1 Introduction

The world of electronic voting systems (e-voting) has evolved significantly since it was first introduced by Chaum in 1981. Sections have been renumbered sequentially to maintain order in text, please check and verify.It is a platform designed to facilitate collaborative decision-making and enables voters to cast their votes and the election committee to count ballots electronically. A typical e-voting scheme contains three phases, namely, register, vote, and tally. Several entities are involved in the system, including voters, the election committee, a certificate authority, candidates, and adversaries, as presented in Fig 1. From Fig 1, we can see that during the register phase, both voters and the election committee are registered and obtain certificates from the certificate authority. Additionally, the list of candidates is prepared, and the public parameters of the e-voting system are distributed. The voting phase involves voters casting their votes, while the tallying phase encompasses counting the ballots and announcing the election results.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. Overview of an e-voting scheme.

https://doi.org/10.1371/journal.pone.0324182.g001

Several security properties must be in place to ensure the security of an e-voting system. According to Kho et al. [1], these essential properties include confidentiality, anonymity, unforgeability, coercion-resistance, and cast-as-intended (CAI) verifiability. Various schemes with security enhancements have been proposed and put into practice [2–9]. These schemes aim to ensure that e-voting is secure and that voters can cast their votes without fear of coercion or privacy violations.

Finogina and Herranz [3] were the first to address the compatibility issue between CAI verification and coercion-resistance. CAI verifiability ensures that voters can verify whether their intended vote has been accurately recorded, even in the absence of a secure channel between voters and the election committee. According to Finogina and Herranz [3], several techniques in the literature aim to achieve CAI verifiability, such as using proofs to verify the cast ballot, tracking numbers, cast-and-audit, voting codes, QR codes, hardware tokens or voting cards with return codes. However, all these techniques often generate some form of evidence or receipt containing voting information for the voter, which directly contradicts the requirement of coercion-resistance, as it must prevent the creation of evidence that could be used to prove a voter’s choice.

In addition to CAI verifiability, the risk of coercion and vote buying is another significant concern. Coercers may attempt to influence how voters cast their ballots, or malicious voters may sell their votes to coercers, undermining the fairness and legitimacy of the electoral process. Therefore, coercion-resistance is a critical property of any e-voting system that aims to ensure the integrity and fairness of the electoral process.

The JCJ protocol proposed by Juels et al. in 2005 [5] is a well-known protocol that provides coercion-resistance. The protocol enables voters to deceive coercers by generating fake voting credentials that are indistinguishable from genuine ones. According to Finogina and Herranz [3], existing coercion-resistant e-voting approaches often lack compatibility with CAI verifiability when trusted channels between voters and the election committee are removed. CAI verifiability is another critical property of secure e-voting systems, as it ensures that voters’ intentions are accurately reflected in the final tally. The core challenge in e-voting systems lies in balancing coercion-resistance and CAI verifiability, particularly when encryption is managed by the election committee and secure channels between voters and the election committee are absent. In such a setup, while encryption performed by the election committee ensures that voters cannot access vote verification materials, thereby guaranteeing coercion-resistance, it also raises concerns about whether voters can verify that their ballot is encrypted with their intended vote. Finogina and Herranz therefore addressed this issue by proposing an e-voting protocol that achieves both coercion-resistance and CAI verifiability without relying on secure channels between voters and election authorities.

As noted by Finogina and Herranz, it is reasonable to assume that a coercer cannot maintain continuous control over a voter and would not resort to severe threats, such as threatening the voter with a firearm, as the voter would have no choice but to comply in such cases. If such severe threats were involved, the issue would extend beyond the voting process and fall under the jurisdiction of law enforcement [3]. Therefore, coercion-resistance is meaningful only when the coercer has limited observational capabilities, allowing the voter to resist without incurring significant risks [3].

Consider a common scenario where a voter arrives at the polling station to cast their vote [3]. Could a coercer physically prevent the voter from gaining entry to the polling station? Could they compel the voter to produce a photocopy of their completed ballot as proof of their vote? In the context of e-voting, these concerns translate into questions such as: “Are forced abstention attacks permissible?" and “Can coercers extract vote-verification materials during the voting process?" These questions are critical when evaluating the integrity and security of an e-voting system under potential coercion.

To complicate matters further, some voters with malicious intent may deliberately choose to sell their votes, turning the process into a transaction. Additionally, e-voting introduces a separation between the stages of registration, vote casting, and vote verification, each of which can occur at different times. This separation brings forth a new and significant question: “At precisely which stage can the coercer observe or exert influence over the voter?"

In this work, we adopt the coercion-resistant protocol developed by Finogina and Herranz. In the coercion-resistance setting proposed by Finogina and Herranz, the coercer can communicate with the voter prior to the vote protocol execution and compel the voter to select a particular selection v^*. During the voting protocol execution, the secure channel between the voter and the election committee is not accessible to the coercer, which is crucial for maintaining meaningful coercion-resistance. However, the coercer can observe the public channel through which the ballot is posted to the bulletin board. After the voting protocol has been executed, the coercer expects to receive Trc, which includes the voter’s preference, the corresponding ballot, and the randomness used during the voting process.

To counteract coercion in this scenario, the key idea indicates that the voter should always retain the capability to trick the coercer [3]. The voter can execute the voting protocol with their chosen vote v and subsequently replicate all necessary parameters, such as challenges, to convince the coercer that the cast ballot corresponds to v^* [3]. The coercer can determine whether the voter adhered to their instructions and cast their vote for v^* [3].

Finogina and Herranz [3] addressed the compatibility issue between CAI verifiability and coercion-resistance in the literature. However, their work does not provide rigorous proofs for other essential security properties required by an e-voting system, namely, confidentiality, anonymity, unforgeability, as well as the prevention of double voting [1]. To the best of our knowledge, no existing concrete e-voting scheme simultaneously satisfies confidentiality, anonymity, and unforgeability while also being compatible with CAI verifiability and coercion-resistance.

To address these shortcomings, we propose an e-voting scheme that builds upon the coercion-resistance protocol compatible with CAI verifiability, as introduced by Finogina and Herranz [3]. Our approach enhances their system to ensure it meets the necessary security properties: coercion-resistance, CAI verifiability, confidentiality, anonymity, unforgeability, and prevention of double voting. We further demonstrate that anonymity inherently implies CAI verifiability in e-voting schemes, a result that may be of independent interest. By integrating additional security measures and refining the protocol, our scheme aims to provide a robust solution for secure and verifiable e-voting.

2 Related works

In this section, we review coercion-resistant e-voting schemes from the year 2019 till present.

Smyth [10] presented Athena, a verifiable, coercion-resistant e-voting with linear complexity in JCJ setting. Their scheme revealed anonymised credentials to eliminate ballots cast using identical private credential with linear complexity and utilised plaintext equality tests on every mixed ballot individually, containing a mixed public credential and to exclude any unauthorised mixed ballots also with linear complexity. Aranha et al. [11] argued that the coercion-resistant protocol proposed by Smyth offered lower security compared to the JCJ scheme, as it revealed the number of votes associated with each credential.

Grontas et al. [12] presented the first e-voting scheme that achieved end-to-end verifiability and everlasting privacy in JCJ setting [5]. They proposed a new cryptographic primitive, namely, publicly auditable conditional blind signature where after the interaction, the voter will be issued a token by the signing server, the token can only be verified by the designated verifier. The everlasting privacy intends to protect votes from more powerful adversary (e.g. quantum computing). Their everlasting privacy property is achieved by assuming the existence of an anonymous channel to exchange private data between the election authorities. However, the work did not present a rigorous security analysis.

Estaji et al. [13] revisited the JCJ e-voting scheme [5] to enhance its usability and practicality. In particular, they addressed the issue where voters could not directly validate whether their cast ballots were valid and included in the final tally by introducing new methods for duplicate removal within the JCJ framework.

Lueks et al. [8] proposed VOTEAGAIN, an e-voting scheme that uses a revoting mechanism to provide coercion-resistance and can handle systems with millions of voters. However, Haines et al. [4] argued that VOTEAGAIN is insecure because it relies on a single, completely trusted voting authority to achieve verifiability and coercion-resistance. Furthermore, a malicious bulletin board could compromise the privacy, verifiability, and coercion-resistance of their scheme. Haines et al. [4] introduced a variant of VOTEAGAIN that reduces reliance on voting authorities without compromising the efficiency and usability of the original scheme. Their future work involves formally proving that their modifications to VOTEAGAIN maintain the scheme’s security properties.

Rønne et al. [14] introduced a quantum-safe, coercion-resistant e-voting scheme within the JCJ framework. They addressed the complexity challenges in the tally phase of the JCJ protocol by employing fully homomorphic encryption (FHE), allowing the tallying process to be executed in linear time while also ensuring quantum safety. It is worth noting that we do not compare the computational cost of this scheme, as it utilises different cryptographic tools. Aranha et al. [11] claimed the coercion-resistant protocol introduced by Rønne et al. offered lower security compared to the JCJ scheme, as it revealed the number of votes associated with each credential.

Cortier et al. [2] identified a major issue with the JCJ protocol: it leaks the total count of received ballots, valid ballots, and revotes during the revoting phase. Hence, they proposed CHide, a new coercion-resistance protocol that solves the leakage issues in JCJ protocol. However, Aranha et al. [11] argued that CHide requires a larger asymptotic complexity of . They reduced the CHide’s asymptotic complexity to logn) to speed up the tallying protocol. However, their improved scheme did not consider voter authentication.

Finogina and Herranz [3] proposed the first CAI verifiability and coercion-resistance setting without requiring a secure channel between election authorities and voters. However, their proposed scheme did not claim some important security properties such as confidentiality of ballot, voter’s anonymity, ballot unforgeability and double-voting prevention [1]. The scheme proposed by Finogina and Herranz focuses solely on the voting algorithm and omits the tallying process, as the tally can be conducted using various verifiable methods suggested in the literature, such as verifiable shuffling of ciphertexts, verifiable decryption, and verifiable homomorphic tallying of the final results.

Spadafora et al. [15] presented a decentralised e-voting protocol designed to resist coercion and vote-selling while ensuring complete transparency, although it does not achieve receipt-freeness. The protocol leverages blockchain technology to ensure decentralisation and benefits from blockchain’s transparency and non-repudiation properties. The security of the protocol is rigorously proven under the Decisional Diffie-Hellman (DDH) assumption for prime-order cyclic groups and standard blockchain robustness assumptions.

Giustolisi and Garjan [16] introduced an Internet voting scheme that balances efficiency with coercion-resistance. The scheme employs noise ballots to obscure legitimate votes and a cleansing process to eliminate invalid ballots without revealing sensitive information. The scheme supports coercion-resistance, including scenarios with revoting, and enables linear tallying without the use of mixnets or MPC, utilising exponential ElGamal encryption and non-interactive zero-knowledge proofs (NIZKPs).

Chen et al. [17] proposed an e-voting scheme aimed to prevent bribery and coercion. By utilising the advantages of a subliminal channel, the channel transmitted a secret message that was modified from the original, ensuring that the receiver only received the general signature without access to the hidden message. Consequently, the e-voting scheme remains secure even if the voting secret is leaked, as the briber or coercer cannot determine the voter’s actual vote. However, the briber or coercer could still attack the channel by preventing the voter’s vote from being sent. To mitigate this risk, Chen et al. employed a smart card, which served as a protective mechanism to prevent the subliminal channel from being compromised.

Several recent studies have explored advancements in secure e-voting protocols by leveraging emerging technologies and optimised cryptographic techniques. For instance, Elhabob et al. [18,19] proposed equality tests in public key encryption and identity-based encryption with cryptographic reverse firewalls, which could potentially be adapted for detecting duplicate ballots in e-voting while preserving voter privacy. Hadabi et al. [20] introduced a proxy re-encryption scheme with plaintext checkable encryption (PCE) for secure data sharing in Industrial IoT. PCE could enhance coercion-resistant e-voting by ensuring ballots are verifiable while safeguarding voter secrecy. Wang et al. [21] presented a secure cross-system encrypted data-sharing scheme based on attribute-based encryption (ABE), which could be utilised in e-voting to manage voter authentication and control access to encrypted ballots. Furthermore, Xiong et al. [22] proposed a scheme that could contribute to revocable authentication in e-voting, ensuring that voters cannot be linked to their past votes. However, further in-depth research is required to assess the feasibility of fully integrating these techniques into e-voting systems.

3 Cryptographic preliminaries

In this section, we describe the underlying cryptographic tools employed in constructing our e-voting scheme, namely, sigma protocol, commitment scheme, multi-signature, public key encryption (PKE) scheme and event-oriented linkable and traceable anonymous authentication scheme (EOLTAA).

3.3 Multi-signature

A multi-signature has four algorithms [27]:

• MS.Setup . This algorithms takes as the input and produces parameters params of the signature scheme.
• MS.KeyGen . This algorithms takes params as input and produces a set of public and secret keys of signer i.
• MS.Sign . This is an interactive algorithm runs between signers to sign m. After a few interactions, the algorithm produces the multi-signature .
• MS.Verify . This algorithm takes multi public key sets of signer i, m and as input and produces 1 if the is valid or 0 if the is invalid.

Definition 3. A multi-signature is required to satisfy existential unforgeability under adaptively chosen message attacks (EUF-CMA). The EUF-CMA game is defined as follows [28]:

• Register phase: The Challenger generates a target key pair (pk^*,sk^*) of the honest user and passes pk^* to .
• Training phase: can query MS.Sign Oracle by preparing m and of purported signers where pk^* must happen at least once. can choose the public keys in any manner it desires, including as a function of pk^* and prior protocol interactions. is able to concurrently initiate the MS.Sign oracle and interact with multiple “clones" of the honest signer. Each clone operates independently, maintaining its own state and randomness, but all share the same keys pk^*,sk^*, and follow the signing protocol to generate responses to the messages they receive. Once the honest signer completes its process, the final output is returned to that whether be a valid multi-signature or .
• Forging phase: outputs and and wins the game if the verification of and .

We say that the multi-signature scheme is EUF-CMA secure if for all PPT with negligible advantage:

4 Definition and security requirements for generic e-voting schemes

5 Anonymity implies CAI verifiability

We notice that the security game of anonymity and CAI verifiability have high similarities, this motivates us to demonstrate the relationships between the security game of anonymity and CAI verifiability. The one-way equivalency demonstrates if the e-voting scheme possesses anonymity (IND-CVA), then it also possesses CAI verifiability (IND-CAI). The following theorem presents the one-way equivalency between the security game of anonymity and CAI verifiability.

Theorem 1. If an e-voting scheme possesses anonymity (IND-CVA), then it also possesses CAI verifiability (IND-CAI).

Proof: Assume A₂ is an Adversary who -compromises the IND-CAI security of the e-voting scheme and A₁ is the Adversary who -compromises the IND-CVA security of e-voting scheme. We aim to demonstrate that e-voting scheme is not -secure by showing how A₁ can utilise A₂ to -compromise the IND-CVA security of the e-voting scheme. Here, represents the number of vote queries, q_a represents the number of authentication queries, represents the non-negligible advantage in breaking the IND-CVA in e-voting, represents the non-negligible advantage in breaking IND-CAI in the e-voting, and t represents the attack completion time. In this scenario, A₁ can run A₂ as a subroutine while simulating its attack environment.

The CVA Challenger gives Params to A₁. A₁ gives Params to A₂ and completes the Registration phase. During the Training phase, A₂ sends a vote query to A₁. A₁ submits v to Vote oracle via a vote query to generate and returns to A₂. A₂ submits a tally query Bal to A₁. A₁ submits Bal to Tally oracle to check its validity. The Tally oracle provides the tally result to A₁ and A₁ retrieves the validation result from the tally result. A₁ then sends the validation result whether it is invalid or valid to A₂.

Eventually, A₂ concludes the Training phase and initiates the Identification phase. During this phase, A₂ issues v^* to A₁. A₁ assigns v^* to Vote oracle to generate C_b and C_1−b where and one of them is created with v^*. A₁ generates on C_b and on C_1−b. A₁ sets and . A₁ randomly guesses and delivers as the IND-CAI challenge to A₂. A₂ outputs its guess and A₁ uses A₂’s answer as its guess.

Now, we analyse the probability of A₁ winning the IND-CVA game. If the correct guess is b, we have:

(1)

When , we have ; this implies:

(2)

On the other hand, if the correct guess is 1–b, we have:

(3)

which gives:

(4)

Combining (2) and (4), we obtain:

(5)

Given that A₁ accurately simulates the environment, we conclude that and , as required. In this setup, A₁ runs in time t, while A₂ runs in time .

6 Our proposed scheme

6.2 Security analysis

We present a security analysis to demonstrate that the proposed e-voting scheme satisfies the relevant security requirements outlined in Theorems 2 to 6, specifically confidentiality, anonymity, unforgeability, coercion-resistance, and CAI verifiability, as follows:

Confidentiality: If the underlying PKE scheme satisfies IND-CCA, then our proposed e-voting scheme ensures confidentiality. Anonymity: If the underlying anonymous authentication scheme (EOLTAA) is anonymous, then our proposed e-voting scheme guarantees anonymity. Unforgeability: If the underlying authentication scheme (EOLTAA) is unforgeable, then our proposed e-voting scheme upholds unforgeability. Coercion-resistance: If the underlying PKE scheme satisfies IND-CCA, the commitment scheme satisfies the binding property, and the sigma protocol satisfies the special honest-verifier zero-knowledge property, then our proposed e-voting scheme ensures coercion-resistance. CAI Verifiability: If our proposed e-voting scheme ensures anonymity, as demonstrated in Theorem 2, it also guarantees CAI verifiability, as demonstrated in Theorem 1.

Note that our scheme does not require a direct proof (i.e., a detailed proof) because its security follows from our previous work on the transformation framework from e-voting to e-cheque [30]. The key benefit of the proposed transformation framework is that it significantly reduces the complexity of proving security. Specifically, by leveraging the security relationships among e-voting, e-auction, e-cheque, and e-cash in terms of security definitions and requirements, we can derive new schemes from existing ones without starting from scratch, with the assurance that the transformed scheme inherits the security guarantees of the underlying scheme or building block.

6.2.1 Confidentiality.

Theorem 2. Let APKE = {Setup, Identification, Validation} represent the secure EOLTAA scheme and PKE scheme. Let e-voting = {Register, Vote, Tally} represent the e-voting scheme. If the underlying APKE scheme is -indistinguishability under chosen-ciphertext attacks (IND-CCA), then the e-voting scheme is -IND-CBAA, where

(6)

Here, represents the number of vote queries, q_a represents the number of authentication queries, represents the non-negligible advantage in breaking IND-CCA in APKE, represents the non-negligible advantage in breaking IND-CBAA in e-voting, n represents a negligible function parameterised by , and t represents the attack completion time.

Proof: Assume A₂ is an Adversary who -compromises the IND-CBAA security of the e-voting scheme, and is the Adversary who -compromises the IND-CCA security of the APKE scheme. We aim to demonstrate that APKE scheme is not -secure by showing how A₁ can utilise A₂ to -compromise the IND-CCA security of APKE. In this scenario, A₁ runs A₂ as a subroutine while simulating its attack environment.

The APKE Challenger gives (Params,upk,usk,Cert) to A₁. These keys and certificate (upk,usk,Cert) are generated from the EOLTAA scheme. We allow A₁ to possess the (upk,usk,Cert) of the EOLTAA scheme, enabling it to simulate the Vote and Tally oracles for A₂. Although A₁ has access to (upk,usk,Cert) from the EOLTAA scheme, this does not provide an advantage in breaking the IND-CCA security. After this, A₁ gives Params to A₂ and completes the Registration phase.

During the Training phase, A₂ sends a vote query to A₁ which represents the Vote oracle from A₂’s perspective. Here, A₁ takes , encrypts m to generate to obtains C, and creates for C. A₁ then returns the result to A₂. After that, A₂ submits a tally query as Bal to A₁. At this point, A₁ assigns and uses the Decrypt oracle to simulate the tallying process for A₂. Specifically, A₁ passes to the Decrypt oracle to check its validity. The oracle provides the decryption result and A₁ retrieves the validation result from the decryption result and returns the validation result whether it is invalid or valid to A₂.

Eventually, A₂ concludes the Training phase and initiates the Identification phase. During this phase, A₂ selects and and gives them to A₁. A₁ assigns and randomly chooses a bit . A₁ generates and obtains C_b from m_b and creates for C_b. A₁ then assigns . A₁ delivers Bal_b as the challenge in IND-CBAA to A₂. With a probability , A₂ guesses the correct value of . A₁ takes A₂’s guess as its own guess. Since , A₁ successfully compromises the IND-CCA security.

Given that A₁ accurately simulates the environment, we conclude that and , as required. In this setup, A₁ runs in time t, while A₂ runs in time .

6.2.2 Anonymity.

Theorem 3. Let APKE = {Setup, Identification, Validation} represent the secure EOLTAA scheme and PKE scheme. Let e-voting = {Register, Vote, Tally} represent the e-voting scheme. If the underlying APKE is -anonymous, then the e-voting scheme is -IND-CVA, where

(7)

Here, represents the number of vote queries, q_a represents the number of authentication queries, represents the non-negligible advantage in breaking the anonymity in APKE, represents the non-negligible advantage in breaking IND-CVA in e-voting, n represents a negligible function parameterised by , and t represents the attack completion time.

Proof: Assume A₂ is an Adversary who -compromises the IND-CVA security of the e-voting scheme, and is the Adversary who -compromises the anonymity security of the APKE scheme. We aim to demonstrate that APKE scheme is not -secure by showing how A₁ can utilise A₂ to -compromise the anonymity security of APKE scheme. In this scenario, A₁ runs A₂ as a subroutine while simulating its attack environment.

The APKE Challenger gives to A₁. These keys are generated from the PKE scheme. We allow A₁ to possess the of the PKE scheme, enabling it to simulate the Vote and Tally oracles for A₂. Although A₁ has access to from the PKE scheme, this does not provide an advantage in breaking the anonymity security. After this, A₁ gives Params to A₂ and completes the Registration phase.

During the Training phase, A₂ sends a vote query to A₁ which represents the Vote oracle from A₂’s perspective. Here, A₁ takes , encrypts m to generate to obtains C, and creates for C. A₁ then returns the result to A₂. After that, A₂ submits a tally query as Bal to A₁. At this point, A₁ assigns and uses the Decrypt oracle to simulate the tallying process for A₂. Specifically, A₁ passes to the Decrypt oracle to check its validity. The oracle provides the decryption result and A₁ retrieves the validation result from the decryption result and returns the validation result whether it is invalid or valid to A₂.

Eventually, A₂ concludes the Training phase and initiates the Identification phase. During this phase, A₂ issues v^* to A₁. A₁ assigns and obtains C_b by encrypting m^* where . A₁ creates for C_b. A₁ then assigns . A₁ delivers Bal_b as the challenge in IND-CVA to A₂. With a probability ε ′ ≤ 1 2 + n ( k ), A₂ correctly guesses b ′. A₁ takes A₂’s guess as its own guess. Since b′ = b, A₁ successfully compromises the anonymity security.

Given that A₁ accurately simulates the environment, we conclude that ε = ε ′ and t ′, as required. In this setup, A₁ runs in time t, while A₂ runs in time t ′.

6.2.3 Unforgeability.

Theorem 4. Let APKE = {Setup, Identification, Validation} represent the secure EOLTAA scheme and PKE scheme. Let e-voting = {Register, Vote, Tally} represent the e-voting scheme. If the underlying APKE is -unforgeable, then the e-voting scheme is -EUF-CVA, where

(8)

Here, represents the number of vote queries, q_a represents the number of authentication queries, represents the non-negligible advantage in breaking the anonymity in APKE, represents the non-negligible advantage in breaking EUF-CVA in e-voting, n represents a negligible function parameterised by , and t represents the attack completion time.

Proof: Assume A₂ is an Adversary who -compromises the EUF-CVA security of the e-voting scheme, and is the Adversary who -compromises the unforgeability security of the APKE scheme. We aim to demonstrate that APKE scheme is not -secure by showing how A₁ can utilise A₂ to -compromise the unforgeability security of APKE scheme. In this scenario, A₁ runs A₂ as a subroutine while simulating its attack environment.

The APKE Challenger gives to A₁. These keys are generated from the PKE scheme. We allow A₁ to possess the of the PKE scheme, enabling it to simulate the Vote and Tally oracles for A₂. Although A₁ has access to from the PKE scheme, this does not provide an advantage in breaking the unforgeability security. After this, A₁ gives Params to A₂ and completes the Registration phase.

During the Training phase, A₂ sends a vote query to A₁ which represents the Vote oracle from A₂’s perspective. Here, A₁ takes , encrypts m to generate to obtains C, and creates for C. A₁ then returns the result to A₂. After that, A₂ submits a tally query as Bal to A₁. At this point, A₁ assigns and uses the Decrypt oracle to simulate the tallying process for A₂. Specifically, A₁ passes to the Decrypt oracle to check its validity. The oracle provides the decryption result and A₁ retrieves the validation result from the decryption result and returns the validation result whether it is invalid or valid to A₂.

Eventually, A₂ concludes the Training phase and initiates the Forging phase. During this phase, A₂ forges Bal^* and issues Bal^* as its answer to A₁, A₁ assigns and takes A₂’s guess as its own guess. With a probability ε ′ ≤ n ( k ), A₂ correctly forges Bal^*. Since Bal^* is valid, then is valid, A₁ successfully compromises the unforgeability security.

Given that A₁ accurately simulates the environment, we conclude that and , as required. In this setup, A₁ runs in time t, while A₂ runs in time .

6.2.4 Coercion-resistance.

Theorem 5. Let PKE = {PKE.KeyGen, PKE.Encrypt, PKE.Decrypt}, Commitment = {Setup, Commit, Open} and  - protocol = {Commit, Challenge, Response} represent the secure public key encryption scheme, secure commitment scheme and secure -protocol respectively. Let e-voting = {Register, Vote, Tally} represent the e-voting scheme. If the underlying PKE scheme is IND-CCA, Commitment satisfies binding property and -protocol satisfies special honest-verifier zero-knowledge property, then the e-voting scheme satisfies coercion-resistance.

Proof: Lemmas 1, 2 and 3 prove Theorem 5.

Lemma 1. Let PKE = {PKE.KeyGen, PKE.Encrypt, PKE.Decrypt} represent the secure public key encryption scheme. Let e-voting = {Register, Vote, Tally} represent the e-voting scheme. If the underlying PKE scheme is -IND-CCA, then the e-voting scheme is -coercion-resistance, where

(9)

Here, represents the number of vote queries, q_e represents the number of encrypt queries, represents the non-negligible advantage in breaking IND-CCA in PKE, represents the non-negligible advantage in breaking coercion-resistance in e-voting, n represents a negligible function parameterised by , and t represents the attack completion time.

Proof: Theorem 2 proved that if there exists a secure PKE scheme that is IND-CCA, then there exists a secure e-voting scheme that is IND-CBAA. From Theorem 5, if the underlying PKE scheme is IND-CCA, then the e-voting scheme satisfies coercion-resistance. This completes the proof.

Lemma 2. Let Commitment = {Setup, Commit, Open} represent the secure commitment scheme with binding property. If the underlying Commitment is -binding, then the e-voting scheme is -coercion-resistance, where

(10)

Here, represents the number of vote queries, q_com represents the number of commitment queries, represents the non-negligible advantage in breaking binding property in Commitment, represents the non-negligible advantage in breaking coercion-resistance in e-voting, n represents a negligible function parameterised by , and t represents the attack completion time.

Proof: Assume A₂ is an Adversary who -compromises the coercion-resistance security of the e-voting scheme, and is the Adversary who -compromises the binding property of the Commitment scheme. We aim to demonstrate that Commitment scheme is not -secure by showing how A₁ can utilise A₂ to -compromise the binding property of Commitment scheme. In this scenario, A₁ runs A₂ as a subroutine while simulating its attack environment.

The Commitment Challenger gives to A₁. These keys are generated from the PKE scheme. We allow A₁ to possess the of the PKE scheme, enabling it to simulate the Vote and Tally oracles for A₂. Although A₁ has access to from the PKE scheme, this does not provide an advantage in breaking the coercion-resistance security. After this, A₁ gives Params to A₂ and completes the Registration phase.

During the Training phase, A₂ sends a vote query to A₁ which represents the Vote oracle from A₂’s perspective. Here, A₁ takes , computes a commitment cmt and corresponding opening value on m, encrypts m to generate to obtains C, and creates for C. A₁ then returns the result to A₂. After that, A₂ submits a tally query as Bal to A₁. At this point, A₁ assigns and uses the Decrypt oracle to simulate the tallying process for A₂. Specifically, A₁ passes to the Decrypt oracle to check its validity. The oracle provides the decryption result and A₁ retrieves the validation result from the decryption result and returns the validation result whether it is invalid or valid to A₂.

Eventually, A₂ concludes the Training phase and initiates the Identification phase. During this phase, A₂ issues to A₁. A₁ assigns , where and only one of them contained v^*. A₁ computes cmt and corresponding opening values rand_b for the same cmt. A₁ obtains C_b by encrypting m^* and generates for C_b. A₁ returns and as the challenge to A₂. With a probability , A₂ can identify that and verification of b , b ′ return true. A₁ takes A₂’s guess as its own guess. Since and b , b ′return true, A₁ successfully compromises the coercion-resistance security.

Given that A₁ accurately simulates the environment, we conclude that and , as required. In this setup, A₁ runs in time t, while A₂ runs in time .

Lemma 3. Let -protocol = {Commit, Challenge, Response} represent the secure -protocol with special honest-verifier zero-knowledge property. If the underlying -protocol is -special honest-verifier zero-knowledge, then the e-voting scheme is -coercion-resistance, where

(11)

Here, represents the number of vote queries, represents the number of challenge queries, represents the non-negligible advantage in breaking the special honest-verifier zero-knowledge in -protocol, represents the non-negligible advantage in breaking coercion-resistance in e-voting, n represents a negligible function parameterised by , and t represents the attack completion time.

Proof: Assume A₂ is an Adversary who -compromises the coercion-resistance security of the e-voting scheme, and is the Adversary who -compromises the special honest-verifier zero-knowledge of the -protocol. We aim to demonstrate that -protocol is not -secure by showing how A₁ can utilise A₂ to -compromise the special honest-verifier zero-knowledge of -protocol. In this scenario, A₁ runs A₂ as a subroutine while simulating its attack environment.

The -protocol Challenger gives to A₁. These keys are generated from the PKE scheme. We allow A₁ to possess the of the PKE scheme, enabling it to simulate the Vote and Tally oracles for A₂. Although A₁ has access to from the PKE scheme, this does not provide an advantage in breaking the coercion-resistance security. After this, A₁ gives Params to A₂ and completes the Registration phase.

During the Training phase, A₂ sends a vote query to A₁ which represents the Vote oracle from A₂’s perspective. Here, A₁ takes , encrypts m to generate to obtains C, and creates for C, and runs -protocol to obtain transcript (a,e,z) on public input . A₁ then returns the result to A₂. After that, A₂ submits a tally query as Bal to A₁. At this point, A₁ assigns and uses the Decrypt oracle to simulate the tallying process for A₂. Specifically, A₁ passes to the Decrypt oracle to check its validity. The oracle provides the decryption result and A₁ retrieves the validation result from the decryption result and returns the validation result whether it is invalid or valid to A₂.

Eventually, A₂ concludes the Training phase and initiates the Identification phase. During this phase, A₂ issues to A₁. A₁ computes C^*, generates on C^*, and runs -protocol to receive transcript (a^*,e^*,z^*) on . A₁ returns and (a^*,e^*,z^*) as the real view to A₂. Based on the special honest-verifier zero-knowledge of -protocol, if a simulator exists that takes x and random challenge e, it can produce a simulation view (a valid transcript ) that is indistinguishable to (equal as probability distributions) the real view (a^*,e^*,z^*) with a probability , A₂ can simulate same view as A₁’s view, A₁ uses A₂’s answer as its guess. Since the simulation view is indistinguishable from real view (a^*,e^*,z^*), A₁ successfully compromises the coercion-resistance security.

Given that A₁ accurately simulates the environment, we conclude that and , as required. In this setup, A₁ runs in time t, while A₂ runs in time .

6.2.5 Cast-As-Intended (CAI) verifiability.

Theorem 6. The coercion-resistant e-voting scheme proposed above has CAI verifiability.

Proof: From Theorem 1, it is proven that IND-CVA implies IND-CAI, and the proposed scheme is secure against IND-CVA as proven in Theorem 3. So, the proposed scheme is IND-CAI secure.

7 Result

Table 1 shows the comparison analysis of our scheme with the existing coercion-resistant e-voting schemes while Table 2 shows the comparison on the computation cost of our scheme compared to the existing coercion-resistant e-voting schemes.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Comparison analysis of the existing coercion-resistance e-voting schemes.

https://doi.org/10.1371/journal.pone.0324182.t001

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Comparison on the computation cost of existing coercion-resistant e-voting schemes.

https://doi.org/10.1371/journal.pone.0324182.t002

We observed that our scheme provided the most comprehensive security requirements, incorporating CAI verifiability within a coercion-resistance setting, as shown in Table 1. Most of the coercion-resistance schemes proposed in the literature conflict with CAI verifiability, as discussed in the Introduction. Another distinctive feature of our scheme is that, despite offering the richest security requirements, the computational cost for the Vote and Tally algorithms remains linear (). Furthermore, our scheme ensured robust in-protocol coercion-resistance, which is achieved through prevention rather than detection. Prevention is more effective as it proactively addresses coercion, eliminating the problem before it occurs, and safeguarding voters’ freedom and autonomy from the start. In contrast, detection only addresses coercion after it has already taken place. Prevention mechanisms can be integrated directly into the system design, ensuring that the voting process is secure from the outset. Detection mechanisms, however, typically rely on monitoring or auditing, which may not always be effective and are prone to loopholes or false negatives. Additionally, prevention is often more efficient in the long term, as it avoids the need for complex detection and auditing processes. Detection systems may require extensive surveillance, legal processes, and additional resources to identify and act on instances of coercion.

In addition, we observed that the proposed scheme by Chen et al. [17] has the same computational cost for the Vote and Tally algorithms as our proposed scheme from Table 2. The main difference between our scheme and Chen et al.’s [17] is that we incorporate CAI verifiability in our Vote algorithm, whereas their scheme does not satisfy CAI verifiability in the coercion-resistant setting. Additionally, our scheme offers a more robust in-protocol coercion-resistance. We primarily highlight the significant differences between our scheme and Chen et al.’s [17] in terms of the voter’s role, the approaches to achieving coercion-resistance and technical mechanisms employed, and the overall security models and assumptions as follows:

The Voter’s Role in Coercion-Resistance:

• In Chen et al.’s [17] coercion-resistant protocol, the voter actively participates by embedding subliminal information (PIN and subliminal messages) to resist coercion. However, this approach requires the voter to take action after being coerced, and the coercion is detected after the voting phase.
• In our proposed scheme, the voter’s interaction is fully secure during the voting process itself. The cryptographic protocol ensures that even if the voter is coerced, they cannot reveal their vote to the coercer, thus preventing coercion from occurring in the first place.

Mechanism and Coercion Discovery (Detection vs. Prevention):

• Chen et al. [17] focuses on detecting coercion after the voting process. The AAC analyses the subliminal message during the dispute phase to uncover the true intent of the voter. Coercion is not directly prevented during the voting phase, but if coercion is suspected, it can be revealed after the ACC analyses the subliminal messages.
• Our scheme focuses on preventing coercion during the voting process. We build coercion-resistant directly into the voting protocol through cryptographic commitments, multi-signature verification, and zero-knowledge proofs, the voter’s interaction with the election committee is secure, and the voter cannot be forced to reveal a verifiable vote, making coercion much harder to execute.

Security Models and Assumptions:

• Chen et al. [17] assumes the presence of a trusted AAC that will act during a post-election phase to resolve disputes using subliminal messages. It also relies on subliminal communication channels for the voter to transmit additional covert information about their true vote.
• Our proposed scheme is based on the hardness of the cryptographic assumptions. The voter’s choices are hidden through commitments and zero-knowledge proofs, making it impossible for an adversary (coercer) to extract or force the voter’s true choice during or after the protocol.

8 Conclusion

We presented a provably secure coercion-resistant e-voting scheme and proved that our proposed e-voting scheme possesses the security properties of confidentiality, anonymity, unforgeability, and CAI verifiability with asymptotic complexity of O(n). We also proved that anonymity implies CAI verifiability for e-voting schemes. By enhancing the security and privacy guarantees of the existing e-voting scheme, we believe that we address the shortcomings of the current system and our comprehensive security models can be a useful reference for the design of future e-voting schemes.

The limitation of this work is that it focuses solely on the interactive communication between the election committee and the voter during the execution of the voting protocol, ensuring that the encryption of the voter’s choice accurately reflects their intent. The development of a non-interactive voting protocol that also achieves coercion-resistance remains an open challenge and is left as a direction for future research. Besides that, our proposed coercion-resistant e-voting scheme could be extended to satisfy post-quantum security requirements. Current public key encryption schemes are vulnerable to adversaries equipped with quantum computing capabilities. Lattice-based cryptography appears to be the most promising approach to address this challenge. For instance, a suitable public key encryption scheme could be constructed using the Ring Learning With Errors (RLWE) problem. The sigma protocol could be replaced with a lattice-based zero-knowledge interactive system, while a lattice-based commitment scheme offers a strong candidate for a quantum-safe commitment mechanism. However, these suggestions serve only as a foundational concept for a post-quantum coercion-resistant e-voting scheme. A more in-depth investigation would be required to fully explore and realise this idea. Additionally, we plan to implement the proposed scheme to assess its practical performance and computational efficiency in real-world scenarios.