Citation Context

...addition, receipt-freeness has been considered by Benaloh & Tuinstra [11] and Moran & Naor [25] and coercion resistance has been studied by Juels, Catalano & Jakobsson [23], Küsters, Truderung & Vogt =-=[40]-=- and Unruh & MüllerQuade [39]. These definitions can be used to show ballot privacy because it is believed to be a weaker condition [11, 26]; however, they are too strong for protocols which only prov...

Citation Context

... result – to be leaked even in an ideal situation, and only forbid further leakage. Another possibility is to consider the overall advantage of the attacker without comparing it to an ideal situation =-=[20]-=-. This advantage is always non-negligible as in certain situations the votes are always revealed, e.g. in the case of an unanimous vote. 2A third approach was proposed by Langer et al. [21]. The auth...

Citation Context

...m the protocol execution itself, even when mounting an active attack (see [23] for more details about this definition and [25,31,11] for alternative definitions in the simulation-based model and also =-=[24]-=- for an alternative definition in the game-based model). 3.5 Anonymous Credentials Anonymous credentials have an important role in coercion-resistant schemes. They make possible voters to deceive adve...

Citation Context

...honest. This assumption, as we will show, is necessary for the system to be coercion-resistant. Our analysis is based on a rigorous cryptographic definition of coercionresistance we recently proposed =-=[13]-=-. Compared to other cryptographic definitions, e.g., [10, 15, 19], our definition is quite simple and intuitive and promises to be widely applicable. We argue in Section 4.1 that other cryptographic d...

Citation Context

...nd aim to achieve “only” vote privacy. The study of this notion has only recently started to receive more attention with new models being developed in both symbolic models [13] and computational ones =-=[21, 23, 5]-=-. Models for related notions like confidential message transmission serve as a good but insufficient source of inspiration: unlike in those applications, vote privacy is not absolute but relative to s...

Citation Context

...alyzed in [18]. In contrast, the Norwegian protocol is both complex and fully deployed. There are also been studies of hybrid protocols (not fully electronic), such as Scantegrity [20] or ThreeBallot =-=[19]-=-. We informally describe the protocol in Section 2. The applied-pi calculus is briefly defined in Section 3. We then provide a formal modeling of the protocol in Section 4 and formally state and prove...

Citation Context

...dels for ballot privacy started with the work of Benaloh [21, 6] and has recently started to receive more attention with new models being developed in both symbolic models [32] and computational ones =-=[37, 38, 11]-=-. Unlike related privacy notions such as confidential message transmission, ballot privacy is not absolute but relative to specific election bylaws and voter choices. Consider a voting system that dis...

Citation Context

...ability. 3For more information check our web-site http://www.demos-voting.org 4 As we have mentioned previously, modelling coercion resistance is out of the scope of this work. We refer the reader to =-=[31, 25, 48, 36]-=- for formal definitions of coercion resistance in the cryptographic, symbolic and universal composability model. Organization. In Section 2, we introduce the syntax and define the correctness, E2E ver...