[E-voting] alternative e-voting systems

Michael McMahon michaelmcmahon at vodafone.ie
Thu Mar 4 17:50:25 GMT 2004

Adrian Colley wrote:
> Ah, I see.  The job of manual checking can be minimised if you
> arrange an automated way of physically separating the ballots into
> appropriate categories.  Then the only manual job is to look through
> each category for miscategorised ballots, and to make sure that the
> machine count of that category is correct.  The STV result is
> computable from the published set of categories and associated
> machine counts (even with randomisation).  The manual labour is
> reasonably small and varies linearly with the total valid poll.
> (I've been banging this drum for a while, so excuse me if mine eyes
> glazeth over.)

Ok, that may be a better way of doing it, (even though it is defined a
different way in current election law). The point is, it is still
a manual process.


> I'm not happy with Chaum's system for two reasons, which I don't
> pretend are the result of an exhaustive analysis: (1) it depends
> critically on the security of cryptographic schemes which might not
> remain unbroken; 

Right. That's a fair point. It is certainly true that once published,
the receipt batches are forever more vulnerable to being decrypted
at some time in the future. There are a couple of things I'd say about that:

I'm not a crypto expert, so I'll leave it to those folks, to look
at the details of the algorithm, and make a judgement on that risk,
but I would think that enough time is available in the whole election
scenario to use pretty large keys.

I'm also not sure how much information is revealed necessarily by decrypting
the receipt batch. It could be that you would need to have the receipt in
your posession and know who the receipt came from, to be able to determine
the voters identity. Presumably, most voters will destroy their receipts soon
enough after the election. So, I think the scope of the disclosure can be

> and (2) it seems that a "voter serial number"[1]
> might be hidden in the apparently-random parts of the ballot, and
> there's no way for a voter to be sure that it hasn't happened.

I don't see how that would be possible. Any added information would
be visible in the tally-batch. The counting equipment (and anyone else
who wants to look at them) could easily detect any extraneous bits of information
in the tally ballots.

More information about the E-voting mailing list