# Exploiting re-voting in the Helios election system Maxime Meyer, Ben Smyth 2026-09-05 ## Abstract Election systems must ensure that representatives are chosen by voters. Moreover, each voter should have equal influence. Traditionally, this has been achieved by permitting voters to cast at most one ballot. More recently, this has been achieved by tallying the last ballot cast by each voter. We show this is not achieved by the Helios election system, because an adversary can cause a ballot other than a voter’s last to be tallied. Moreover, we show how the adversary can choose the contents of such a ballot, thus the adversary can unduly influence the selection of representatives.
# Introduction An election is a decision-making procedure to choose representatives (Lijphart and Grofman 1984; Saalfeld 1995; Gumbel 2005; Alvarez and Hall 2010). Choices are made by voters, and this must be ensured by election systems, as prescribed by the United Nations (“Universal Declaration of Human Rights” 1948, Article 21), the Organization for Security and Co‑operation in Europe (“Document of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE” 1990, para. 7.3), and the Organization of American States (“American Convention on Human Rights, ‘Pact of San Jose, Costa Rica’” 1969, Article 23). These organisations also prescribe that systems must ensure that voters have equal influence in the decision (“Universal Declaration of Human Rights” 1948; “Document of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE” 1990; “American Convention on Human Rights, ‘Pact of San Jose, Costa Rica’” 1969). This has led to the emergence of the following eligibility and non-reusability requirements (Kremer and Ryan 2005; Backes, Hriţcu, and Maffei 2008).[^1] - Eligibility. Choices are only made by voters. Eligibility ensures that non-voters cannot (directly) influence the decision. For instance, national elections typically require that voters are citizens of the nation, thus, eligibility forbids influence from foreign citizens.[^2] - Non-reusability. Only one choice of each voter has influence. Non-reusability ensures that each voter can contribute at most one choice, hence, voters have equal influence. In addition, for verifiable elections (Cohen and Fischer 1985; Kremer, Ryan, and Smyth 2010; Küsters, Truderung, and Vogt 2011; Smyth, Frink, and Clarkson 2015; Kiayias, Zacharias, and Zhang 2015), non-reusability is useful to aid recovery from failure (since voters can “*vote, verify, and revote until verification succeeds*" (Adida and Neff 2006, sec. 1)). Election systems have traditionally permitted each voter to cast at most one choice. More recent systems permit multiple choices (e.g., (Juels, Catalano, and Jakobsson 2002; Maaten 2004; Adida et al. 2009; Gjøsteen 2012; Cortier et al. 2014; Post 2010)) and a voter’s last choice should have influence. We strengthen the aforementioned non-reusability requirement to capture such influence. - Strong non-reusability. Only the last choice of each voter has influence. Strong non-reusability enables voters to change their choices, which provides flexibility, and aids education (since voters can “*ask the help of anyone for submitting a random ballot, and then re-voting privately afterwards*" (Adida et al. 2009, sec. 3.3)). By comparison, (weak) non-reusability does not enable voters to change their choices, because that notion does not specify which ballot should have influence. Hence, it is permissible for a choice, other than the voter’s last, to have influence. Consequently, voters cannot change their choices, because voters do not know which of their choices will have influence. Thus, the notions of non-reusability by Kremer & Ryan (Kremer and Ryan 2005) and Backes *et al.* (Backes, Hriţcu, and Maffei 2008) are too weak to analyse an interesting property of recent election systems; a slight strengthening of their notions is necessary. Eligibility and non-reusability are fundamental requirements of election systems (“Universal Declaration of Human Rights” 1948; “Document of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE” 1990; “American Convention on Human Rights, ‘Pact of San Jose, Costa Rica’” 1969), as-is strong non-reusability when voters are permitted to change their choices. These requirements all assume that the adversary’s capabilities are limited to controlling the communication channel and that the election system is operated in the prescribed manner, hence, they are not intended to exclude attacks that arise when the election system is subverted by the adversary (to authenticate non-voter ballots, for instance). By comparison, verifiability requirements assume the election system has been subverted and are intended to enable the detection, rather than exclusion, of attacks (Cohen and Fischer 1985; Kremer, Ryan, and Smyth 2010; Küsters, Truderung, and Vogt 2011; Smyth, Frink, and Clarkson 2015; Kiayias, Zacharias, and Zhang 2015). It follows that an election system that satisfies eligibility, non-reusability, and strong non-reusability is invulnerable to attacks against those requirements when the election system is operated in the prescribed manner, whereas a verifiable system might be vulnerable to attacks, but those attacks can be detected. Thus, eligibility, non-reusability, and strong non-reusability should be satisfied regardless of whether verifiability is, because election systems operated in the prescribed manner should prevent attacks by network adversaries, rather than just enabling attack detection. We analyse Helios (Adida et al. 2009): an open-source, web-based election system, [^3] which has been used by the International Association of Cryptologic Research (IACR), the ACM, the Catholic University of Louvain, and Princeton University (Pereira 2016). Helios uses a third party to authenticate voters’ ballots, which suffices for eligibility, assuming the third party is trusted. Authenticated ballots are listed alongside voter identities and at most one ballot is listed alongside each identity, which suffices for non-reusability. Any other ballots are archived. Auditing can be used to statistically determine whether non-voter ballots are incorrectly authenticated by an untrusted third party or whether unauthenticated ballots are listed. For instance, voters can be asked whether the ballot alongside their identity is theirs, to determine if the ballot was incorrectly authenticated or simply unauthenticated. Albeit cooperation and honesty of some voters is required for auditing, and sufficiently many malicious voters can manipulate audits. #### Contribution We show that the archiving mechanism used by Helios is insufficient to ensure strong non-reusability, in the presence of an adversary that is able to delay messages sent on the network. In particular, the adversary can cause a choice other than a voter’s last to be counted. Moreover, we show how the adversary can pick the choice, in a poll station with a malicious election supervisor. Although malice can be detected by voters that perform verifiability checks once voting closes, recovery is only possible before tallying commences. # Analysis of Helios ## Protocol description
Casting a ballot
Authenticating the ballot
Tallying
Helios protocol flow
An execution of Helios (Figure 4) proceeds as follows. First, a voter casts a ballot for their choice: the voter encrypts their choice (1) and sends their encrypted choice to the bulletin board (2). Secondly, the voter authenticates their encrypted choice to the bulletin board, to prove they are indeed a voter. The authentication process uses OAuth (Hardt 2012),[^4] which is reliant on a third party. The process proceeds as follows. The voter authenticates to a third party (3), the third party generates a token for the voter (4), the voter sends the token to the bulletin board (5), and the bulletin board relays the token to the third party (6). The third party checks whether the token is valid and notifies the bulletin board of the token’s validity (7). If the token is valid, then the bulletin board accepts the voter’s encrypted choice. Hence, the bulletin board contains the voter’s authenticated encrypted choice. In addition, the bulletin board archives any encrypted choice previously accepted for that voter,[^5] which is intended to ensure that only the last choice of each voter has influence. Finally, the bulletin board homomorphically combines the accepted encrypted choices (8), the administrator decrypts the homomorphic combination (9), and the bulletin board reveals those decrypted choices (10). Helios satisfies eligibility, because encrypted choices are only accepted by the bulletin board when accompanied by a token authenticating the voter that constructed the encrypted choice. Moreover, Helios satisfies non-reusability too, because, upon acceptance, the bulletin board archives any encrypted choice previously accepted for that voter. But, this is insufficient for strong non-reusability. ## Vulnerability The flow of our exploit initially corresponds to an honest execution: a voter casts a ballot for their choice, as per Figure 1. The remaining steps (Figure 8) proceed as follows. First, the adversary intercepts a voter’s token: the voter authenticates to a third party (1), receives an authentication token (2), and sends the token to the bulletin board (3), but it is intercepted by the adversary (4).[^6] (We indicate the ballot-token relation by colouring the top right-hand corner of the ballot and the token in purple.) Thus, the bulletin board contains an unauthenticated encrypted choice and is awaiting an authentication token for that encrypted choice. Next, the adversary waits until the voter casts another encrypted choice (5), authenticates with the third party (6), receives a token (7), and sends the token to the bulletin board (8). (We indicate the ballot-token relation using green colouring.) Thus, the bulletin board can authenticate the voter’s second ballot. Finally, the adversary releases the intercepted token and it is received by the bulletin board (9). Thus, the bulletin board will accept the voter’s first ballot, and archive the voter’s second ballot (10). Consequently, the voter’s first choice is counted, rather than their second. Hence, strong non-reusability is not satisfied, because only the last choice of the voter should have influence, which is not the case.
Token interception
Casting a second ballot
Release intercepted token
Helios exploit flow
#### Video demonstration The exploit is demonstrated in a supporting video (Smyth and Thomson 2014). Helios developers Ben Adida and Olivier Pereira acknowledge the existence of this vulnerability, but they contend it would be detected.[^7] We will discuss detection mechanisms in the following section. ## Impact Let us now consider the possibility of an adversary unduly influencing an election’s outcome, in settings where Helios is deployed in voting terminals located at poll stations. In such settings, a malicious election supervisor could offer to demonstrate the Helios system to a voter, under the guise of education. During the demonstration, the supervisor could suggest that the voter selects a particular choice. This should not cause suspicion, because Helios is intended to permit voters to change their choices (§1). Once the voter casts the demonstration ballot, it could be intercepted, perhaps by a router in the polling station that the supervisor controls. After the demonstration, the supervisor could instruct the voter to re-vote in private. Once the voter leaves the poll station, the intercepted ballot could be released. Consequently, the supervisor’s choice is tallied, rather than the voter’s, thereby demonstrating the possibility of undue influence. We acknowledge that the voter can discover that malice has taken place, because Helios satisfies individual verifiability (Smyth, Frink, and Clarkson 2015; Kremer, Ryan, and Smyth 2010) and the voter can check whether the bulletin board accepted their second encrypted choice. However, it is well-known that many voters do not perform checks necessary for verifiability and voting systems rely on checks being performed by sufficiently many diligent voters (M. Bernhard et al. 2017, sec. 2.1.6). Thus, the exploit is particularly effective against voters that do not perform checks. Moreover, even if malice is detected, recovery is only possible when a voter successfully casts another encrypted choice (before tallying), hence, the exploit can also be effective against voters that detect malice. Effectiveness can be improved by releasing the intercepted ballot just before voting closes, this not only reduces the voter’s opportunity to detect malice, but also forces the voter to convince officials that they should be able to cast another ballot after voting closes, which is problematic, because there is no convincing evidence that any malpractice has taken place. Once tallying commences, the voter cannot recover, furthermore, given the absence of any evidence, victims have little recourse. We believe that verification checks should serve as a last line of defence and that election systems should prevent many attacks, rather than merely being able to detect them (especially as detection does not imply the ability to recover). Hence, we believe eligibility and non-reusability are worthy of study independently of verifiability. ## Fixes We can patch the vulnerability by checking authentication token timestamps, timestamping ballots, coupling encrypted choices with counters, or proving knowledge of earlier encrypted choices *à la* Clarkson, Chong & Myers (Clarkson, Chong, and Myers 2008, sec. 3.3). We favour solutions using timestamps, since the other approaches require the voter to maintain state. Moreover, timestamps have been acknowledged as a possibility for a fix by Helios developer Olivier Pereira.[^8] We concede that timestamps increase the attack surface, since an adversary may tamper with clocks. But, we stress that the third party is already assumed to construct authentication tokens correctly and that voters are already assumed to construct ballots correctly (or, at least, audit ballots to increase confidence of correct construction),[^9] hence, tampering with clocks might be precluded by those assumptions. OAuth tokens may contain timestamps (J. Richer 2015, sec. 2.2) and these can be used to determine the order in which ballots were authenticated. Similarly, ballots could be extended to include timestamps which can be used to determine the order in which ballots were constructed.[^10] These timestamps can be used by the bulletin board to patch the vulnerability. Indeed, rather than archiving any encrypted choice previously accepted for a voter, the bulletin board can archive any encrypted choice associated with an earlier timestamp. The validity of tokens can only be checked by the bulletin board, because tokens must remain secret. Thus, the bulletin board might convince itself that ballots are authenticated, but it cannot convince other parties. Developing an authentication mechanism that permits anyone to check the validity of authentication tokens, rather than just the bulletin board, would be an interesting direction for future work. Alternatively, voters can be issued with credentials and cryptography can be used to ensure that only voters can construct authorised ballots (i.e., authorised ballots are unforgeable (Smyth 2018a, sec. 1)). For instance, Quaglia & Smyth (Quaglia and Smyth 2018) replace tokens with digital signatures. But, solutions reliant on cryptography seem to require expensive infrastructures for voter credentials and seemingly ignore the problem of corruption during the registration procedure (Smyth, Frink, and Clarkson 2015, sec. 4). Indeed, auditing is required to check whether any non-voters are issued credentials. Eliminating such audits is desirable, but perhaps impossible. # Related work Smyth & Pironti  (Smyth and Pironti 2013) identify a flaw in Helios’s sign-out procedure which can be exploited by TLS truncation attacks to dupe voters into believing they have successfully signed-out, when they have not. Thus, an adversary can make a choice on the voter’s behalf from the terminal used by the voter, thereby violating eligibility. Beyond eligibility and non-reusability, malleability has been exploited to launch violate ballot secrecy (Cortier and Smyth 2011, 2013; Smyth and Cortier 2011; Smyth 2012, 2018b) and verifiability (Smyth, Frink, and Clarkson 2015), and unsound proofs of knowledge have been exploited to violate verifiability (D. Bernhard, Pereira, and Warinschi 2012). # Conclusion We have shown that Helios does not satisfy strong non-reusability, because an adversary can cause a ballot other than a voter’s last to be tallied. In particular, the adversary can intercept the authorisation token associated with the ballot that the adversary wants tallied, wait until the voter has casts their last ballot, and then release the intercepted token. The released token causes the bulletin board to accept the ballot that the adversary wants tallied, and to archive the voter’s last ballot. Thus, strong non-reusability is not satisfied. We have also shown that an adversary can choose the contents of such ballots. In particular, the adversary can exploit the educational needs of voters to cast a ballot for the adversary’s choice, and cause that ballot to be tallied rather than the voter’s last, as we have explained. Consequently, adversaries can unduly influence the selection of representatives. Although victims may detect malice, there is no evidence that malpractice has taken place, hence, victims have little recourse. The vulnerability is due to the manner in which Helios interacts with OAuth. Hence, our exploit should generalise to other systems that use OAuth in a similar manner and to systems that use similar authentication mechanisms. We hope that this article leads to improvements in the Helios election system, advances understanding of authentication mechanisms, and helps system developers to integrate authentication mechanisms securely. # Acknowledgements We thank Elizabeth Quaglia, Susan Thomson and our anonymous reviewers for feedback that helped improve this paper. Smyth’s work was partly performed at INRIA, with support from the European Research Council under the European Union’s Seventh Framework Programme (FP7/2007-2013) / ERC project *CRYSP* (259639). # References # References
Adida, Ben, Olivier de Marneffe, Olivier Pereira, and Jean-Jacques Quisquater. 2009. “Electing a University President Using Open-Audit Voting: Analysis of Real-World Use of Helios.” In *EVT/WOTE’09: Electronic Voting Technology Workshop/Workshop on Trustworthy Elections*. USENIX.
Adida, Ben, and C. Andrew Neff. 2006. “Ballot Casting Assurance.” In *EVT’06: Electronic Voting Technology Workshop*. USENIX.
Alvarez, R. Michael, and Thad E. Hall. 2010. *Electronic Elections: The Perils and Promises of Digital Democracy*. Princeton University Press.
“American Convention on Human Rights, ‘Pact of San Jose, Costa Rica’.” 1969.
Backes, Michael, Cătălin Hriţcu, and Matteo Maffei. 2008. “Automated Verification of Remote Electronic Voting Protocols in the Applied Pi-calculus.” In *CSF’08: 21st Computer Security Foundations Symposium*, 195–209. IEEE.
Bernhard, David, Olivier Pereira, and Bogdan Warinschi. 2012. “How Not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios.” In *ASIACRYPT’12: 18th International Conference on the Theory and Application of Cryptology and Information Security*, 7658:626–43. LNCS. Springer.
Bernhard, Matthew, Josh Benaloh, J. Alex Halderman, Ronald L. Rivest, Peter Y. A. Ryan, Philip B. Stark, Vanessa Teague, Poorvi L. Vora, and Dan S. Wallach. 2017. “Public Evidence from Secret Ballots.” In *E-Vote-ID’17: 10th International Conference for Electronic Voting*, 84–109. LNCS. Springer.
Clarkson, Michael R., Stephen Chong, and Andrew C. Myers. 2008. “Civitas: Toward a Secure Voting System.” In *S&p’08: 29th Security and Privacy Symposium*, 354–68. IEEE.
Cohen, Josh Daniel, and Michael J. Fischer. 1985. “A Robust and Verifiable Cryptographically Secure Election Scheme.” In *FOCS’85: 26th Symposium on Foundations of Computer Science*, 372–82. IEEE.
Cortier, Véronique, David Galindo, Stéphane Glondu, and Malika Izabachène. 2014. “Election Verifiability for Helios under Weaker Trust Assumptions.” In *ESORICS’14: 19th European Symposium on Research in Computer Security*, 8713:327–44. LNCS. Springer.
Cortier, Véronique, and Ben Smyth. 2011. “Attacking and fixing Helios: An analysis of ballot secrecy.” In *CSF’11: 24th Computer Security Foundations Symposium*, 297–311. IEEE.
———. 2013. “Attacking and fixing Helios: An analysis of ballot secrecy.” *Journal of Computer Security* 21 (1): 89–148.
“Disinformation and ‘fake news’: Interim Report.” 2018.
“Document of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE.” 1990.
Gjøsteen, Kristian. 2012. “The Norwegian Internet Voting Protocol.” In *VoteID’11: 3rd International Conference on e-Voting and Identity*, 1–18. Springer.
Gumbel, Andrew. 2005. *Steal This Vote: Dirty Elections and the Rotten History of Democracy in America*. Nation Books.
Hardt, D. 2012. “The OAuth 2.0 Authorization Framework.” RFC 6749. Internet Engineering Task Force.
J. Richer, Ed. 2015. “OAuth 2.0 Token Introspection.” RFC 7662. Internet Engineering Task Force.
Juels, Ari, Dario Catalano, and Markus Jakobsson. 2002. “Coercion-Resistant Electronic Elections.” Cryptology ePrint Archive, Report 2002/165.
Kiayias, Aggelos, Thomas Zacharias, and Bingsheng Zhang. 2015. “End-to-End Verifiable Elections in the Standard Model.” In *EUROCRYPT’15: 34th International Conference on the Theory and Applications of Cryptographic Techniques*, 9057:468–98. LNCS. Springer.
Kremer, Steve, and Mark D. Ryan. 2005. “Analysis of an Electronic Voting Protocol in the Applied Pi Calculus.” In *ESOP’05: 14th European Symposium on Programming*, 3444:186–200. LNCS. Springer.
Kremer, Steve, Mark D. Ryan, and Ben Smyth. 2010. “Election verifiability in electronic voting protocols.” In *ESORICS’10: 15th European Symposium on Research in Computer Security*, 6345:389–404. LNCS. Springer.
Küsters, Ralf, Tomasz Truderung, and Andreas Vogt. 2011. “Verifiability, Privacy, and Coercion-Resistance: New Insights from a Case Study.” In *S&p’11: 32nd IEEE Symposium on Security and Privacy*, 538–53. IEEE.
Lijphart, Arend, and Bernard Grofman. 1984. *Choosing an electoral system: Issues and Alternatives*. Praeger.
Maaten, Epp. 2004. “Towards Remote e-Voting: Estonian Case.” *Electronic Voting in Europe-Technology, Law, Politics and Society* 47: 83–100.
Pereira, Olivier. 2016. “Internet Voting with Helios.” In *Real-World Electronic Voting: Design, Analysis and Deployment*. CRC.
Post, Gerald V. 2010. “Using Re-Voting to Reduce the Threat of Coercion in Elections.” *Electronic Government, an International Journal* 7 (2): 168–82.
“Putin’s Asymmetric Assault on Democracy in Russia and Europe: Implications for U.S. National Security.” 2018.
Quaglia, Elizabeth A., and Ben Smyth. 2018. “Authentication with Weaker Trust Assumptions for Voting Systems.” In *AFRICACRYPT’18: 10th International Conference on Cryptology in Africa*. Vol. 10831. LNCS. Springer.
Saalfeld, Thomas. 1995. “On Dogs and Whips: Recorded Votes.” In *Parliaments and Majority Rule in Western Europe*. St. Martin’s Press.
Smyth, Ben. 2012. “Replay Attacks That Violate Ballot Secrecy in Helios.” Technical Report 2012/185, Cryptology ePrint Archive.
———. 2018a. “A Foundation for Secret, Verifiable Elections.” Cryptology ePrint Archive, Report 2018/225.
———. 2018b. “Ballot secrecy: Security definition, sufficient conditions, and analysis of Helios.” Technical Report 2015/942, Cryptology ePrint Archive.
Smyth, Ben, and Véronique Cortier. 2011. “A note on replay attacks that violate privacy in electronic voting schemes.” RR-7643. INRIA.
Smyth, Ben, Steven Frink, and Michael R. Clarkson. 2015. “Election Verifiability: Cryptographic Definitions and an Analysis of Helios and JCJ.” Technical Report 2015/233, Cryptology ePrint Archive.
Smyth, Ben, and Alfredo Pironti. 2013. “Truncating TLS Connections to Violate Beliefs in Web Applications.” In *WOOT’13: 7th USENIX Workshop on Offensive Technologies*. USENIX Association.
Smyth, Ben, and Susan Thomson. 2014. “Helios Re-voting Attack.” YouTube video, linked from .
“Universal Declaration of Human Rights.” 1948.
[^1]: Kremer & Ryan capture both requirements in a single, informal definition, namely, “only...voters can vote, and only once" (Kremer and Ryan 2005), whereas Backes *et al.* decouple that definition into “only...voters can vote" and “every voter can vote only once" (Backes, Hriţcu, and Maffei 2008). (We refer to voters and non-voters, whereas Kremer & Ryan and Backes *et al.* distinguish non-voters from ‘legitimate voters’ and ‘eligible voters.’) [^2]: We concede that non-voters may indirectly influence the decision, e.g., voters may be swayed by disinformation (“Putin’s Asymmetric Assault on Democracy in Russia and Europe: Implications for U.S. National Security” 2018; “Disinformation and ‘fake news’: Interim Report” 2018). [^3]: , accessed 11 Aug 2017. [^4]: Other authentication methods are also supported. [^5]: See `Voter.last_cast_vote()` in , accessed 11 Aug 2017. [^6]: An adversary can intercept packets even when they are encrypted. For example, packets sent over a TLS connection, i.e., encrypted packets, can be intercepted. Intercepting a TLS packet prevents further data from being received on *that* TLS connection (until the packet is released), but data may be received on other TLS connections (of which there are many), because TLS does not guarantee ordering of messages between connections. (Multiple TLS connections are maintained to reduce latency.) Hence, TLS does not prevent further communication between the voter and the bulletin board. [^7]: Email communication, April 2014. [^8]: Email communication, April 2014. [^9]: Auditing ballots provides assurance that ballots (constructed by untrusted systems) are cast as intended, in particular, ballots encapsulate voters’ choices. This property is complimentary to individual verifiability, which allows voters to check whether their ballot is accepted by the bulletin board. [^10]: An encrypted choice comprises of El Gamal ciphertexts and non-interactive zero-knowledge proofs, and timestamps could be included in hashes used by proofs. This ensures that timestamps cannot be modified, if they are to be accepted by the bulletin board, because the board checks validity of proofs before accepting them.