Research Archives - Sequent /research/ Online Voting Platform Wed, 29 May 2024 17:03:42 +0000 en-US hourly 1 https://wordpress.org/?v=6.5.7 /wp-content/uploads/2022/06/cropped-FAV-6-32x32.png Research Archives - Sequent /research/ 32 32 Degree of Privacy in Voting /research/degree-of-privacy-in-voting/ Tue, 30 May 2023 08:37:41 +0000 /?p=1849 This article demonstrates the natural extension of Diaz’s 2002 degree of anonymity model to voting scenarios. The outcome is straightforward but holds potential value for intricate cases like weighted voting, where privacy concerns surpass the conventional “bisimilarity-under-swapping” definition outlined by Delaune in 2009. These concerns arise from the possibility of information leakage through election results, […]

The post Degree of Privacy in Voting appeared first on Sequent.

]]>

This article demonstrates the natural extension of Diaz’s 2002 degree of anonymity model to voting scenarios. The outcome is straightforward but holds potential value for intricate cases like weighted voting, where privacy concerns surpass the conventional “bisimilarity-under-swapping” definition outlined by Delaune in 2009. These concerns arise from the possibility of information leakage through election results, as highlighted in Delaune’s work:

Go Back
Blog

Degree of Privacy in Voting

Blog, Research
    Add a header to begin generating the table of contents

    This article demonstrates the natural extension of Diaz’s 2002 degree of anonymity model to voting scenarios. The outcome is straightforward but holds potential value for intricate cases like weighted voting, where privacy concerns surpass the conventional “bisimilarity-under-swapping” definition outlined by Delaune in 2009. These concerns arise from the possibility of information leakage through election results, as highlighted in Delaune’s work:

    It is important to note that the definition of “bisimilarity-under-swapping” remains resilient even in scenarios where the outcome of the election necessitates the disclosure of votes from VA and VB. This applies to situations such as unanimous voting or when other voters reveal their choices, leading to the deduction of votes for VA and VB.

    The notion that information can potentially leak from voting results directs our attention to the degree of anonymity model. This model, rooted in information theory, enables the quantification of anonymity provided by anonymous connection schemes. It considers attackers who gather probabilistic information about users. Unlike the standard possibilistic privacy definition for voting, the degree of information in this model pertains to probabilistic inference. The measure is not binary; instead, it quantifies the amount of information an attacker can obtain by observing the process. In the context of voting, as discussed later, the attacker acquires information by observing the results, which are accessible regardless of the existence of ballot privacy.

    By quantifying information gain, entropy naturally results (Diaz 2009).

    As a measure of degree of anonymity, the authors apply a normalization factor based on maximum entropy (zero information leakage):

    Given the normalization

    Extension to Voting

    Using the degree of anonymity model, we can determine who sent a message out of possible groups (the anonymity set). This model should be extended to the case of voting, where the attacker wants to determine the voter’s choice. The availability of individual votes as plaintexts varies depending on the secure voting scheme employed. Consequently, the translation between different scenarios is not instantaneous. In one case, the focus is on determining a single variable out of n options, while in the context of voting, the objective is to ascertain vote choices based on election results.

    However, it is possible to incorporate probabilities directly into the degree of anonymity model. These probabilities should be derived from the election results, as they constitute the publicly available information accessible to the attacker. Furthermore, it is desirable to establish a general approach that does not rely on the specific electoral method or the format of the election result. We start with:

    These are sets of voters, choices and election results.

    The function ‘a’ represents the individual voter’s selection, defined as a mapping that associates each voter with their respective choice. On the other hand, the function ‘t’ denotes the election tally, which maps the set of choices made by voters to the corresponding result.

    Ar corresponds to the set of all functions ‘a’ that generate the outcome ‘r’, representing the sets of selections made by voters. Expanding on this, the function ‘m’ denotes the count of distinct functions ‘a’ in which voter ‘v’ selects choice ‘c’ and the overall result is ‘r’. In essence, it quantifies the number of instances where voter ‘v’ chooses ‘c’ and the final result corresponds to ‘r’.

    These expressions allow us to provide equivalent expressions for the terms in the original definition of degree of anonymity. According to the election result, the entropy corresponding to the uncertainty of a voter’s choice is

    In this case, entropy is simply the standard expression for entropy, but with probabilities that correspond to the likelihood that a certain choice will be selected given a certain election result. When there is no information about the election, the maximum entropy corresponds to a uniform probability distribution for the voter’s choice, resulting in

    where |C| is the number of choices (the cardinality of C). Finally, the degree of privacy is

    which quantifies the degree to which a voter’s v choice remains secret given the election result r. This expression exhibits similarities to the degree of anonymity model, albeit with certain modifications. Firstly, we are addressing the degree of privacy, quantifying the level of knowledge about a voter’s choice, rather than attempting to de-anonymize the sender of a message. Furthermore, this result pertains to each individual voter. While this characteristic may not always be relevant, it holds significance in scenarios involving weighted voting, where voters possess distinct degrees of anonymity. Additionally, it is possible to derive aggregate values, such as the average or minimum degree of anonymity. Another generalization involves computing expectation values over results for a given setup. As an extreme example, in an election with a single voter, the degree of anonymity would always be 0, regardless of the result.

    As mentioned previously, the aforementioned definition applies universally to any election, regardless of the electoral method, result type, or even the design of the ballot. Now, let’s delve into some specific examples to further illustrate this point.

    Examples

    We calculate values for examples. In all cases we are using a plurality rule for the function t: V => C => R.

    Yes/No vote, Single voter

    This is a Yes/No vote (ballot options are Yes or No). We have a single voter, John.

    V = { John }, C = { Yes, No }, R = { {Yes:1, No:0}, {Yes:0, No:1} }

    In the following expression:

    The value of n is 2, for two possible results (the cardinality of C). Consider the case where r = Yes, then

    Ar = { (John, Yes) }, and |Ar| = 1

    since it is the only way that John could have voted. Similarly,

    m(John, Yes, Yes) = 1 and m(John, No, Yes) = 0

    again, for the same reason. The entropy then reduces to

    H(v, r) = 1/1*log(1/1) = 0

    which when plugged into

    gives

    d(John, Yes) = d(John, No) = 0

    The degree of anonymity is zero. This matches the obvious fact that in an election with a single voter, their vote will be revealed.

    Yes/No vote, Unanimous result

    V = { v1 … vn }, C = { Yes, No }, R = { {Yes:n, No:0}, {Yes:0, No:n} }

    In the following expression:

    we see that the unanimous vote case has a similar form as the case of a single voter, except for a general number of voters and results:

    |Ar| = 1

    for all r, and also

    m(v, Yes, {Yes:0, No: 10} ) = 0 and m(v, Yes, {Yes:10, No: 0} ) = 1

    which leads to

    d(v, r) = 0

    for all v and r. Once again, this matches the obvious expectation: in a unanimous election, all votes are disclosed.

    Yes/No vote, General case

    V = { v1 … vn }, C = { Yes, No }, R = { {Yes:n, No:0} … {Yes:0, No:n} }

    In this case, the cardinality of R is |C|, as we are not confining the results solely to unanimous outcomes. The calculation for |Ar| and m deviates from the previous approach. By indexing the results in R based on the number of positive votes, we obtain the following:

    with a binomial coefficient on the right. This is the number of ways it is possible to obtain the result r. We also have

    dividing the previous two expressions provides

    Because this is a Yes/No election

    which when divided by |Ar|

    The complete expression for H is therefore

    at this point, we can do a couple of sanity checks. Firstly, the probabilities in the entropy expression (r/|C| + 1 — r/|C|) sum to 1. Secondly, these examples highlight a common-sense inference. If an election comprises |C| choices and the number of “Yes” votes is r, then the probability of any voter selecting “Yes” must be r / |C|. Although our generalized approach for calculating entropy is more extensive than our intuition for indistinguishable voters under the plurality rule, it aligns with logical reasoning.

    Finally, the degree of privacy for the general Yes/No election is

    Below is a graph of this function for a fixed value of 10 voters (|C| = 10).

    As we saw in the previous section, unanimous elections correspond to the two edges of the graph, where d = 0.

    Summary

    The application of the generalized degree of anonymity model in the context of voting has demonstrated its versatility and relevance. This extension proves applicable to diverse voting methods, providing a flexible approach. Through simple yet illustrative examples, we observe that the model’s calculations align with outcomes derived from traditional methods specific to each type of election. While these initial examples may seem straightforward, the significance of the degree of privacy becomes particularly apparent in more complex scenarios where voters are distinguishable, and results may inadvertently reveal additional information. Weighted voting serves as a prime illustration of such cases. While the definitions presented herein can be equally applied to this scenario, employing them in their general form may require additional considerations to address potential combinatorial challenges.

    References

    Diaz 2002 — Towards measuring anonymity

    Delaune 2009 — Verifying privacy-type properties of electronic voting protocols

    [3] It is also possible to use a non-uniform prior probability here. In that case the resulting conditional probabilities must be derived in such a way that relative magnitudes are preserved.

    The post Degree of Privacy in Voting appeared first on Sequent.

    ]]>         A Toy Model of Information – Theoretic Security /research/a-toy-model-of-information-theoretic-security/ Fri, 21 Apr 2023 09:20:46 +0000 /?p=1892 In a previous post, we discussed different types of uncertainty due to limited information or computations as the basis for cryptography. A Caesar cipher example demonstrated how an adversary could have all the information to reveal a secret if the relationship between the message space, key space, and ciphertext satisfies the following: Go Back Blog Add a header to […]

    The post A Toy Model of Information – Theoretic Security appeared first on Sequent.

    ]]>

    In a previous post, we discussed different types of uncertainty due to limited information or computations as the basis for cryptography. A Caesar cipher example demonstrated how an adversary could have all the information to reveal a secret if the relationship between the message space, key space, and ciphertext satisfies the following:

    Go Back
    Blog

    A Toy Model of Information – Theoretic Security

    Blog, Research
      Add a header to begin generating the table of contents

      In a previous post, we discussed different types of uncertainty due to limited information or computations as the basis for cryptography. A Caesar cipher example demonstrated how an adversary could have all the information to reveal a secret if the relationship between the message space, key space, and ciphertext satisfies the following:

      				
					ZHOO GRQH BRX KDYH IRXQG WKH VHFUHW YGNN FQPG AQW JCXG HQWPF VJG UGETGV
XFMM EPOF ZPV IBWF GPVOE UIF TFDSFU <strong>WELL DONE YOU HAVE FOUND
THE SECRET</strong> VDKK CNMD XNT GZUD ENTMC SGD RDBQDS UCJJ BMLC WMS
FYTC DMSLB RFC QCAPCR TBII ALKB VLR EXSB CLRKA QEB PBZOBQ

      Since none of the other attempts yielded meaningful results, we were able to identify the correct message. Since the number of possible keys is so small, only one of them can decrypt a possible message. In technical terms, the key space and message space[2] are small enough compared to the length of the message that only one key will decrypt.

      The situation can be coarsely be classified into three cases:

      1. H(K | C) = H(K) — Perfect secrecy
      2. H(K | C) < H(K) — Information-theoretic security
      3. H(K | C) = 0 — Computational security

      The epistemic uncertainty mentioned in the previous entry is the epistemic uncertainty of information theory. To illustrate how information-theoretic privacy works, we can use a simple model that reduces computation security when conditions are not met.

      Elements of our model

      The XOR function

      Using a key that determines the exact transformation and allows the intended recipient to recover the secret, our toy model must specify how messages are encrypted from plaintext to ciphertext. We can use a two-character alphabet that consists of binary sequences as messages. As our encryption function, we will use the XOR function, which produces a third binary sequence from two inputs. By choosing this option, we also fix our key space to be binary sequences. Here’s an example encryption:

      1010011000 XOR 1100111010 = 110100010

      The XOR function produces a ciphertext 110100010 by taking as input a message (1010011000) and a key (1100111010). There is no difference in the process, we can simply imagine that the 1010011000 above is some meaningful content like “WELL DONE YOU FOUND THE SECRET ”. Like in English, in plaintext space (binary sequences) there is a subset of combinations that make meaningful messages, while the rest do not. As a result, we come to the notion of language entropy, which measures how large the meaningful subset of messages is in relation to the entire plaintext space.

      As the language entropy increases, the proportion of the blue region in relation to the entire plaintext space also increases. For binary languages, the entropy ranges from 0 to 1, which is measured in bits per character. Currently, our toy model consists of these components:

      • Plaintext space: P ∈ {0, 1}n
      • Message space: M ⊂ P
      • Key space: K ⊂ {0, 1}n
      • Ciphertext space: C ∈ {0, 1}n
      • Encryption function: XOR: P x K → C
      • Language entropy: HL ∈ {0.0-1.0}

      The security characteristics of our system are contingent upon three parameters that are associated with the aforementioned factors:

      • n:the number of characters in the plaintext
      • |K|: the size of the key space
      • HL: the language entropy
      • RL = 1 — HL: the language redundancy

      The final parameter, redundancy, is essentially a rephrasing of the language entropy. The equation that formulates the security in relation to these parameters is:

      The given equation provides a minimum estimate for the anticipated quantity of false keys, denoted by the term “sn”. A false key, for a specific ciphertext, is a key that decrypts the ciphertext into a message that is not equivalent to the message that was initially encrypted using the correct key. As illustrated in the initial encryption example mentioned in the post, it was observed that among all the attempted keys used to decrypt the ciphertext, only one produced a coherent plaintext, implying that the ciphertext had no false keys. Conversely, if one of the keys, denoted as “s”, had decrypted the ciphertext into something similar to

      THE MESSAGE COULD BE THIS

      then in such a scenario, the key “s” would be considered a false key. If an attacker were to attempt all possible keys, they would end up with two potential messages, making it challenging to determine the accurate one. As a result, the confidentiality of the secret would be relatively preserved. The presence and quantity of anticipated false keys determine the category to which a cryptosystem belongs among the three general classifications mentioned earlier. Examining the false key equation reveals the following patterns:

      • sn increases with the size of the key space, |K|
      • sn decreases with the size of the plaintext, n
      • sn decreases with language redundancy, RL

      A visual representation

      Encryption representation with n = 2, H = 0.8, M = 3, K = 1

      The image’s left side depicts a visual representation of our parameter values for the toy model, where the left axis denotes the plaintext space, and the right axis represents the ciphertext space. Each point on the graph symbolizes an encryption or a mapping from the plaintext space to the ciphertext space. To obtain the visual representation, we set n = 2, resulting in a plaintext space with four elements. Out of these four, three convey meaningful messages, considering a language entropy of 0.8. Thus, the three red dots on the graph correspond to the three encryptions of these three meaningful messages. Since K=1, each plaintext has only one corresponding ciphertext or, visually, only one point on any given horizontal line. For comparison, see:

      n = 2, H = 0.8, M = 3, K = 3

      Displayed in the image are nine points that correspond to three messages encrypted using three distinct keys. Consequently, each horizontal line on the graph signifies all the encryptions for a specific message under various keys. As for the variance in color, consider the following alternative set of parameters:

      n = 6, H = 0.8, M = 28, K = 3

      If we increase the plaintext length, the number of meaningful messages also increases to 28, resulting in a total of 28 x 3 = 84 encryptions, represented by red and blue points in this particular case. Can you discern the pattern that explains this phenomenon? It may be challenging to identify, but the explanation lies in comprehending the significance of vertical lines in the visual representation. Points that lie on the same horizontal line denote distinct encryptions for the same message, whereas points that are positioned on the same vertical line signify different messages encrypted using the same key. As previously observed, this is precisely the situation where an attacker cannot deduce the secret by attempting all possible keys in reverse, as it is impossible to distinguish the original message among the resulting messages.

      Ciphertexts represented by blue points have more than one key that can decrypt them into a meaningful message. Alternatively, blue points signify ciphertexts that possess one or more spurious keys.

      sn > 0 ⇒ blue point

      sn = 0 ⇒ red point

      We can now visualize the properties of information-theoretic security that we mentioned earlier.

      • sn increases with the size of the key space, |K|

      Fixed n, H, increasing values of K

      In terms of visualization, the number of red dots proportionally increases.

      • sn decreases with language redundancy, RL

      Fixed K, H, increasing values of n

      In terms of visualization, the number of red dots proportionally increases.

      Fixed n, K, decreasing values of H (increasing values of R)

      Visualizing the categories

      In addition to these patterns, we also discussed three general categories that cryptosystems fall into:

      • H(K | C) = H(K) — Perfect secrecy

      n = 8, H = 0.55, K = 256

      In terms of visualization, the number of blue dots per column is equivalent to the number of horizontal lines. This indicates that the adversary cannot extract any information from the ciphertext. It is noteworthy that 2^8 = 256, which corresponds to the value of K.

      • H(K | C) < H(K) — Information-theoretic security

      n = 9, H = 0.55, K = 106

      In terms of visualization, only blue dots are present. Each ciphertext is partially secured, implying that the attacker lacks sufficient information to disclose the secret definitively.

      • H(K | C) = 0 — Computational security

      n = 13, H = 0.53, K = 29

      In terms of visualization, there are red dots indicating ciphertexts that do not have information-theoretic protection and rely on computational security for their confidentiality.

      Try it yourself.

      This post discusses the main concepts presented in Claude Shannon’s Communication Theory of Secrecy Systems published in 1949. Additionally, we have created a toy model to help visualize the security properties of cryptosystems and how they change with the primary parameters. If you’re interested, you can experiment with the model here. If you’re a teacher and find it useful, please inform us!

      The post A Toy Model of Information – Theoretic Security appeared first on Sequent.

      ]]>             Anonymity, Pseudonymity and E-participation /research/anonymity-pseudonymity-and-e-participation/ Wed, 29 Mar 2023 10:04:45 +0000 /?p=1926 In this article, we will examine two papers related to the topic of anonymity in e-participation: Ruesch & Märker 2012 – “Making the Case for Anonymity in E-Participation” and Moore 2016 – “Anonymity, Pseudonymity and Deliberation: Why Not Everything Should be Connected.” Our focus is on the concept that there may be an optimal solution […]

      The post Anonymity, Pseudonymity and E-participation appeared first on Sequent.

      ]]>

      In this article, we will examine two papers related to the topic of anonymity in e-participation: Ruesch & Märker 2012 – “Making the Case for Anonymity in E-Participation” and Moore 2016 – “Anonymity, Pseudonymity and Deliberation: Why Not Everything Should be Connected.” Our focus is on the concept that there may be an optimal solution in the anonymity spectrum, which strikes a balance between conflicting properties at both ends.

      Go Back
      Blog

      Anonymity, Pseudonymity and E-participation

      Blog, Research
        Add a header to begin generating the table of contents

        In this article, we will examine two papers related to the topic of anonymity in e-participation: Ruesch & Märker 2012 – “Making the Case for Anonymity in E-Participation” and Moore 2016 – “Anonymity, Pseudonymity and Deliberation: Why Not Everything Should be Connected.” Our focus is on the concept that there may be an optimal solution in the anonymity spectrum, which strikes a balance between conflicting properties at both ends.

        Advocating for Anonymity in E-Participation

        We will examine the points raised in the first paper, which presents an analysis of the participatory budget of the city of Gütersloh in Germany. Although the title may suggest a stance in support of anonymity, it is important to note that the concept of anonymity is not absolute and exists on a spectrum. This spectrum is where the trade-offs between opposing arguments take place. The discussion is relevant to various online platforms such as forums, social networks, and the web in general, and therefore, we will first review general points.

        General arguments

        • The self-control argument

        There is substantial evidence supporting the argument that anonymous communication often leads to more uncivil discourse, while a real name policy can promote more civilized communication. The ability to be identified by others appears to foster self-restraint, reduce personal attacks, and help establish “communities of trust.”

        • The legal argument

        Advocates of the real name policy emphasize the significance of having easily identifiable profiles to ensure legal accountability for the actions and language used by internet users.

        • The online=offline argument

        If we are expected to be accountable using our real names in our offline lives, why should we not have the same expectation in our online lives?

        Conversely

        • The open participation argument

        Requiring users to disclose their real name could lead to the exclusion of many individuals from participating in forums or social networks, particularly in authoritarian regimes where those critical of the government may face repercussions.

        • The freedom argument

        Users are more likely to express themselves freely and without being influenced by groupthink when they are not required to disclose their real identity.

        • The privacy argument

        Users should have the right to choose whether to make certain political or other opinions publicly accessible, especially considering that information once published on the internet can be almost impossible to control.

        Arguments specific to E-participation

        Many of the points discussed so far are likely familiar as they relate to observations made in the previous post. However, the focus has mainly been on social networks and unmoderated online forums, leaving the area of e-participation relatively unexplored in regards to anonymity and real name policy. This paper aims to fill that gap by explicitly connecting the “anonymity debate” to e-participation, presenting both pros and cons as rationale and objections, respectively.

        Rationale 1: Requiring a real name policy and personal data can ensure that only eligible citizens participate, thereby improving representativeness and, in turn, legitimacy.

        Rationale 2: Requiring users to disclose their real name and personal data ensures that the quality of dialogue is improved by preventing offensive comments from anonymous users.

        Rationale 3: The following objections challenge the points made in favor of real name policy and the request for personal data in ensuring transparent communication and strengthening democracy:

        Objection 1: The focus on real name policy and request for personal data can detract from discussions centered on issues, leading to a biased perception of messages that degrades the quality of discourse.

        Objection 2: Real name policy and request for personal data infringe upon individuals’ privacy rights.

        Objection 3: Requiring a real name policy and personal data can lead to time-consuming and costly administrative issues.

        Objection 4: Real name policy and request for personal data can lead to negative media attention and public perception due to legal, administrative, and usability problems they cause.

        Objection 5: Requiring real names and personal data may create usability issues that discourage people from participating, ultimately leading to a decrease in overall participation.

        The arguments put forth regarding online discussion and the internet at large share a considerable amount of common ground with those presented in the case of e-participation. Rationale 2 and Objection 1 align with the general arguments for self-control and quality, while Objection 2 corresponds with the broader arguments for open participation and freedom.

        Preserving Integrity through Pseudonymity

        Introducing Integrity Preserving Pseudonymity as a Compromise Solution:

        The authors of the paper argue that, based on the Gütersloh experience, the objections to real name policy outweigh the rationales. However, as we mentioned earlier, anonymity is not a black and white issue and there are various compromise solutions between complete anonymity and real name policy. These range from no registration at all to registration with verified personal data.

        One potential solution that could be considered a midpoint is Integrity Preserving Pseudonymity. With this approach, citizens are required to validate their real identities to participate in the platform, but their identities remain private and cannot be linked to their pseudonyms beyond the eligibility requirement.

        This compromise solution allows citizens to maintain a degree of identity by linking their contributions to their pseudonyms, but still ensures their privacy with respect to both the general public and institutional authorities managing the participation process. This strikes a balance between anonymity and real name policy, where identity is stronger than complete anonymity but weaker than real identity.

        Integrity preserving pseudonymity can be established using anonymous credentials, a cryptographic technique introduced by David Chaum (CHA 85). Revisiting the pros and cons of this type of pseudonymity, we can analyze whether the Rationales and Objections support or challenge the use of pseudonymity, as well as the two extremes of pure anonymity and real names. To simplify, we have abbreviated the arguments and merged Objection 4 with Objection 3. The following table summarizes the analysis.

        The cells in the table are marked with a check (√) or an X depending on whether the argument supports or questions the use of pseudonymity. Cases where the argument has both positive and negative aspects with respect to the policy are marked with both symbols. Here is a summary of the arguments for pseudonymity.

        • Legitimacy, integrity

        Integrity preserving pseudonymity guarantees that only eligible citizens can participate while maintaining integrity.

        • Civility

        Pseudonymity has characteristics of both real name policy and anonymity. On one hand, since participants are not fully identifiable, there is some possibility for uncivil behavior, which may pose a challenge for accountability. However, on the other hand, pseudonymity does offer a degree of identity through linking contributions to a particular citizen, allowing for a level of accountability. While this level of accountability is not as strong as that offered by real names, it is greater than that provided by pure anonymity.

        • Communication transparency

        According to the definition in the paper, the argument against pseudonymity based on the fact that citizens do not know the real person they are communicating with is considered negative. However, it is possible to make points similar to those made for civility in this context.

        • Issue-centric debate

        This argument is equivocal for the same reasons as described for Civility. The presence of some degree of identity may divert from a purely issue-focused discussion, similar to what happens with pure anonymity.

        • Privacy, inclusion, freedom

        Integrity preserving pseudonymity, by definition, protects citizens’ real identities, which in turn promotes inclusion and freedom.

        • Administrative complexity

        Implementing pseudonymity involves citizen authentication using their real name and other personal information, resulting in similar complexity issues to those of a pure real name policy. Furthermore, pseudonymity requires a meticulous implementation with proper cryptography, leading to administrative complexity and associated costs.

        • Usability and participation

        This argument presents a mixed evaluation for pseudonymity. On one hand, the real name authentication required for pseudonymity may result in complexity issues similar to those for a pure real name policy, decreasing usability and participation. On the other hand, pseudonymity offers some advantages for increasing participation, while still protecting citizens’ real identity, which aligns with the Privacy-inclusion-freedom argument.

        The overall evaluation of a pseudonymity policy should consider the relative importance of each argument, rather than simply counting the pros and cons. Pseudonymity can function as an optimal balance between maintaining important properties of pure anonymity and ameliorating its drawbacks. However, the level of identity present in pseudonymity does pose a greater threat to Privacy-integrity-freedom than pure anonymity if inference attacks are conducted on pseudonyms’ linkable contributions. The paper suggests that negative effects of anonymity can be accounted for by the use of pseudonyms and moderation, and that real name policy should be avoided in e-participation projects.

        Summary

        In Ruesch & Märker’s 2012 paper, we examined arguments both for and against anonymity in general and specifically in the context of e-participation. We noted that anonymity exists on a spectrum and that integrity preserving pseudonymity falls somewhere in between complete anonymity and full identification. We then assessed pseudonymity based on the arguments presented and suggested that, depending on the importance of each argument, it could be an effective compromise that balances conflicting requirements in e-participation systems. [36]

        References

        (Chaum 85) — Chaum, David (October 1985). “Security without identification: transaction systems to make big brother obsolete”.

        (Ruesch & Märker 2012) — Making the Case for Anonymity in E-Participation

        [20] De Cindio, Fiorella. 2012. “Guidelines for Designing Deliberative Digital Habitats: Learning from E-Participation for Open Data Initiatives.” The Journal of Community Informatics 8 (2).

        [21] Fredheim, Rolf, Alfred Moore, and John Naughton. n.d. “Anonymity and Online Commenting: An Empirical Study.” SSRN Electronic Journal. doi:10.2139/ssrn.2591299.

        [22] Cho, Daegon, and Alessandro Acquisti. 2013. “The More Social Cues, The Less Trolling? An Empirical Study of Online Commenting Behavior.”

        [23] Diakopoulos, Nicholas, and Mor Naaman. 2011. “Towards Quality Discourse in Online News Comments.” In Proceedings of the ACM 2011 Conference on Computer Supported Cooperative Work — CSCW ‘11. doi:10.1145/1958824.1958844.

        [25] Fredheim, Rolf, Alfred Moore, and John Naughton. n.d. “Anonymity and Online Commenting: An Empirical Study.” SSRN Electronic Journal. doi:10.2139/ssrn.2591299.

        [26] Davies, Todd. 2009. Online Deliberation: Design, Research, and Practice. Stanford Univ Center for the Study.

        [29] Connolly, Terry, Leonard M. Jessup, and Joseph S. Valacich. 1990. “Effects of Anonymity and Evaluative Tone on Idea Generation in Computer-Mediated Groups.” Management Science 36 (6): 689—703.

        [30] Flanagin, A. J., V. Tiyaamornwong, J. O’Connor, and D. R. Seibold. 2002. “Computer-Mediated Group Work: The Interaction of Sex and Anonymity.” Communication Research 29 (1): 66—93.

        The post Anonymity, Pseudonymity and E-participation appeared first on Sequent.

        ]]>                 Homomorphic vs Mixnet Based E-voting /blog/homomorphic-vs-mixnet-based-e-voting/ Mon, 20 Feb 2023 07:44:38 +0000 /?p=1612 Although proposals have been made using other techniques, most common modern approaches to constructing secure voting systems can be divided into two categories: those based on homomorphic tallying (shorthand “homomorphic systems”) and those based on verifiable mixnets (shortand “mixnet systems”). Most systems, both prototypes in academia as well as production systems in industry, use one […]

        The post Homomorphic vs Mixnet Based E-voting appeared first on Sequent.

        ]]>

        Although proposals have been made using other techniques, most common modern approaches to constructing secure voting systems can be divided into two categories: those based on homomorphic tallying (shorthand “homomorphic systems”) and those based on verifiable mixnets (shortand “mixnet systems”). Most systems, both prototypes in academia as well as production systems in industry, use one (or both) of these technologies to achieve the necessary properties for what is termed secure e-voting, and the related gold standard end-to-end verifiable voting.

        Go Back
        Blog

        Homomorphic vs Mixnet Based E-voting

        Blog, Research
          Add a header to begin generating the table of contents

          Although proposals have been made using other techniques, most common modern approaches to constructing secure voting systems can be divided into two categories: those based on homomorphic tallying (shorthand “homomorphic systems”) and those based on verifiable mixnets (shortand “mixnet systems”). Most systems, both prototypes in academia as well as production systems in industry, use one (or both) of these technologies to achieve the necessary properties for what is termed secure e-voting, and the related gold standard end-to-end verifiable voting.

          In this post we briefly describe the two approaches and then offer a qualitative pros & cons comparison of the two for aspects we have found significant in our experience evaluating and operating such systems. Given that Sequent’s voting system uses a mixnet as its core, it is unsurprising that our conclusion following the below comparisons leans in favour of that choice when building a secure voting system. However, at Sequent we’re open to the possibility of adding a homomorphic backend to our platform if careful analysis suggests it is desirable for particular use cases that may arise.

          Homomorphic tallying

          Voting systems based on homomorphic tallying exploit the homomorphic property of the underlying encryption to compute tallies. This homomorphic property makes it possible to add encrypted numbers together without decrypting them. The beauty of applying this technique to voting lies in the fact that when computing an election result we do not need to decrypt individual votes, only their sum, so that the secrecy of an individual’s ballot is preserved. 

          Unfortunately some technicalities have to be solved. We need a way to encode voter selections in a way that is amenable to this type of summing. This usually amounts to constructing vectors of ciphertexts for which a 1 represents a marked option on the ballot while a 0 represents an unmarked one, and then summing these vectors component-wise. In addition, because we only decrypt sums we also need a way to ensure that these encryptions represent valid choices. Not only because ballots could be nonsensical, but they could also be constructed maliciously to grant a voter more power than they ought to have. Preventing such cases is accomplished using zero knowledge proofs: using that technique we still don’t learn the contents of individual ballots but we are assured that they are valid. 

          You can learn more about the technical details of homomorphic tallying from any of the existing proposals featuring it in the literature, a prominent example is ElectionGuard.

          Verifiable mixnets

          Unlike homomorphic tallying, systems based on verifiable mixnets do decrypt individual ballots, but they do this after a process of anonymization which breaks the link between an encrypted ballot and the voter that cast it. The anonymization process amounts to a  shuffling of a set of ballots such that the output set cannot be correlated with the input. The central problem that a verifiable mixnet solves is that of performing this shuffle while still ensuring that the output of that process corresponds to what went in, in other words, no manipulation took place. This is where, as above, zero knowledge proofs enter the picture, ensuring that the shuffling is correct while revealing no other information.

          (A mixnet with three nodes, taken from here)

          Verifiable mixnets come in different flavours, one example (we use at Sequent) is that of re-encryption mixnets. These implement the shuffle by permuting and re-encrypting the input ciphertexts such that the result is a shuffled set of ciphertexts that are equivalent but cannot be correlated with the input. Of course, whoever performs this shuffle does know the correspondence, but that’s where the “net” part of mixnet comes in. If this process is repeated by several independent parties, none of them will be able to trace the path of any ciphertext through the mix network: this will only be possible if all the independent parties pool their information together. So in effect, a mixnet implements a distribution of trust for the secrecy of the ballot, a recurring theme for secure voting systems.

          You can learn more about all the technical details that we use at Sequent in these papers, and of course directly looking at our source code repository.

          Comparison

          Given this short description of the two techniques let’s take a look at some pros and cons of each for e-voting. We have divided the comparison into sections that are significant in our experience, in alphabetical order.

          Generality

          By generality we mean the degree to which the underlying cryptographic protocol can support a wide range of election and ballot types. Starting from the simplest election type, one which poses a yes/no question to voters, election and ballot types can increase in complexity up to schemes involving, for example, choosing one or more out of several choices, ordering of choices, scoring choices numerically, or even write-ins where voters can outright fill in a previously unspecified choice. 

          Generality is probably the axis along which homomorphic vs mixnet based voting systems differ most. As we mentioned before, a homomorphic tally system needs to convert voter’s ballots into suitable ciphertexts that can be summed exploiting the scheme’s homomorphic property. Unfortunately, beyond the case of choosing n-out-of-k options, this rules out the more complex examples we mentioned. Mixnets on the other hand can handle arbitrary ballot types, provided the ciphertext is sufficiently large to capture the ballot information. This makes generality a strong advantage of mixnet systems over homomorphic ones.

          Implementation complexity

          This category refers to the complexity of the software that makes up the voting systems. Absent other considerations, a higher implementation complexity is a negative factor in our comparison. One immediate reason is the higher difficulty in developing and maintaining the software that makes up the system. More importantly, a more complex implementation is more vulnerable to implementation errors and is harder to secure against both random errors and adversarial attacks.

          In terms of total implementation complexity it is probably fair to say that a homomorphic system is less complex and wins out in this category. But this result leaves out important details as to where the complexity lies. Whereas mixnet systems pay a high complexity cost for the development of the shuffling and its proofs, homomorphic systems pay most of their complexity cost in ensuring that cast ballots are correctly constructed. This difference is a reflection of a key difference between the two. Homomorphic systems do not decrypt individual ballots and rely on complex proofs to certify that said ballots are valid. Mixnet systems however do decrypt after anonymization, so it is trivial in that case to remove invalid or maliciously constructed ballots.

          The consequence of this difference is that homomorphic systems pay a large fraction of their complexity cost on the client where complex proofs must be constructed, and less so on the backend where the tally is more straightforward. Mixnets have the opposite complexity layout, the shuffle and tallying software is sophisticated, whereas the client is relatively simple. It could be argued that complexity on the client side is more problematic, since it is deployed in an uncontrolled environment, the user’s device, and is subject to greater degree of heterogeneity and uncertainty. Conversely, the backend runs in a controlled environment, the systems that specialised entities must run as trustees. In spite of this, we maintain that homomorphic systems come out ahead with respect to implementation complexity.

          Performance

          The discussion here draws parallels with the previous section, but replacing implementation complexity with computational complexity. Specifically, a homomorphic system requires more computation on the client side and less so on the backend. This occurs because these systems typically encrypt each possible selection with a ciphertext, resulting in vectors of ciphertexts that grow with the number of options presented to the voter. On top of this, zero knowledge proofs must be constructed for each of these encryptions. Both the encryption and the zero knowledge proofs add computational cost, a computation that takes place in the voter’s client which is limited in performance. On the other hand, once the ballots have reached the backend the necessary computation to verify them and perform the homomorphic sum is reduced, relative to the hardware characteristics available in a server environment..

          Mixnet systems have the opposite layout. Ballot selections can usually be encoded into a single ciphertext, and proofs of validity are not essential as ciphertexts are decrypted after anonymization. However, the process of anonymization, the shuffle, is computationally intensive and grows in complexity the higher the degree of trust distribution is required. Depending on the techniques used, the size of the electorate and the hardware involved a tally can take up to hours in the worst cases.

          Both homomorphic and mixnet based systems may encounter situations which make it a suboptimal choice. But while it is difficult to remedy cases in which client devices cannot be expected to compute large numbers of ciphertexts and proofs, it is usually easier to “throw hardware at the problem” on the backend. For this reason mixnets are more robust to demanding performance scenarios. However, when they can be applied, homomorphic systems show significantly better performance than mixnet systems in general. 

          Privacy

          There are different degrees to which a voting system can be said to achieve privacy. The most common and basic requirement is ballot secrecy: the voting system does not reveal who voted for what. There are stronger notions of privacy such as receipt-freeness, where the voter cannot prove how they voted, and coercion resistance where the voter is able to cast their chosen vote even under the influence of a coercer.

          Homomorphic and mixnet based e-voting systems have been the subject of academic research for decades in an attempt to satisfy these requirements. While many proposals exist that achieve ballot secrecy, receipt-freeness and coercion resistance are still an open problem. Our comparison with respect to privacy is then limited to ballot secrecy.

          If constructed correctly (including choices for security parameters), and modulo implementation complexity aspects, both types of systems offer comparable ballot secrecy using cryptography that relies on well known hardness assumptions. In fact, in prominent instances of protocols of both kinds there is overlap in the cryptographic techniques with identical security properties, as is the case for example when using the ElGamal cryptosystem.

          There are some considerations that escape a binary definition of ballot secrecy. One could argue that the tally counts are a form of leakage since they reveal more information than strictly the final result itself, a concern addressed by research into tally-hiding schemes. But this is true for both types of systems; homomorphic e-voting systems are not fully homomorphic, and are unable to perform arbitrary computations in ciphertext space to yield leak free results. In summary, we consider homomorphic and mixnet systems to be comparable with respect to privacy.

          Verifiability

          The gold standard for secure voting systems is end-to-end verifiability. A system is end-to-end verifiable if it is possible to certify that each of the key operations that make up an election (ballot casting, ballot recording and ballot counting) have been executed correctly. The question then becomes about whether homomorphic and mixnet systems can satisfy the requirements that make a system end-to-end verifiable.

          Again, homomorphic and mixnet based e-voting systems have been the subject of academic research to satisfy these requirements. Within the category of end-to-end verifiability, there exist different proposals as to how each step of the verification takes place. One notable step is cast-as-intended verification, for which adequate usability is still an open problem. But whatever mechanisms are chosen to perform these verifications, they are generally equally applicable to both homomorphic and mixnet systems.

          We can say that, if constructed correctly, both types of systems achieve comparable levels of verifiability;  there are many examples of both types in the academic literature on end-to-end verifiable systems. Helios in particular is a system that has been proposed in both homomorphic and mixnet variants. In summary, we consider homomorphic and mixnet based systems to be comparable with respect to verifiability.

          Conclusion

          One would think that the conclusion of our qualitative comparison between homomorphic and mixnet based systems would favour the former, given that it edges out its mixnet counterpart in more of the categories above. However, this advantage only manifests in the concrete cases where homomorphic systems can be applied at all. In contrast, mixnets can handle a much wider range of scenarios, albeit at a higher complexity cost. If one requires a system for a particular use case which does not rule out homomorphic based systems, they are better. But if one wants a future proof system that can be relied upon in general, mixnets are a better choice.

          The post Homomorphic vs Mixnet Based E-voting appeared first on Sequent.

          ]]>                     Uncertainty, Cryptography and Information /research/uncertainty-cryptography-and-information/ Wed, 07 Dec 2022 05:46:27 +0000 /?p=2001 This post will discuss three types of uncertainty and how they can be used to understand cryptography. According to Wikipedia, uncertainty refers to an incomplete and/or unknown piece of information. A prediction is an estimate of what will occur in the future, an estimate of what has already been measured or an estimate of what is […]

          The post Uncertainty, Cryptography and Information appeared first on Sequent.

          ]]>

          This post will discuss three types of uncertainty and how they can be used to understand cryptography. According to Wikipedia, uncertainty refers to an incomplete and/or unknown piece of information. A prediction is an estimate of what will occur in the future, an estimate of what has already been measured or an estimate of what is yet to be measured.

          Go Back
          Blog

          Uncertainty, Cryptography and Information

          Blog, Research
            Add a header to begin generating the table of contents

            This post will discuss three types of uncertainty and how they can be used to understand cryptography. According to Wikipedia, uncertainty refers to an incomplete and/or unknown piece of information.

            A prediction is an estimate of what will occur in the future, an estimate of what has already been measured or an estimate of what is yet to be measured.

            Here, we need to consider two main concepts: information and knowledge. Uncertainty can be defined as a lack of information or knowledge. As we’ll see, these two concepts are not equivalent and do not cover every situation. In order to understand uncertainty, we need to start at the strongest level.

            Ontological Uncertainty: Indeterminacy

            The Bloch sphere representing the state of a spin 1/2 particle.

            As described in quantum mechanics, certain particles (spin 1/2 particles like electrons) have a property called spin that gives two discrete results, called “spin up” and “spin down”. The equation below describes this.

            As a result, the probability of getting spin up equals α, and the probability of getting spin down equalsβ².

            If we were to measure the spin before we measured it, would it be up or down? The equation above, however, only gives us probabilities for what will happen when we measure. We might ask ourselves, before we measure it, is the spin up or down? But the equation above only gives us probabilities of what will happen when we make the measurement.

            According to mainstream interpretations of quantum mechanics, we cannot know what the spin value was before the measurement. Furthermore, it is impossible to predict what the measurement will reveal before it occurs. Our question requires information that presently doesn’t exist.

            As a result of this intrinsic indeterminacy, we use the term ontological uncertainty: uncertainty is not a property of knowledge, but one of nature. Our confusion results from an ontological mismatch between nature and our models of it. This type of uncertainty can be summarized as follows:

            We cannot know the information because it does not exist.

            As a side note, the Heisenberg uncertainty principle is not very well named, since it is similar to the subject of the next section. The indeterminacy principle would be a better name.

            Information Deficit: Epistemic Uncertainty

            We began with the strongest and strangest form of uncertainty. The second type is encountered when dealing with incomplete information every day. Unlike the previous type of uncertainty, this uncertainty is a property of our state of knowledge, not of nature. For example, when we ask what caused dinosaur extinction, we are referring to a fact about reality, no matter how accessible it may be. In poker, when we wonder whether we have the best hand, we are referring to an unknown but existing fact, the set of all hands dealt.

            In fields such as information theory, probability, and thermodynamics, uncertainty is treated as incomplete information. The technical term is entropy, and it’s measured in bits. If a description lacks a lot of information, it is said to have high entropy. In asking whether the coin will land heads or tails, we are missing one bit of information. Three bits are missing if we ask what number will come out of a fair 8-sided die. There are more possibilities in a die throw than in a coin flip, so there is a higher degree of uncertainty about the outcome. As a result, it has more entropy bits. This type of uncertainty can be summarized as follows:

            We do not know the information, but it exists.

            Before I finish, I would like to clarify a few things. Here’s the reason why the concept of randomness didn’t appear when discussing coin flips and die rolls. This section discusses classical physics, where phenomena are deterministic even if we don’t know all of the initial conditions. There is a combination of determinism and unknown initial conditions that underlies the use of randomness at the macroscale. Subjective randomness is sometimes used to distinguish it from intrinsic randomness, which is an alternative term for ontological uncertainty.

            A deterministic coin flipping machine

            The Third Type…

            Now for the interesting part. Imagine I have all the information about something, but I still don’t know everything about it. Sounds contradictory right? Here’s an example to illustrate this kind of situation.

            1. All men are mortal
            2. Socrates is a man

            If now somebody tells you that

            1. Socrates is mortal.

            Are they giving you any information? Hopefully it seems to you like they told you something you already knew. Was there any information prior to giving statement 3? Put differently, does statement 3 contain any information not present in 1,2?

            One of the 24 valid syllogism types

            Consider another example.

            1. x = 1051
            2. y = 3067
            3. x * y = 3223417

             

            In this case statement 3 tells us something we probably didn’t know. But does statement 3 contain information not present in 1 and 2? We can turn to definitions from information theory in order to provide an answer. Define three random variables (for convenience in some arbitrary range a-b)

            x ∈ {a-b}, y ∈ {a-b}, x*y {…}

            We can calculate the conditional entropy according to the standard equation which in our case gives

            H(x*y | x, y) = 0

            The conditional entropy of xy given x and y is zero. This is simply a technical way to say that given statements 1 and 2, statement 3 contains no extra information: whatever 3 tells us was already contained in 1,2. Once x and y are fixed, xy follows necessarily. This brings us back to the beginning of the post.

            We could say that uncertainty is lack of knowledge or even lack of information. As we’ll see, these two ideas are not equivalent and cannot be applied to every situation.

            The two ideas differ now, as should be evident. In this case, we have all the information about something (x, y), but we do not know everything about it (x*y).

            Logical Uncertainty: Computation Deficit

            It is computation that bridges having all the information with having all the knowledge. In the Socrates syllogism, deducing (computing) the conclusion from the premises adds no information. A calculation based on x and y does not produce an answer. Despite the fact that the information was always there, computation can tell us things we did not know.

            We are uncertain about the blanks, even though we have all the necessary information to fill them.

            The goal of computing is to derive implicit consequences from data. The distinction between deducing the conclusion of a simple syllogism and multiplying two large numbers is one of degree, not kind. There is a clear difference, however, in that without sufficient computation, we will remain uncertain about things that are already present. At the high end, there are cases such as Fermat’s last theorem, about which mathematicians have been unsure for 350 years. We conclude with a summary of logical uncertainty:

            We have all of the information, but there are logical consequences we are unaware of.

            Pierre de Fermat

            Cryptography: Secrecy and Uncertainty

            Cryptography (from Greek kryptós, “hidden, secret,” and v graphein, “writing”) is the practice and study of secure communication techniques in the presence of third parties known as adversaries.

            The key word here is “secret,” which should remind us of our uncertainty. To say that we want a message to remain secret from an adversary is to say that we want this adversary to be unsure about the message’s content. Although our first instinct would lead us to believe that epistemic uncertainty exists, this is not always the case.

            Consider the Caesar cipher, named after Julius Caesar, who used it over 2000 years ago. Each letter in the message is replaced by another letter obtained by shifting the alphabet a fixed number of places. This number of locations serves as the encryption key. For example, with a +3 shift

            abcdefghijklmnopqrstuvwxyz defghijklmnopqrstuvwxyzabc

            Let’s encrypt a message using this +3 key:

            cryptography is based on uncertainty fubswrjudskb lv edvhg rq xqfhuwdlqwb

            We hope that if our adversary obtains the encrypted message, he/she will not discover its secret, whereas our intended recipient, knowing the +3 shift key, can recover it by using the reverse procedure (-3 shift). When analyzing ciphers, we assume that our adversary will intercept our messages and will also know the procedure, if not the key (in this case +3) used to encrypt them. Assume we are the adversary and capture this encrypted message using these assumptions:

            govv nyxo iye rkfo pyexn dro combod

            We want to know the secret, but we don’t know what key shift value it is. However, because the alphabet has 26 characters, there are only 25 possible shifts; a shift of 26 leaves the message unchanged. So, why not try all of the keys and see what happens:

            FNUU MXWN HXD QJEN OXDWM CQN BNLANC EMTT LWVM GWC PIDM NWCVL BPM AMKZMB DLSS KVUL FVB OHCL MVBUK AOL ZLJYLA CKRR JUTK EUA NGBK LUATJ ZNK YKIXKZ BJQQ ITSJ DTZ MFAJ KTZSI YMJ XJHWJY AIPP HSRI CSY LEZI JSYRH XLI WIGVIX ZHOO GRQH BRX KDYH IRXQG WKH VHFUHW YGNN FQPG AQW JCXG HQWPF VJG UGETGV XFMM EPOF ZPV IBWF GPVOE UIF TFDSFU WELL DONE YOU HAVE FOUND THE SECRET VDKK CNMD XNT GZUD ENTMC SGD RDBQDS UCJJ BMLC WMS FYTC DMSLB RFC QCAPCR TBII ALKB VLR EXSB CLRKA QEB PBZOBQ SAHH ZKJA UKQ DWRA BKQJZ PDA OAYNAP RZGG YJIZ TJP CVQZ AJPIY OCZ NZXMZO QYFF XIHY SIO BUPY ZIOHX NBY MYWLYN PXEE WHGX RHN ATOX YHNGW MAX LXVKXM OWDD VGFW QGM ZSNW XGMFV LZW KWUJWL NVCC UFEV PFL YRMV WFLEU KYV JVTIVK MUBB TEDU OEK XQLU VEKDT JXU IUSHUJ LTAA SDCT NDJ WPKT UDJCS IWT HTRGTI KSZZ RCBS MCI VOJS TCIBR HVS GSQFSH JRYY QBAR LBH UNIR SBHAQ GUR FRPERG IQXX PAZQ KAG TMHQ RAGZP FTQ EQODQF HPWW OZYP JZF SLGP QZFYO ESP DPNCPE

            When we tried a key shift of +10, we discovered the secret. Take note of how we were able to isolate the correct message when none of the other attempts yielded meaningful results. This is due to the fact that the space of possible keys is so limited that only one of them decrypts to a possible message. Technically, the key space and message space[2] are small enough in comparison to the length of the message that only one key is required to decrypt it. In terms of uncertainty, the following inequality[3] expresses this:

            The left part of the expression, H(Key | Ciphertext), indicates how much uncertainty about the key remains once the encrypted message has been obtained. Take note of the term S(c), which represents the number of keys required to decrypt a meaningful message. As previously stated, S(c) = 1, resulting in H(K | C) = P(c) * log2 (1) = P(c) * 0 = 0.

            In other words, once we know the encrypted message, there is no uncertainty about the key, and thus the secret message[4]. Of course, when we first captured this,

            govv nyxo iye rkfo pyexn dro combod

            We didn’t know the secret, but we had all the information we needed to find out. We were only logically uncertain about the secret and required computation rather than information to discover it.

            Alberti’s cipher disk (1470)

            Although we have only seen this for the simple Caesar cipher, it turns out that, with a large enough message to encrypt, many ciphers have this property. This is true for public key ciphers, such as those used in many secure voting systems, regardless of message size. Because our adversaries have enough information to obtain the secret, we can say that practical cryptography is based on logical uncertainty. However, as previously demonstrated, there are various degrees of logical uncertainty. Cryptography is based on this uncertainty being “strong” enough to keep secrets safe.

            Talking about degrees of logical uncertainty leads us to computational complexity.

            Logical Uncertainty and Computational Complexity

            Computational complexity can be said to measure logical uncertainty in the same way that entropy measures epistemic uncertainty. In probability theory, we investigate how much information is required to eliminate epistemic uncertainty. Computational complexity is the amount of computation required to remove logical uncertainty. We saw that while deducing the conclusion of Socrates’ syllogism was simple, multiplying two large numbers was difficult. Complexity considers how difficult these problems are in comparison to one another. So, if we’re looking for the foundations of cryptography, we should start there.

            Consider the widely used RSA public key cryptosystem. This scheme is based on the computational difficulty of factoring large numbers, among other things. This situation can be represented by two statements, for example:

            • X=1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139
            • X=3797522793694367392280887275544562785456553663 199*40094690950920881030683735292761468389214899724061

             

            Statement 2 (the factors) is implied by statement 1, but obtaining 2 from 1 necessitates considerable computational effort. In practice, an adversary who intercepts a message encrypted with the RSA scheme will need so much computation to decrypt it that this possibility is labeled infeasible. Let’s be a little more specific. This means that an adversary will need thousands of years of computing time on a modern computer to complete the task using the fastest known algorithm.

            If the previous statement did not set off alarm bells, perhaps I should emphasize the words “well-known algorithm.” We know that using known algorithms is impossible, but what if a faster algorithm is discovered? You’d think complexity theory would have a solution for that hypothetical situation. The simple truth is that it does not.

            Problems for which efficient algorithms exist are classified as P in complexity theory. Although no efficient algorithm for integer factorization is known, whether it is in P or not is an open question[5]. In other words, we are logically unsure whether factorization occurs in P!

            Several complexity classes

            Assuming that integer factorization does not exist in P, a message encrypted with RSA is secure. To ensure an adversary’s logical uncertainty about secret messages, cryptographic techniques rely on assumptions that are the subject of logical uncertainty at the computational complexity level! Not what you want to find when looking for foundations.

            In Conclusion

            But it’s not all that bad. When you think about it, it’s not so much whether factorization and other problems are in P as it is whether adversaries will find the corresponding efficient algorithms. The condition that factorization is in P and that efficient algorithms are discovered secretly by adversaries is far more powerful than the first requirement alone. More importantly, the second condition appears to be one for which we can find some evidence.

            It is debatable whether or not evidence can be found for a logical statement. Is the fact that no one has proven that factorization is in P evidence that it isn’t? Some say yes, while others say no. However, it appears less controversial to assert that the fact that no algorithm has been discovered serves as evidence for the possibility that we (as a species with a given level of cognitive and scientific advancement) will not discover it in the near future.

            Several complexity classes

            The bottom line for cryptography’s foundations is a matter of both logical and epistemic uncertainty. On the one hand, questions about computational complexity belong in the realm of logic, and empirical evidence for this appears conceptually shaky. However, the practical aspects of cryptography are dependent not only on complexity issues, but also on our ability to solve them. Another point to consider is that computational complexity informs us about the difficulty of algorithms given specific computational primitives.

            However, the question of which primitives we have access to when developing computing devices is a matter of physics (as quantum computing illustrates). This means that we can use empirical evidence about the physical world to justify or refute confidence in cryptography’s security. Today, the ultimate foundations of cryptography are formed by the combination of computational complexity results and empirical evidence about the world.

            References

            [1] Along the x, y, or z axes

            [2] Without going into details, the message space is smaller than the set of all combinations of letters given that most of these combinations are meaningless. Meaningful messages are redundantly encoded.

            [3] http://www14.in.tum.de/konferenzen/Jass05/courses/1/papers/gruber_paper.pdf

            [4] The equation refers to the general case, but we can still use it to illustrate a particular case.

            [5] To be precise, it’s that and the more general question of whether P=NP.

            The post Uncertainty, Cryptography and Information appeared first on Sequent.

            ]]>