Non-interactive Zero-Knowledge Arguments for Voting

1. Non-interactive Zero-Knowledge Arguments for Voting Jens Groth UCLA

2. Voting process Voters Authorities E(vote) + NIZK argument + signature  E(vote) + NIZK argument + signature  ... Check signatures Check NIZK arguments Multi-party computation  Result

3. Encryption Homomorphic property E(m1+m2) = E(m1) * E(m2) Threshold property t authorities can decrypt t-1 authorities cannot decrypt

4. Single vote elections Candidates 0, 1, ..., L-1 M > # voters Encoding M0, M1, ..., ML-1 Encrypted votes E(M2), E(M1), E(M2), ... Authorities Ek = E(M2) E(M1) E(M2) ... = E(M2+M1+M2+...) = E(viMi) Threshold decrypt  viMi  Result

5. Contributions • Many types of elections- Single vote- Limited vote (each voter N votes)- Shareholder election (each voter Nk votes)- Approval voting (each voter up to L votes)- Borda voting (preferential vote) • Efficient NIZK arguments- random oracle model

6. Encoding votes Voter k ivikMi Single vote vik = 0,1 andivik = 1 Limited vote vik = 0,1 andivik = N Approval vote vik = 0,1andivik ≤ L Shareholder vote vik ≥ 0andivik = Nk Borda vote vik = πk(i+1) for permutationπk

7. Tallying Encrypted vote E(ivikMi) M > # votes receivable Product kEk = kE(ivikMi) = E(kivikMi) = E(i(kvik)Mi) = E(iviMi) Threshold decryption viMi vi = # votes on candidate i

8. Homomorphic integer commitment Homomorphiccommit(m1+m2) = commit(m1) commit(m2) Message space Z Unique prime factorization

9. -protocols Statement E = E(v;r) contains a valid vote Voter (v,r) Authorities a c z Fiat-Shamir heuristic c = hash(E,a,ID) Random oracle model: NIZK argument

10. NIZK arguments Equivalence E = E(a) a = b c = commit(b) Multiplication ca = commit(a) cb = commit(b) c = ab cc = commit(c) Square ca = commit(a) b = a2 cb = commit(b) Divisor ca = commit(a) a|b cb = commit(b)

11. Single vote Encrypted vote E = E(Mi) M = p2, p prime NIZK argument ca = commit(pi) Divisor NIZK (ca, commit(pL-1;0)) a|pL-1 cb = commit(Mi)  Square NIZK (ca, cb) a2 = p2i Equivalence NIZK (E, cb) for 0≤i<L

12. Limited vote Encrypted vote M = p2 E = E(Mij) 0 ≤ i1 <...< iN <L NIZK argument caj = commit(pij), caN+1 = commit(pL;0) Divisor NIZK (cajp, caj+1) pa1|a2,...,paN|pL cbj = commit(Mij)  Square NIZK (caj, cbj) aj2 = Mij Equivalence NIZK(E, cbj) 0≤i1<...<iN<L

13. Approval vote Encrypted vote E = E(aiMi) ai = 0,1 NIZK argument cai = commit(ai) Square NIZK (cai, cai) ai2 = ai ai = 0,1 Equivalence NIZK (E, caiMi) aiMi

14. Non-negativity Commitment c = commit(m) m ≥ 0 Idea 4m+1 = x2 + y2 + z2 NIZK argument cx = commit(x) cx2 = commit(x2) cy = commit(y) cy2 = commit(y2) cz = commit(z) cz2 = commit(z2) Square NIZKs (cx, cx2) (cy, cy2) (cz, cz2) Equivalence NIZK (c4 commit(1;0), cx2 cy2 cz2)

15. Shareholder vote Encrypted vote E = E(aiMi) ai ≥ 0 and ai = N NIZK argument cai = commit(ai) Non-negative NIZK (cai) ai ≥ 0 Equivalence NIZK (commit(N;0), cai) ai = N Equivalence NIZK (E, caiMi) aiMi

16. Borda vote Encrypted vote E = E(aiMi-1) ai = π(i) NIZK argument cai = commit(ai) Known shuffle NIZK (1, 2, ..., L, ca1, ..., caL) commitments contain 1, 2, ..., L permuted Equivalence NIZK (E, caiMi-1) aiMi-1

17. Comparison Non-negative NIZK 4m+1 = x2 + y2 + z2