Skip to content

Election verifier

Jump to bottom
David Ruescas edited this page Oct 10, 2023 · 1 revision

Sequent Election Verifier

Original source

The election verifier analyzes the data published in an election to enable universal verifiability. In end-to-end verifiability terms, the election verifier covers the recorded-as-cast and counted-as-recorded properties.

Counted-as-recorded verification

This verification takes as input the trustee verification keys, the ballot ciphertexts input to the system and the plaintexts output by the system. The verification passes only if it can be proven that the plaintexts are exactly the result of the correct decryption of a set of ciphertexts that is equivalent to the input set of ciphertexts. Note

  • Two sets of ciphertexts are equivalent if they contain equivalent ciphertexts.
  • Two ciphertexts are equivalent if they encode the same plaintexts, irrespective of randomness.
  • Correct decryption is defined with respect to the trustee verification keys.

Given Sequent’s use of a mixnet verification translates to:

  1. The ballot ciphertexts are the input to the first link in the mixing chain.
  2. The proof of shuffle for each link in the mixing chain verifies.
  3. The ciphertexts in the last link of the mixing chain correspond to the ciphertexts input to decryption.
  4. The proof of decryption linking the decryption factors to the input ciphertexts verifies with respect to the trustee verification keys.
  5. The combination of decryption factors matches the plaintexts.

Recorded-as-cast verification

This verification takes as input an individual ballot hash and the ballot ciphertexts input to the system. The verification passes only if a ciphertext exists in the ballot ciphertexts whose hash is equal to the input ballot hash.

“Counted-as-cast” verification

This verification combines the two verifications above, taking as input an individual ballot hash, the trustee verification keys, the ballot ciphertexts input to the system and the plaintexts output by the system. The verification passes only if both the above verifications pass; this guarantees that the specified ballot was included in the correctly counted result.

Verifier implementation

The election verifier implements concrete checks that in combination support the verification objectives above. Additional consistency checks are also performed to detect deviations from expected behavior.

Root checks

These are checks that are made for the session as a whole, and not individual tallying batches.

  1. CONFIGURATION_VALID

This check verifies that the election configuration artifact is valid:

  • The number of trustees ranges from 2 to 12 (crate::protocol2::MAX_TRUSTEES).
  • The threshold ranges from 2 to the number of trustees.
  • There are no duplicate trustees.
  1. MESSAGE_SIGNATURES_VALID

All message signatures verify, with respect to their specified sender public key present in the configuration referenced in 4.2.

  1. MESSAGES_CFG_VALID

All messages refer to the same configuration referenced in 4.2.

  1. PK_VALID
  • The public key has been correctly constructed.
  • The trustee verification keys have been correctly constructed.
  • All trustees have signed the public key statement, which asserts correctness of private shares (VSS).

Per batch checks

The following checks will be made for each tallying batch.

  1. BALLOTS_PK_VALID
  • The ballots artifact message signature verifies with respect to the protocol manager’s public key.
  • The message includes the hash of the ballot ciphertexts and the hash of the public key checked by 4.
  1. MIX_START_VALID

The first link in the mixing chain takes the ballots referenced in 5 as input.

  1. MIX_END_VALID

The last link in the mixing chain outputs the ciphertexts input to decryption referenced in 10.

  1. MIX_VALID
  • The proof of shuffle for each link in the chain verifies.
  • The number of links in the mixing chain is equal to the threshold specified in the configuration referenced in 1.
  1. MIX_UNIQUE_VALID

Each of the links in the mixing chain was produced by a different trustee.

  1. DECRYPTION_VALID

The proof of decryption linking the decryption ciphertexts to the decryption factors verifies with respect to the public key information referenced in 4, 5.

  1. PLAINTEXTS_VALID

The combination of decryption factors referenced in 10 matches the published plaintexts.

Running the election verifier

Usage: verify [OPTIONS] --server-url <SERVER_URL> --board <BOARD>

Options:
      --server-url <SERVER_URL>    URL of the bulletin board server
      --board <BOARD>              Name of the board to audit
      --ballot-hash <BALLOT_HASH>  Checks inclusion of the given ballot
  -h, --help                       Print help

The --board, --server-url parameters are required. If the --ballot-hash parameter is present the verifier will run counted-as-cast verification. Otherwise counted-as-recorded verification will be run.

The verifier will output progress messages and a summary at the end of the run.

Clone this wiki locally