7. Cryptographic Proofs
7.2. Proof of BV — Theorem 5.6
The proof is based on Theorem 6.10 and proceeds by game hopping.
1. Since the adversary cannot win the game with a correct vote, we abort immediately after receiving α if the vote was correct.
2. The ballot verifiability game can be rewritten as a reduction to the OT-BV game in the appendices that handles the polynomial generation and OT response for voteri0. This is
just code rewriting so it does not change the adversary’s success probability.
3. By Theorem 6.10 we switchy0 for a random group element, incurring the aforementioned loss in the adversary’s advantage.
4. We rewrite the game to cancel out the contributions of the other (dishonest) authorities. 5. We rewrite the game to split it into a game and a reduction.
6. We apply Theorem 12.6 to the ZK proof returned by the reduction to extract the witness. This lets us reduce to the discrete logarithm problem.
Steps 1 and 2
We give the reduction to OT-BV. After generating the electorate data, we overwrite that of voteri0 with that from the game we are reducing to. We also abort the game early if the ballot
is correct (Step 1) and use the game to generate the OT response. Since this no longer gives us the value z from the OT, we simply set it to z=⊥ for checking purposes. The algorithms CheckConfirmation and HasBallotdo not require at this value.
ExpbvA-2(s, t,n,k,E,q) // setup (i0,Db 1)← A1() (D1,Db1,P,K)←GenElectorateData(n,k,E) (D1,i0,Db1,i0)←OT-BV.Prepare(Ki0,n) (bx ∗, b y∗)←GetPublicCredentials(D)b (pk 1)← A2(D1,Db1) (sk1,pk1)←GenKeyPair() pk←GetPublicKey(pk)
// Adversary chooses the first part of the ballot (i, α)← A3(pk1)
ifExtract(α, pk)6=⊥then return 0 ifi6=i0 then return 0
Parseα as (x,b a, π)
acheck1←CheckBallot(i, α, pk,K,E,bx
Ifacheck1 = 0 then return 0 β ←OT-BV.Respond(a, pk)
// Adversary gets the response and produces the second part (i0, γ)← A3(β)
Parseγ as (y, πb 0)
acheck2←CheckConfirmation(i0, γ,by
∗,h(i, α, ⊥)i,h i)
Ifacheck2 = 0 then return 0
// Finalisation v←E(α, pk)
vote←Extract(v,Ki0,n,q)
Ifvote=⊥then return 1 else return 0
Lemma 7.4 For all adversaries A we haveAdvbvA =AdvbvA-2.
Proof. By inspecting the definitions of the algorithms involved, one can see that the Expbv-2 game behaves identically to theExpbv one as long as it does not return early (in the modified line). But in an execution which returns early, the adversary would not win the game if we
omitted this line. q.e.d.
Step 3
We switch OT-BV for OT-SIM using Theorem 6.10. Call the new game Expbv-3. The cited theorem immediately gives us the following result.
Lemma 7.5 For all adversaries A that make up toν random oracle queries we have
AdvbvA-3 ≥AdvbvA-2 1−ν(n+ 1) b q 1− n b q−n+ 1
The following equation is an immediate consequence of this lemma:
AdvbvA-2 ≤Advbv-3+ν(n+ 1) ˆ q + n ˆ q−n+ 1
Note. We have proposed to set p0 =qb. In this case, the yb-elements ofDb were all uniform
in Gqbpreviously and the following step is redundant.
Unfortunately, the following step does not lend itself nicely to a concrete security analysis (which is why we have recommended setting p0 =qb. In our concrete security analysis, we
therefore letAdvbvA−3∗ be the advantage of the adversary after this step is performed.
Formally, switch OT-SIM for OT-RED together with a DLOG challenger that creates a chal- lenge as y0Zp0; C←
b
gy0 . This does not change the adversary’s advantage as the two sys- tems are equivalent. Then, we switch the challenger for one that creates the challenge as
y0Zqb; C←bg
y0 . This is an example of subsystem switching.
The justification for this hop is based on a theorem of Boneh and Venkatesan [7] who show that retrieving just the most significant bits of a discrete logarithm reduces to finding the entire logarithm. However, their theorem uses a lattice basis reduction argument which makes it hard to compute the exact loss function for the reducton.
Step 4
Immediately before the line (xb
∗,
b
y∗) ← GetPublicCredentials(D) we add the following code tob cancel out the contributions of the other authorities to the voter’s key pair. Recall that each entry eof the matrixDb is a pair (bx,by), the components of which we refer to ase(1) and e(2).
b DI,i0 ← (DI,ib 0)(1), (DI,ib 0)(2)/ Y i6=I (Di,ib 0)(2)
This changes the I-th row of our local copy of the matrixD, which we return to the adversaryb in stageA2. The result is that the discrete logarithm ofyb
∗ isy+y0 for the valuesy, y0 that our
authority I chose.
Lemma 7.6 Call the result of the changes in this stepExpbv-4. For all adversaries Awe have
AdvbvA-3∗=AdvbvA-4.
Proof. Our entry of Db for voter I is still uniformly random in G
b
q as y0 is uniform in Zbq.
Therefore, this change is undetectable and does not change the adversary’s winning probability. q.e.d.
Note. We have proposed to strengthen the CH-Vote protocol by adding ZK-PoKs to the matrix Db. In this case, we simulate the ZK-PoKs associated with authority I here which
the game can do as it is in control of the random oracle. Replacing a real ZK-PoK with a simulated one is perfectly indistinguishable to the adversary by the ZK property.
Step 5
We rewrite our game to delegate most of the work to a reductionR as described in Figure 28. This introduces a new abstraction boundary, where the discrete logarithm y0 of the valueC is hidden from the reduction. In order to get the reduction to DLOG in the next step to work, we also pass the voter secret key yI,i0 as well as the ballot component α and the public key pk
back to the game across this abstraction boundary.
Since we have only moved code around but not changed the semantics, the adversary’s advantage remains unchanged. The only point that may need some explanation is that we have moved the
ExpbvA-5(s, t,n,k,E,q)
y0Zqb; C←bg
y0
(y, πb 0, y, α, pk)← R(A, C) // if this returns 0, so do we ifExtract(α, pk)6=⊥then return 0
Return 1 R(A, C) // setup (1, i0,Db 1)← A1() (D1,Db1,P,K)←GenElectorateData(n,k,E) (D1,i0,Db1,i0)←OT-RED.Prepare(Ki0,n, C) b D1,i0 ← (Db1,i0)(1), (Db1,i0)(2)/ Q i6=1(Dbi,i0)(2) (bx∗,yb∗)←GetPublicCredentials(D)b (pk 1)← A2(D1,Db1) (sk1,pk1)←GenKeyPair() pk←GetPublicKey(pk)
// Adversary chooses the first part of the ballot (i, α)← A3(pk1)
ifi6=i0 then return 0
Parse α as (x,b a, π)
acheck1←CheckBallot(i, α, pk,K,E,xb
∗,h i)
If acheck1 = 0 then return 0 β ←OT-RED.Respond(a, pk)
// Adversary gets the response and produces the second part (i0, γ)← A4(β)
Parse γ as (y, πb 0)
acheck2←CheckConfirmation(i0, γ,yb
∗,h(i, α, ⊥)i,h i)
If acheck2 = 0 then return 0
Parse DI,i0 as (xI,i0, yI,i0, RI,i0, FI,i0)
return (by, π0, yI,i0, α, pk)
extractor check to the game, so it executes after the rest of the reduction. However, since the extractor is deterministic, the momentαandpkare determined so is the result of the extraction, so it does not matter if we do this check at a later time. The reason for this step is that the reduction Ris now an efficient algorithm again. We conclude thatAdvbvA-5 =AdvbvA-4.
Step 6
The adversary produces a Schnorr ZK-PoKπ0 inγ. We use Theorem 12.6 to extract the witness ˜
y such thatgby˜=yb. By applying the theorem to the reductionRwe get the following result. Lemma 7.7 Let EA,R be the event that extraction from reduction R succeeds for a given ad-
versary A. If Amakes up to ν random oracle queries then
AdvbvA-5≤qν·Pr[EA,R] +
ν
2τ
where τ is the length (resp. entropy) of the challenge space in the PoK in γ.
If the adversary’s advantage was non-negligible and the adversary makes at most a polynomially bounded number of random oracle queries then the probability of the extraction succeeding will still be non-negligible.
Note. The Simulation-Sound Extraction property (Theorem 12.6) implies that the Forking Lemma still works after the adversary has seen simulated proofs (which implies “program- ming” access to the random oracle), as long as the proof returned at the end is not one of the simulated proofs.
We have made a recommendation to add PoKs to the authority public keys and to the values in Db. In this case, our experiment additionally simulates these proofs. Since the returned
proofγ is on the statementyband the simulated proofs are on statements generated with high entropy by the experiment, the probability of a collision here (that would let the adversary submit a simulated proof and still pass the confirmation check) is negligible, specifically1/qb.
We can now reduce to the discrete logarithm problem. Obtain a challenge C from the DLOG challenger and use it in place of the one that the previous experiment generated by itself. This does not change the distribution ofCso the probability of successful forking remains unchanged. This gives us the following reduction E to the discrete logarithm problem:
Reduction E(s, t,n,k,E,q) obtain C from DLOG challenger (by, π
0, y, α, pk)← R(A, C)
fork Rto get witness ˜y
return ˜y−y (modqb) to DLOG challenger
If we succeed in obtaining ˜y=y+y0 through the Forking Lemma, then as we already know y, we can return y0 := ˜y−y (modqb) as the required discrete logarithm. The reduction E, unlike Game 5, does not invoke the (inefficient) extractor or abort if extraction succeeds. This does
not matter — the probability of the event that the adversary produces a valid proof and that
α is not a correct ballot component cannot have decreased by omitting a check that can only
decrease the adversary’s advantage. This gives the following result. Lemma 7.8 For every adversary A we have AdvdlogE,
Gbq
=Pr[EA,R] where the left-hand side is
the advantage of reduction E against the discrete logarithm problem.
Proof of Theorem 5.6.
Note. We are assuming p0=bq here.
By combining steps 1–6 we can upperbound the advantange of adversary A against ballot verifiability by: AdvbvA ≤ q ν·AdvdlogE,Gˆ q + ν 2τ +ν (n+ 1) ˆ q + n ˆ q−n+ 1