. Hence, $\mathsf{Bias}(\Pi, Z)$ satisfies JCJ-correctness and JCJ-verifiability.
[^1]: *Doveryai, no proveryai* (trust, but verify) says the Russian proverb.
[^2]: , accessed 16 Nov 2015.
[^3]: Homomorphic combination of ciphertexts is straightforward for two-candidate elections (**Benaloh85?**; **Benaloh86?**; **SK94:Voting?**; **Benaloh96:Thesis?**; **HS00?**), since choices (e.g., “yes” or “no”) can be encoded as 1 or 0. Multi-candidate elections are also possible (**Benaloh86?**; **Hirt10:ThesisChap5?**; **Damgard10:MultCandidateElections?**).
[^4]: , released 25 Jul 2009, accessed 16 Nov 2015.
[^5]: Helios 2.0 builds upon Adida’s *Helios 1.0* (**Adida08?**). But, the two systems are rather different. In particular, the Helios 2.0 tallier homomorphically combines encrypted choices and decrypts the homomorphic combination to reveal the tally, whereas the Helios 1.0 tallier mixes encrypted choices and decrypts the ciphertexts output by the mix. Adida has not released an implementation of Helios 1.0. Tsoukalas *et al.* (**Tsoukalas13:HeliosToZeus?**) released *Zeus* as a fork of Helios 2.0 spliced with mixnet code to derive an implementation (, accessed 15 Sep 2017) and Yingtong Li released *helios-server-mixnet* as an extension of Zeus with threshold asymmetric encryption and some other minor changes (, accessed 15 Sep 2017). Smyth shows that those implementations do not satisfy universal verifiability and proves that a variant does (**2017-verifiability-Helios-mixnet?**).
[^6]: Cf. , accessed 14 Dec 2016.
[^7]: Eligibility is not satisfied either (**2013-truncation-attacks-to-violate-beliefs?**; **2014-truncation-attacks-to-violate-beliefs?**; **Smyth16:helios-eligibility?**).
[^8]: Meaningfully related ballots can be constructed because Helios ballots are malleable.
[^9]: Cf. and , accessed 9 Aug 2016.
[^10]: A set of election schemes satisfies $\EVEA$, if every scheme in the set satisfies $\EVEA$.
[^11]: Helios 2.0, Helios 3.1.4 and do not abort, so they are not similarly effected.
[^12]: We omit many of the parameters of $\TallySymb$ and $\VerifySymb$ here for simplicity; see for details.
[^13]: Let $\Add{{\bf X}} = ({\bf X}[1],\dots,{\bf X}[\beta-1],{\bf X}[\beta]+\kappa,{\bf X}[\beta+1],\dots,{\bf X}[|{\bf X}|])$. And let $|{\bf X}|$ denote the length of vector ${\bf X}$.
[^14]: $\VerifySymb_B$ also needs to check that $\SKT$ is the private key corresponding to $\PKT$. We omit formalizing this detail, but note that it is straightforward for real-world encryption schemes such as El Gamal and RSA.
[^15]: Véronique Cortier and David Galindo, personal communication, Nancy, France, 13 June 2013.
[^16]: David Galindo and Véronique Cortier, email communication, 19 June 2013 & Summer/Autumn 2014.
[^17]: Ralf Küsters & Johannes Müller, email communication, 25 April 2018.
[^18]: Ralf Küsters & Johannes Müller, email communication, 22 May 2018.
[^19]: Quaglia & Smyth (**Smyth17:voting-tutorial?**) and Smyth (**2018-secrecy-verifiability-elections-tutorial?**) provide overviews of ballot-secrecy definitions and provide comparisons between definitions, Smyth (**Smyth16:ballotSecrecy?**) and Bernhard et al. (**BCGPW15?**; **BCGPW15:eprint?**) provide more detailed surveys; Fraser et al. survey definitions of receipt-freeness (**Smyth19:receipt-freeness?**); and Smyth surveys definitions of coercion resistance (**Smyth19:receipt-freeness?**).
[^20]:
[^21]: *We shall implicitly bind ternary operators occasionally—i.e., we write *$\Gamma$ is a homomorphic asymmetric encryption scheme* as opposed to the more verbose *$\Gamma$ is a homomorphic asymmetric encryption scheme, with respect to ternary operators $\odot$, $\oplus$, and $\otimes$*.*
[^22]: *Let $x\leftarrow_R S$ denote assignment to $x$ of an element chosen uniformly at random from set $S$.*
[^23]: *The oracle in experiment $\Exp\text{-}\mathsf{Sign}$ may access parameter $\sk$. Henceforth, we continue to allow oracles to access experiment parameters without explicitly mentioning them.*
[^24]: *We extend set membership notation to vectors: we write $x\in{\bf x}$ if $x$ is an element of the set $\{ {\bf x}[i] : 1 \leq i \leq |{\bf x}| \}$.*
[^25]: *Given a binary relation $R$, we write $((s_1,\dots,s_l),(w_1,\dots,w_k))\in R\Leftrightarrow P(s_1,\dots,s_l,w_1,\dots,w_k)$ for $(s, w) \in R \Leftrightarrow P(s_1,\dots,s_l,w_1,\dots,w_k) \wedge s = (s_1,\dots,s_l) \wedge w = (w_1,\dots,w_k)$, hence, $R$ is only defined over pairs of vectors of lengths $l$ and $k$.*
[^26]: For brevity, the encryption scheme’s message space $\mathfrak m$ is assumed to be $\{1,\dots,|\mathfrak m|\}$.
[^27]: JCJ defines discarding ballots in accordance with a revoting policy (**JCJ10?**). However, we have shown that JCJ fails to satisfy universal verifiability when the policy proposed by Juels et al. is adopted (§[sec:def:uvv]). So, we consider a policy that discards ballots using the same credential—i.e., choices by voters that cast multiple ballots will be discarded.
[^28]: Juels et al. translate tallies ${\bf X}$ into a multisets $\langle {\bf X} \rangle$ representing the tally as follows: $\langle {\bf X} \rangle = \bigcup_{1\leq j \leq |{\bf X}|}
\{ \underbrace{j,\dots,j}_{{\bf X}[j]\textrm{ times}} \}$.
[^29]: *We write $\mu(k_1,k_2,k_3)$ for the smallest value in $\{\mu(k_1), \mu(k_2), \mu(k_3)\}$ (cf. (**JCJ10?**)).*
[^30]: Dario Catalano, personal communication, Paris, France, 10 October 2013.
[^31]: Markus Jakobsson, personal communication, New Orleans, USA, 27 June 2013.