Ask HN: How would you implement a secure online voting system?

My first principle would be to remember that network security, and online security are oxymorons e.g. [fresh frozen, jumbo shrimp, military intelligence].

network connectivity, degrades security, and security is a limitation of connectivity.

I would think this might actually be a good application for the blockchain with smart contracts

It can be done. Every voting machine gets a key. Voting machines send results inside a secure VPN network. Votes itself can be duplicated on paper inside the voting machine. The voting machine might not need to be connected to the internet as you can have a separate terminal operated by a staff member.

We have ATMs working securely for decades. It is a largely solved problem. Problem is that the government is not willing to pay for a secure solution.

Blockchain is of course an interesting idea but what I don't really like about it is that someone with more than 50% control can take over the blockchain. While you could see that unfriendly action happening, an adversary could probably create enough chaos to throw doubt on the system. I have been considering an alternative.

In the UK, we have a postal voting system, which can be used by those unable or unwilling to travel to a polling station. You receive a ballot paper and two envelopes to put that ballot paper in. Perhaps other countries have something similar.

You put the ballot paper in envelope A, which is a plain envelope. You then put envelope A in envelope B which has some sort of barcode on it to ensure that there is only a limited number of envelope B. I assume there is a register therefore of those who have voted (just as we have at physical polling stations to prevent double voting).

The B envelopes are torn open and then the A envelopes are gathered. Then the A envelopes are torn open and the votes mixed in with the rest of the votes at polling day.

So another idea might be to double encrypt your voting message. The first message is signed against the key of the verification authority and contains a verification code. The second is signed against the counting authority. The verification system verifies that the vote is valid and hasn't been sent twice and then this is passed to the counting authority which is able to open just the vote message itself without more information.

Drawbacks:

1. We trust the verification authority to not send more votes than it receives

2. We trust the verification certificate and counting certificates are never in the same place. Hardware security modules can help with this.

3. We trust the client-side encryption is correctly implemented

4. We trust that the two authorities have the best interests of democracy at heart

5. We trust that the proposed system isn't just a total lie

So in other words, we trust the same things that we trust with postal votes - that there is a sufficiently decentralised organisation with enough checks and balances and eyes on what is going on to correctly blow the whistle if anything fraudulent is seen.

TL;DR: You need to trust somebody.

Why is online voting needed? As technologists we are sometimes suggesting and using technology to solve problems where technology creates more problems than it solves. If voting systems are online, they can be corrupted/hacked en masse. If it is paper, the corruption/hacking is much more logistically harder to accomplish.

Take the US presidential election as an example. Voting happens on the first Tuesday in November and the winner takes office on Jan 20th. That is over 2 months elapsed time. We don't need to know the winner on election night. Even if it takes 3 weeks to get accurate counts in a close race, there is still plenty of time for transition.

I came up with a design many years ago that is both verifiable, mostly anonymous and does not require a trusted authority.

The basic idea is as follows: 1. Server maintains a public DB of valid registered voters. 2. when users are ready to vote server groups voters in small groups of size n(N=~10-20 voters) 3. server shares IP information of group members so the group members can connect to one another directly. 4. Voters vote and create a random anonymous identifier to tag their vote with. 5. votes+tags (no voter id) are passed back and forth between all the voters in the group until every voter has the vote of every other group member. (Now there are n copies of all the votes). 6. each voter sends all the votes back to server 7. server verifies that all sets of votes agree and then publishes votes along with tags to the public. If votes don't agree (ie one of the group members was naughty) then server breaks up the group, creates new groups and tries again.

There's a lot of academic research about electronic voting. A quick search on scholar.google.com brings up https://pdfs.semanticscholar.org/9cb3/cd86b699b124348b21e936..., I'm sure there's much more more out there.