A vVote: a Verifiable Voting System

This paper details a design for end-to-end verifiable voting in the Australian state of Victoria, based on the Prêt à Voter end-to-end verifiable voting system [Ryan et al. 2009]. The system ran successfully in the state election in Victoria (Australia) in November 2014, taking a total of 1121 votes from supervised polling places inside Victoria and overseas. The proposed protocol is end-to-end verifiable, meaning that there are no human or electronic components which must be trusted for guaranteeing the integrity of the votes.2 There are probabilistic assumptions about the number of voters who confirm correct printing of some Prêt à Voter ballots, the number who check that their printout matches their intended vote, and the number who check that their receipt appears on the Web Bulletin Board (WBB). It also provides voters with evidence of malfeasance, assuming that they check the signature on their receipt before they leave the polling station. Since this is a polling-station scheme, we do not address eligibility verifiability. Prevention of ballot stuffing is by existing procedural mechanisms. Running an end-to-end verifiable protocol on a subset of the votes does not make the election result end-to-end verifiable, when that result depends on traditional paper processes that are not verifiable. Nevertheless we believe there are significant advantages to using an end-to-end verifiable electronic voting system for part of an election, and we consider that explanation to be a main contribution of this paper. The team involved in developing the vVote design described in this report were: Craig Burton, Chris Culnane, James Heather, Rui Joaquim, Peter Y. A. Ryan, Steve Schneider and Vanessa Teague.