The ballot encoding and tally are based on Shamir (1979) ( j , d )-secret sharing work. In this scheme a secret C is shared among j participants, but it can only be retrieved if d + 1 participants collaborate. To share the secret, a polynomial q ( x ) encodes the secret as its independent term, with randomly chosen coefficients a d ⋯ a 1 . A set P of random points of q ( x ) are used as pieces, distributed among the participants (Equation (1)) (1) q ( x ) = a d x d + ⋯ + a 1 x + C mod p , P = ⟨ ( x 1 , q ( x 1 ) ) , … , ( x d + 1 , q ( x d + 1 ) ) ⟩ . To recover C, d + 1 points are used to interpolate the polynomial of modulo prime p, for example, with the Lagrange (1795) interpolation method, where l i is the Lagrange Basis Polynomial: (2) q ( x ) = ∑ i = 0 d + 1 q ( x i ) l i ( x ) , l i ( x ) = ∏ k = 0 , k ≠ i d + 1 x − x k x i − x k .

The protocol uses blind signatures as introduced by Chaum (1983). In the scheme, a provider applies a blind function to some data and sends it to the signer. Both the blind and the corresponding unblind functions are only known for the provider, and the blind output does not leak any information about the data contained. When the signer receives the blinded data, it signs it and sends it back to the data provider. The sign function needs a corresponding verify function, without the need of sharing the key used for signing. The provider can then apply the unblind function and obtain the signature of the original data, thanks to the commutative property of the signing and blinding methods.

The blind signature scheme provides untraceability: it is not possible to link signed data with the blind data it comes from. The three methods that implement blind signatures are Blind, Sign and Unblind, with s k, p k the corresponding secret and public key of the signer. The methods, as implemented using RSA, are defined as follows: (3) Blind ( data , mask p k ) = data · mask p k mod n , (4) Sign s k ( data · mask p k ) = Sign s k ( data ) · Sign s k ( mask p k ) mod n , = Sign s k ( data ) · mask mod n , (5) Unblind ( Sign s k ( data · mask p k ) ) = Sign s k ( data ) · mask · mask − 1 mod n , = Sign s k ( data ) mod n .

For simplicity, we explain the workflow of the protocol using RSA blind signatures, which generates blind signatures using its partial homomorphic properties under modular exponentiation (Hwang et al., 2003). However, any blind signature scheme such as Pointcheval and Sanders (2016) can be used in its place without affecting the workflow of the protocol, only modifying how the Blind, Unblind and Verify methods are implemented.

The concept of dispute is stated by Basin in 2020 as “when a voter claims that the voting authority is dishonest and did not correctly process his ballot while the authority claims to have followed the protocol”. Basin et al. distinguish between universal and individual verifiability to detect relevant disputes in electronic voting. Universal verifiability properties can be ensured only with access to public data (e.g. PBB). They claim that universal verifiable properties do not lead to disputes because any voter or third party with access to the PBB can audit the property. However, individual verifiability describes properties that only the voter can check, because she is the only one who knows which ballot has been cast, as well as some other private data. This characteristic leads to the occurrence of disputes. On the one hand, voters are able to detect problems with their ballots but may not be able to prove it to others. On the other hand, voters can accuse an honest authority of misbehaving, which may not be able to prove its honesty. Basin et al. (see Table 1) also identify three problems related to individual verifiability: 1.

The voter is blocked from casting the ballot. The reasons can be technical or social. This is connected with voter suppression and disenfranchisement in traditional elections. Despite defined, this dispute was left out of the scope by the authors.

Although related to accountability, dispute resolution is a stronger requirement, since it requires unambiguity. In other terms, dispute resolution eliminates the need for a trusted authority acting as a judge. Any honest third party would act as such using the protocol execution and the data in the PBB.

However, different protocols consider different notions of accountability. In Basin et al. (2020), the definition of dispute resolution only includes partial accountability: for a protocol with multiple parties, it is enough to detect that a party misbehaved, but not which one. In the case of Themis, they improve the accountability guarantees by trying to identify which exact party misbehaved. However, for some cases Themis is only able to narrow down the blame to a set of parties, achieving partial accountability. Our proposed protocol DiReCT, is designed to provide individual accountability, as shown in the security analysis in Section 6.

The entities involved in the proposed voting protocol are: the voters; the voting authority (VA); the k parties; and, a Public Bulletin Board (PBB). •

The voters are the members of the census.

Based on the previous definition of entities and their roles, we compile here the security assumptions of the protocol. We compiled them as a list to make it clear and cite on the protocol if needed: SA1

Every voter v has a certificate and the corresponding signing key obtained from the census.

Aumann and Lindell (2010) formalized covert adversaries as a type of adversary which “faithfully models the adversarial behaviour in many commercial, political, and social settings”. In terms of the adversary capability assumptions, covert adversaries are between an HbC, who follows the protocol and only targets the privacy, and a fully malicious adversary, with unlimited resources and no restraints. SA3

There is a conflict of interest between the parties, such as being competing candidates during the election.

This subsection describes a compact list of the desired properties of the protocol and common definitions.

Verifiability in e-voting has different approaches depending on the author. In this paper, we follow the strict definitions of verifiability from Moran and Naor (2010), Bougon et al. (2022), but divide it into individual, universal and elegibility verifiability, as defined by Kremer et al. (2010).

Individual verifiability is defined as the voters ability to check that their ballot is recorded as cast (2010) and that the ballot content did not change, known as cast as intended or CaI (2010).

The universal verifiability property ensures that anyone (voters and external auditors) can verify that the results of the elections align with the cast ballots (counted-as-cast) (Kremer et al., 2010; Moran and Naor, 2010; Bougon et al., 2022). Eligibility verifiability ensures that only ballots from registered voters are counted, with at most one ballot per voter (Kremer et al., 2010; Bougon et al., 2022).

Attacks performed by covert adversaries are also known as covert attacks. However, this term is also used to refer to attacks that cannot be detected. In our protocol, we use surreptitious attacks to distinguish attacks where the origin cannot be proved.

Vote suppression happens when the voting authority prevents some eligible voters from participating in the elections. Denial of Casting (DoC) is an equivalent attack where the voters ballot casting is blocked by an authority.

Timeliness, as defined by Basin et al. (2020), guarantees that a voter possess the evidence to resolve disputes no later than the election’s end. We increase the granularity of the timeliness definition by applying it to three specific steps in the protocol: T Cert for the VA to respond to a ballot certification request; T Cast for the parties to respond to a ballot casting; and, T Tally for the parties to make public their shares during the tally. After performing the certification, cast, or after the tally starts, the election has set a specific window of time the process can last. Setting those timeouts allows the voter to detect the issue and resolve the dispute. Time constraints, such as the end of the voting period or how long does the voter need to wait for a response, are implicit parameters in the protocol specification. Still, in protocols such as Bougon et al. (2022), it is expected that the voter needs to wait for a response and can raise an issue otherwise. Note that the protocol does not rely on the synchronization of different entities to ensure its security guarantees. Timeouts serve only as upper limits on the expected processing time for various requests and can be set generously to accommodate potential timing differences. For instance, if the processing time for a request typically ranges from less than a minute to 5 minutes, setting a timeout of 15 minutes ensures that a missing response is clearly detectable while also accounting for synchronization differences of several minutes.

The preparation phase is divided into: the identity provision, where voters get credentials to participate in the election; and the system setup, where the election parameters are decided.

In the voting phase voters participate in the election. It starts with the voter crafting the ballot, encoding their vote direction and producing the ballot shares. It follows the ballot certification, where the VA blindly signs the ballots and shares from valid voters in the census. The phase finishes with the casting, where the voters send their shares to the parties to be counted during the tally. Figure 1 depicts a simplified version of the process.

Once the voting finishes, the tally phase starts, with the parties sending the shares to the PBB:tally: (16) Tally ( party i → PBB ) : = party i , ⟨ SP i , H-SP i , SBallot ⟩ , T 4 .

To reconstruct the ballot, first the parties need to collect the shares with an identical SBallot. With all the shares, each party can sort them and reconstruct the original P, as seen in Equation (6). With P it is straightforward to obtain the original polynomial q ( x ), for example using Lagrange’s polynomials (see Equation (2)). The direction of vote can then be obtained from q ( x ) by obtaining the independent term C = q ( 0 ) mod p.

Dispute resolution (Section 3.1) is a key contribution of this paper. Introduced by Basin et al. (2020), in their work the authors identify two disputes regarding individual verifiability: claims for unrecorded ballots (D1); and claims for uncast recorded ballots (D2).

We adapt these definitions to DiReCT without affecting their meaning. D1 is included as DTally, although in DiReCT the recorded ballots can be universally verified (recorded as cast). D2 does not apply as is to DiReCT, instead we consider a more general attack where an authority falsifies ballots (ballot stuffing), and prove that the dispute is not possible in DiReCT. Furthermore, this paper introduces two new disputes. The first one, DCert, is a dispute related to vote suppression, where the voter is blocked from the authentication and ballot certification. The second one, DCast, is a dispute related to denial of casting (DoC), where the voter is blocked from verifying the ballot casting.

The behaviour of a trusted VA during the ballot certification is modelled by the ideal functionality F Cert . F CertObs ensures that any voter with valid credentials obtains a signed ballot within a given time T Cert . It uses the public bulletin board PBB to log public message exchanges. The adversary can read the information but cannot block access to it, and only can post by corrupting an entity with access. The PBB provides integrity and non-repudiation: the content posted cannot be altered by the adversary and it’s origin is unambiguous. Posted messages include the entity, the content and a timestamp (Section 4.1).

The ideal functionality or honest VA only knows that BBallot is a list of k + 1 bit strings, since it has been blinded. In the case of an honest voter, BBallot corresponds to the ballot and shares commitments (Equation (8)).

We define a second ideal functionality F CertObs , which models the universal verification of the Ballot Certification within a time frame T Cert (by any external auditor, party or voter). F CertObs outputs a 1 if the certification is performed on time, 0 otherwise.

The DCert vote suppression dispute is linked with two attacks: a malicious VA blocking honest voters (vote suppression); and a malicious voter claiming a vote suppression from an honest VA (false suppression claim).

In the vote suppression attack, the real world adversary M corrupts the VA. Since voters reveal their identity to the VA, the adversary can selectively block honest voters from ballot certification.

To accomplish the dispute resolution in case of vote suppression, any third party should be able to detect the attack. Framing it in terms of a covert adversary, it is not possible for the adversary to perform the vote suppression surreptitiously. This is analogous to prove that in the hybrid protocol where the vote suppression is performed, the adversary cannot modify the behaviour of the ideal functionality F CertObs , which always outputs a 0.

The ideal functionality F CertObs can be translated to the real world behaviour by any third party with access to the PBB. This is what allows us to translate the hybrid protocol proof from Theorem 1 to the real world.

A voter corrupted by M can pose a false suppression claim at an honest VA.

In order F CertObs to output 0, as universally verifiable evidence of the suppression of the ballot certification request. Theorem 2 proves how this false claim is not possible.

Theorems 1 and 2 results permit successful dispute resolutions for DCert.

The ideal functionality F Cast models an honest party in the casting phase. Validates a ballot share of a voter and posts a receipt in a public log within time T Cast .

It is assumed that T Cast is chosen based on the infrastructure and election’s size. Also, in the worst case scenario, the posting will happen right before the tally starts.

We define a second ideal functionality F CastObs , which models how an honest voter can verify that the casting has been performed within a time frame T Cast . F CastObs outputs 1 if the casting is performed on time, 0 otherwise.

Cast verification dispute (DCast).  The second dispute we consider affects the voter’s verification of her ballot casting (DCast). Given that the communication between the voter and the parties is not public, the adversary may attempt an attack without being identified (covert adversary). Two attacks can cause the dispute: a malicious party blocking some honest voters (Denial of Cast or DoC); and a malicious voter claiming being denied by an honest party (false DoC claim).

The DoC hybrid protocol summarizes how the adversary can avoid confirming the casting to the user. Theorem 3 proves that DoC is not possible in DiReCT.

We prove in Theorem 4 that every user can verify her casting before the tally.

The recovery process F Rec is defined based on the result of Theorem 4, and proved in Theorem 5.

Recovery depends on at least one party participating in the casting SA4. This is included as a security assumption for the sake of completeness. However, it is reasonable to assume that among all the candidates of the elections, there is at least a party that is willing to complete the process. Note that the party can still behave as a covert adversary. In addition, DoC is performed without knowing the identity of the voter or the content of the ballot. Thus there is little incentive for all the parties to perform the DoC other than to disrupt the elections.

Note that the recovery mechanism, where voters may send their shares again to a different party, does not imply any linkability risk. The transmission is private (SA7), and the content received by the party cannot be linked to the voter, independently of the amount of shares a party receives.

The dispute resolution of DCast relies on honest voters performing the recovery. In other words, in case of blocking, the voter does not have evidence to prove the block to a third party. This is the reason why DiReCT dismisses all claims in the denial of casting. The dispute resolution is achieved by combining this dismissal with the fact that voters can always detect and recover from the blocking (Theorem 5).

We define two ideal functionalities related to the tally. F TallyObs represents the record-as-cast universal verifiability. Given a ballot that has been correctly cast with the corresponding public receipt ( F CastObs ( Casting j ) with output 1), any entity with only access to the log can verify the tally. The function aborts if not enough receipts were issued to reconstruct the vote. It outputs ( 0 , NotSharing , [ party x ] ) with the parties that did not publish a share that had a cast receipt, or (0, ShareNotFromReceipt, [ party x ]) if the share was not correct. (0, ShareNotFromP) if the shares pass all the checks but they do not account for the ballot, and ( 1 , SBallot j , vote j ) if the tally is successful and it is possible to retrieve the vote.

F Tally models the behaviour of an honest party during the tally. Only shares with the corresponding receipts ( F Tally output 1) are considered. It considers F TallyObs and outputs 1 when the tally is correct, 0 if there is an intentional problem, or abort if not enough shares have been cast.

The DTally dispute arises when a ballot is not recorded. Theorem 5 proved that the user can recover from cast-blocking. This subsection is built on top of that result, leaving to the adversary the only option to block the recording of the ballot during the tally. The dispute resolution is composed by two attacks: the interception of the ballot by the adversary (blind and selective tally interception); and a corrupt voter false claim (false tally interception claim).

In the random tally interception the adversary’s goal is to randomly block some ballots from being counted with plausible deniability.

In the selective tally interception, the adversary’s goal is to learn the vote direction of a share in order to block it, instead of blindly blocking some ballots from the tally.

We prove that DiReCT is robust against blind (Theorem 6) and selective (Theorem 7) tally interception.

By combining the previous results, Corollary 8 demonstrates the record-as-cast property in the protocol.

The following ideal functionality F Vote models an honest voter performing all the steps to vote in DiReCT. It interacts with the public log, k casting authorities [ A i ] i = 1 k , F CertObs and F Rec . The definition F Vote attacks on the results of the elections.is needed to define in simpler terms

To perform a false claim, the adversary still needs to cast a message that will pass F CastObs . For example, if the adversary tries to send a fake share that does not match the commitment, the parties will not publish the receipt and the share will be discarded from the tally.

To complete the resolution of the DTally dispute, Theorem 9 demonstrates that the false interception claim cannot be performed: Theorem 9.

A party j being subject to a false tally interception claim has universally verifiable evidence of its honesty.

F Eleg models the universal verification of the eligibility in the elections, which can be performed after the tally by any external auditor, party or voter. F Eleg outputs 1 when only members of the census voted, 0 otherwise.

The ballot stuffing hybrid protocol describes how an adversary may attempt to generate ballots to alter the elections, and Theorem 10 proves how the covert adversary is identified in DiReCT.

Theorem 10.

An adversary cannot perform ballot stuffing surreptitiously. If the adversary performs the attack, it is detected and attributed correctly.