Bingo Voting

Bingo Voting is an electronic voting process, the ( EISS ) was developed at the Karlsruhe Institute of Technology at the European Institute for System Security will help to address the lack of accountability of many electronic voting procedures by cryptographic methods. The correct choice is guaranteed under the assumption that trusted random number generators are used. The name " Bingo Voting " comes from the idea of ​​using a mechanical device as a random number generator, similar to bingo or lottery.

In the process of voting machines are used for voting and counting, but gets the voters in choosing a paper document, with whose help he can understand the proper count of his voice. The document is not simply a copy of the completed ballot. Rather, the distribution of votes from the document only for the voters themselves can be seen. The document is neither intended nor suitable to conduct a recount of the election result and is given to the voters back home.

• 3.1 Disputing the election

• 4.2 Reale elections, which were carried out with Bingo Voting
• 4.3 Awards

Concept

The stated goal of the Bingo Voting procedure is to eliminate the disadvantages of the conventional voting machines, in particular the lack of verifiability, and making electronic procedure for voting verifiable and therefore usable.

The basic idea of ​​the method is to give the voters a document, from which it can be seen in his voice, the hand, and to publish copies of all documents after the election. This ensures:

A trivial method would be the voters simply a copy ( marked with an identification number ) ballot in the hand to give his. After the election, all ballots will be published and everyone can verify that his ballot is below, as well as the counting and thus understand the election results. In this naive method extortion and vote buying would be through the document, however, possible secrecy of the ballot would thus not be adequately protected.

However Cryptographic methods allow documents from which only the voters themselves can be seen and his voice no one else This allows the voter to prove his document to any other person what he has chosen.

The document contains the actual voice of the voter so-called filling-in (or dummy votes). These voices have been established before the election and evenly distributed to the candidates. The real voice is produced in the voting booth before the eyes of the voter, so that it knows it, but is for every other by a filling- indistinguishable.

Election process

Predial

Random numbers are generated for each candidate for the preparation of choice. These random numbers are used as a filling-in. On the random numbers Commitments are published, together with a zero-knowledge proof that each candidate has received the same number of filling-in. A Commitment method offers the opportunity to publish a value so that one is committed to it, without betraying him, which means you not publish the value itself, but an " encrypted " version of it. The developers propose for Pedersen commitments, as these beneficial properties have the necessary evidence.

For practical reasons, each voting machine gets its own pool of filling-in. In the following, the method of illustration is described with only one voting machine and a pool of filling-in.

Choice

The time required for the process of voting machine consists of a voting computers with a screen, an input device (such as a touch screen), a printer and a trusted random number generator.

A voter casts his vote in an election from the machine. In this case, no restrictions are given by the procedure itself, the representation and voting and any aids can be adapted to the election.

After the voter has cast his vote, generates the random number generator for every voice that has been delivered, a random number, and displays them on its own display. The voter is getting a printed receipt and can directly check in the voting booth, whether the document is correct. To this end, it compares the random numbers that represent his votes, so are in the appropriate places, with the random numbers that are displayed by the random number generator. If they match, he can be sure that the voting machine has saved his voice correctly.

The random numbers on the document that do not represent votes cast, derived from the pre-established lists. The choice of computer, remove them random numbers from its list after they have been used for a document so that it will not be used a second time.

Counting

The counting is done using the unused filling-in. The candidate who has retained most of its filling- in list, wins the election. Because if a voter who votes for a candidate lose all the other candidates a filling-in from their list. The exact distribution of votes can be calculated from the number of unused filling-in and the number of voters.

After the election, in addition to the election result, further information will be published:

• All unused random numbers ( filling-in ) from the lists of candidates will be published.
• All documents are published.
• For each document, a zero-knowledge proof is published, which proves that exactly a fresh random number is on the receipt and the remaining random numbers from the lists of candidates submitted.

Can With the help of these published data

• Check each voter if his evidence published and thus his voice was included in the count,
• Everyone understands that for each document ( and thus for each voter ) from each list with a filling- out ( of the candidate for whom the vote was cast ), a random number has been deleted, and
• Everyone understands that the number of documents with the number of voters and the election result corresponds.

The last two points can be verified by anyone, regardless of participation in the election or the counting.

Example

A choice of three candidates could run something like this: The Election Commission is along with the three candidates three encrypted lists of random numbers known (actually Commitments to the random numbers). This is also shown that all three lists are of equal length, that contain the same number of random numbers.

In the voting booth, the voter selects one of the three candidates, for example with a touchscreen. After confirming starts a random number generator, a small device with a display that is connected to the computer. The voting machines now generate a receipt, in addition he takes from the two lists of candidates who were not elected, one each random number and the random number from the random number generator. The two random numbers from the lists are written to the respective candidates, the candidate who was elected gets the random number that was just created by the random number generator.

The voters will now get a receipt, in which behind each candidate is a number. He can verify that the document reflects his voice correctly, to the number must be next to the candidate whom he has chosen, with the number that is displayed by the random number generator that match. If this is the case, he may leave the voting booth and take the document home. No one who was not there when the random number has been generated and displayed by the random number generator can view the document, for whom the voter has voted.

After the election, the voter can check whether his evidence was published. So that he can be sure that his vote has been counted. There is for each document is also a proof that two of the three random numbers are from the pre-determined lists. Thus, the voter can be sure that, one each random number has been deleted for the candidate that he has not chosen because they appear so in his evidence. The random number of candidates, the voter has voted, can not come from the list, since it was created in the voting booth before his eyes.

Security and traceability

The reliability of the method is based on the idea that every voter can verify the correct counting of his own voice. For this, the voter in the voting booth must compare the document with the display of the random number generator and check after the election that his document was published. The proofs, which are also necessary for the safety can be traced regardless of by persons or groups that were not involved in the election itself.

The provable correctness of the method is based on the random number generator. If this corrupted, the correctness of the procedure can not be guaranteed. The authors argue that it is easier to understand to build a random number generator and to certify as a full voting machine.

The security of the ballot secrecy is based on the voting machine and the confidence in the election management that generates the random numbers before the election. Saves the voting machine when which vote was cast or the list of random numbers completely known, ballot secrecy is no longer ensured.

Disputing the election

There are several problems that can occur during or after a rigged election:

The Bingo Voting method makes no statement, in which evidence an election can be challenged. It is solely for detection of vote rigging.

Bingo Voting in practice

One of the benefits of electoral processes that use voting machines, is the support that can provide the computer in complex elections with many voices and the ability to the counting and vote splitting. From a certain size Bingo Voting leads her to a limit, as the size of the document and the number of random numbers with the number of votes increase. In an election with three candidates and a vote, the candidate has to look at a document with three random numbers, a number and compare it with the display of the random number generator. In an election with 50 candidates and nine votes, the document is already bearing 450 random numbers, of which the voter must nine compare with the random number generator. While this task can be facilitated by assistance of the computer and an appropriate formatting of the document, but is time-consuming in any case.

Real elections, which were carried out with Bingo Voting

Bingo Voting was first used in the student election at the University of Karlsruhe in 2008 in a real election. There are about 2.5% of the ballots cast by Bingo Voting has been delivered, the remaining votes were conventional paper list. The election committee reported after the election, however, problems with the prototype system to the possibility that members of the EISS could break the secrecy of the ballot.

Awards

Similar procedures

There are other cryptographic voting procedures with a similar goal as Bingo Voting. One of these is punch scan, which was developed by David Chaum.

Swell