EP3568840A1

EP3568840A1 - Random sample elections

Info

Publication number: EP3568840A1
Application number: EP18738540.6A
Authority: EP
Inventors: David Chaum
Original assignee: Individual
Current assignee: Digital Community LLC
Priority date: 2017-01-13
Filing date: 2018-01-12
Publication date: 2019-11-20
Also published as: WO2018132651A1; EP3568840A4

Abstract

A method allows a random sample of a large population of voters to cast votes and for both the unpredictability/un-manipulability of the sample selection and the integrity of the tally to be verified by any interested parties using public information. The problem of vote selling is addressed. Also, a variant allows voters to remain substantially anonymous.

Description

RANDOM SAMPLE ELECTIONS

FIELD OF INVENTION

The invention is in the general field of polling, and more specifically where not all eligible persons are per poll.

DESCRIPTION OF PRIOR ART

Commercial and social advantage may result from a technique whereby a population can be polled, whether or not binding, with a result that is believed more representative and/or convincing than what is achieved by elections today.

BRIEF DESCRIPTION OF THE DRAWING FIGURES

Figure 1 shows a combination flowchart and cryptographic protocol diagram of an exemplary embodiment of an overall voting system aspect in accordance with the teachings the invention.

Figure 2 shows a protocol diagram of an exemplary cryptographic commitment system in accordance with the teachings of the invention.

Figure 3 shows a detailed exemplary combination cryptographic protocol, functional, flow chart, and block diagram of a requesting voter non-count verification in accordance with the teachings of the invention.

Figure 4A-D show a detailed exemplary combination cryptographic protocol, functional, and block diagram of an exemplary voting system with integrity that can be verified by any interested party in accordance with the teachings of the invention. Figure 5 shows a detailed exemplary combination flow chart, cryptographic protocol, functional, and block diagram of an exemplary voting system with integrity that can be verified by any interested party in accordance with the teachings of the invention. Figure 6 shows a detailed exemplary combination flow chart, cryptographic protocol, functional, and block diagram of an exemplary remote voting system with randomly selected voters and integrity that can be verified by any interested party in accordance with the teachings of the invention.

Figure 7A-D show a detailed exemplary combination cryptographic protocol, functional, and block diagram of an exemplary remote voting system with decoy ballots and integrity that may be verified by any interested party in accordance with the invention.

Figure 8 shows a detailed exemplary combination flow chart, cryptographic protocol, functional, and block diagram of an exemplary remote voting system with randomly selected voters, decoy ballots, and integrity that may be verified by any interested party in accordance with the teachings of the invention.

BRIEF SUMMARY OF THE INVENTION

This section introduces some of the inventive concepts in a way that will readily be appreciated, but that may make significant simplifications and omissions for clarity and should accordingly not be taken to limit their scope in any way; the next section presents more detailed descriptions.

Random-sample election techniques can it is believed further advantageously have a cost for a large population that may be several orders of magnitude less than that of conducting a conventional election. The properties that are believed achievable in some example random-sample elections may be summarized as follows:

• Only votes from randomly selected voters are counted.

■ Integrity of the published tally of votes cast is cryptographically proved.

• Vote buying and other "improper influence" of voters is difficult or even impractical.

• Ballot secrecy violation requires collusion compromise of election authority or the underlying cryptography.

• Voters can optionally be compensated for valid participation (even based on a test to

determine that they made consistent answers to the questions).

■ Voters can optionally remain substantially anonymous from all but the election authority.

A method for randomly sampling votes from a relatively large population of persons comprising: committing publicly to information based on first key information that will determine selected persons from first public random values, the first public random values to be realized later, committing publicly to information based on second key information including for audit of ballot information and related tally information responsive to at least second public random values, the second public random values to be realized later, providing ballot information, after the first public random values are realized, to the persons selected by the first public random values realized; accepting and making public voted ballot information related to the ballot information provided at least to the selected persons; making public a tabulation of the voted ballot information; establishing, by revealing information related to the second key information, that the tally corresponds at least substantially with high probability to the voted ballot information; and revealing the identity of selected persons after the vote information is accepted and made public.

The method just described, further comprising: receiving participation requests each related to a requesting person; providing ballot information to the requesting persons; accepting and making public voted ballot information related to the participation requesting ballots; making public the tabulation that includes the votes related to ballots selected but does not include any votes related to participation requested ballots; and such that the information supplied to and that made public related to requesting persons is substantially unrecognizable as to whether it is related to requesting persons or related to selected persons.

Either of the two methods just described, further comprising revealing the identity of requesting voters along with those of selected voters. Either of the three methods just described, further comprising making the identity of the voters revealed public. Any of the methods just described, apart from the previous one just described, further comprising only revealing the identity of the voter to a verifier person also selected at random and making the identity of the verifier person public at least after the votes are cast

GENERAL DESCRIPTION

A general description of an exemplary embodiment will be provided as will be appreciated without limitation and making certain simplifications for clarity as will be understood.

A pre-agreed public random process, such as stock-market closing data, determines which voters are to receive ballots that will be counted. Although the voters are publicly verifiable as selected by the results of the random process, their identity is hidden at least initially. Those ballots sent to the randomly selected voters will be known to those voters to be at least very likely counted, as a consequence of a public cryptographic proof. Anyone can, however, request a ballot that will not be counted. Because such requested ballots will only be distinguishable by the requesting voter, they can be sold to vote buyers and are believed more likely to be sold than the countable ballots. The identity of all voters may be made public once voting is over. Alternatively, a number of "verifiers" may be selected at random, provided with instructions, and only later would the identity of verifiers be made public. Each verifier is provided the identity of a different one of the voters and instructed to contact that voter and ensure that the voter has in fact cast the ballot - and to raise an alarm otherwise. Voters may obtain a code, also known but only in random parts to the verifier, so that the verifier can be convinced that the voter did in fact receive a ballot and verifiers can provide evidence of successful verification they performed. Verifiers may be employed for counted and even uncounted voters. Verifiers, as well as optionally voters who answer verifier queries, may collect rewards. Of course if ballots are sent "signature required," then the authority has some recourse against a voter falsely crying foul.

The participants in a simplified example are the Election Authority and

Three classes of members of the public:

(1) randomly-selected voters whose votes will be counted;

(2) self-selected voters whose votes will not be counted; and

(3) optionally, randomly selected verifiers who do not vote but rather check that a corresponding voter did participate.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Detailed descriptions are presented here of various sufficient to allow those of skill in the art to use the exemplary preferred embodiments of the inventive concepts.

Turning now to Figure 1, a detailed combination cryptographic protocol, functional, flowchart and block diagram of an overall exemplary random-sample voting process will be provided A random-sample election can be conducted in nine steps as indicated in Figure 1 by the step numbers and as will also be further described with reference to Figure 2.

Referring now to step 10, commitments are posted by the election administrator defining: (a) the countable ballots, (b) the uncounted ballots, and (c) combined tabulation tables for both types of ballots.

More particularly, encrypted values sometimes called "commitments" are made public, such as by posting online, for instance, replicated and or in a digitally signed form.

Each countable and uncountable ballot entry, shown arrayed vertically, consists in the example of a pair made up of two components. The first component is of the same type, whereas the second component differs for the countable and uncountable ballots. The first component, in the example, is a so-called mix input item sometimes referred to as an "onion." It is a nested or iterated layering of public key encryption, as is known, with what will be called the "payload" at its innermost core being the ballot indicia from the combined tabulation tables to be described. The second component, continuing the example, is for the uncountable ballots, supplied in step 11 to be described, and for the countable ballots, as described in step 12.

Some combined tabulation table columns include commitments and other columns are empty and will be filled later. The tables relate to what has been called a "voter verifiable" or sometimes "end-to-end" election system, such as those previously disclosed by the present applicant under the rubric "Punchscan" or "Scantegrity," such as have been used in binding elections. The example chosen for clarity is like that of Punchscan as used by Scantegrity, where there are three tables, shown left to right, as will be understood and familiar: (a) serial numbers, "indicia" to be printed on ballot, and the corresponding "vote codes"; (b) a pointer to the ballot row, the group operation relating the ballot row entry to the intermediate position entry, a second group operation relating the intermediate position to the row pointer for the results row; and (c) the results column. The rows of the second and third tables are independently randomly permuted. Initially the vote codes, ballot row and results row pointer, and results columns are empty; the other columns are filled with commits.

One example way, described here for clarity but without limitation, to keep the ballots submitted by volunteers from having their votes included in the tally is for the corresponding "results row" entries already described to be pre-filled for these ballots with an indication that the vote will not be counted.

Referring to step 11, volunteers submit multiply-encrypted values with a so-called "payload" or here "seed" mat will result in their own address being selected.

More particularly, each volunteer allowed may provide a mix input, much as already described for the first components, but with a payload that is an "encrypted" index into the list of voter addresses, to be described further with reference to steps IS and 18.

Referring to step 12, "Public random" values are created in a pre-agreed manner, such as a cryptographic hash of certain stock market closing data, that should be unpredictable earlier than the completion of steps 10 and 11.

More particularly, such public random values are known and used, for instance, in lotteries and in voter-verifiable election systems more generally. Prior to a certain time, it is believed infeasible to predict the values or even some functions of the values.

Referring to step 13, the random values from step 12 are used: (a) to select which committed values from step 11 are to be opened; and (b) as random seeds for cryptographically-generated voter identity indexes. The random seeds are processed as the constructed second components are, with the result believed hard to predict When a random value is processed through a mix that performs operations that would result in successive layers of encryption being stripped off (had they been applied in the first place), as will be understood by one of skill in the cryptographic protocol art, what results is a number (from the same range as can be generated from a user-constructed mix input), which can map nearly uniformly to a user identity or address. Typically, the results at each stage of processing through the mix are "restricted," such as by truncation of enough bits, so that reverse-engineering the mapping from input to output becomes computationally infeasible.

More particularly, by processing the random seeds as if they were onions, by what may in effect be in some examples application of one or more digital signatures, the resulting value is hard to predict by those without the signing keys. This will also be further described with reference to step 14.

Also, in the present example, some such values are used to determine which of the committed values from step 10 already described are to be decrypted in a publicly verifiable manner, referred to here as "opened." This is a known use and the example includes a random selection of pairs and the rows of the voter-verifiable election tables that match the pairs in ballot indicia, as already mentioned as included in the pairs of the first table. Such opening of randomly selected rows in the tables is known to provide a kind of audit of whether the table content is correctly formed, as will be understood.

Referring to step 14, a verifiable mix cascade is conducted, establishing that the batch of input pairs consisting of both types (random voter identities and submitted voter identities) are successively decrypted and mixed to produce an output batch of encrypted indices into the voter address list.

More particularly, the mix in the example is shown as what was called a "cascade" when the notion of mixing was first disclosed, in "Untraceable electronic mail, return addresses, and digital pseudonyms," Communications of the ACM, Volume 24, Issue 2, Feb. 1981, by the present applicant. Verifiability may be obtained by various interactive or non-interactive cryptographic proof techniques, as are known in an extensive literature tracing back, for instance, to early results presented by Sako and ilian in "Receipt-free mix-type voting scheme," Advances in Cryptology— EUROCRYPT '95, Springer- Verlag, 1995. Parallel application of a protocol, in what has been called "coordinated instances," allows the components of a pair to be treated in the same or in a different manner, but for the association of the components to be maintained, as will be understood.

It will however be noted that in the present example system two different types of second-component items are mixed: random values and prepared mix input items. Processing of the latter yields the known decryption. Processing of the former, however, may be regarded as the nested or iterated application of digital signatures. The result is believed mainly unpredictable without the signing keys. In the present example, the final signing is not applied or a committed key is not revealed that compresses the values to the range of valid indices to the voter address list, as will also be further described with reference to step 18.

Referring to step 15, the encrypted ballot values are decrypted from the mix output batch and printed and mailed to the corresponding voter address found by indexing the table of voter addresses.

More particularly, the final second components of the final mix batch are used, as has been mentioned already with reference to step 14, to select respective voter addresses from the list of such addresses shown, as mentioned as will be further described with reference to step 18. The paired vote ballot indicia, also not revealed in cleartext, is also decrypted. Thus, pairs of ballot indicia and voter address are determined by the devices system called out as "decrypt and print" in the figure. The result is printed material, in the example, including a ballot with the indicia, not visible from the outside, and the address visible from the outside. This may be accomplished by conventional means, such as printing a ballot form and stuffing it in an envelope with the delivery address applied to it. These addressed items are delivered to voters, for instance, such as by being mailed or couriered with or without tracking or signature required.

Referring to step 16, voters cast ballots for instance online using the mail they receive, which results in coded votes on an electronic bulletin board.

More particularly, the voter provides the codes through a web browser or other software application. It is also believed desirable that the voter checks that the codes are properly posted. The so-called electronic "bulletin board" system is well-known for such public and verifiable posting, as evidenced by the extensive literature on the subject. Various improvements to these techniques by the present applicant are disclosed in copending applications.

Referring to step 17, the tally is posted and proven to correspond to the published data and coded votes on the bulletin board. Votes for uncounted ballots will not yield votes, but may be stopped from being counted, such as by the pre-filled results rows entries mentioned already.

More particularly, various voter-verifiable techniques are known; however, the particular example tables shown will be described for clarity. First the results and intermediate position columns are populated (they were initially empty as mentioned earlier). Then a later public random value, such as described with reference to step 12, but where the unpredictability begins after the population mentioned, may be used. The random values determine which of the ballot row and results row pointer is to be revealed for each respective row, in some example audit schemes. Other audit schemes being well known in the cryptographic election integrity art.

Referring to step 18, the encrypted indices posted in step 14 are decrypted without regard for whether their votes would be counted or not

More particularly, at a stage that is believed desirable later than the bulletin-board is populated or after the verifiability of the election, the encryption of the voter address may be revealed in some examples for auditing. Other types of auditing, not requiring the voter identities to be made public, will also be further described later.

Turning now to Figure 2, a flowchart in accordance with the teachings of the present invention will be described in detail. Each of the nine steps already described with reference to Figure 1 are summarized in the flowchart. The protocol described is somewhat more generic than the very concrete protocol description presented with reference to Figure 1, as will be appreciated, was for clarity. In particular, for instance, the box for step 20 indicates only some form of commitment being made by the Election Authority, which may be comprised of one organization/individual and/or a quorum of organizations/individuals or a more complex structuring of participants, as are known in some cryptographic protocol settings.

As another example, the box for step 21 calls out voter identification and not address, as other procedures for voters to obtain ballots are anticipated, such as, without limitation, by in person visit or online or various combinations of techniques. Boxes for steps 22 and 23 correspond to the steps described but in less detailed and more generic language.

The box for step (4) as yet another example calls for a verifiable "mixing," being more generally whatever cryptographic protocol, no matter how it works, accomplishing the result so hiding the input and output correspondence.

The box of step 25, as still another example, calls out the "supply" of ballots, more generally, rather than the particular steps of printing and mailing ballot forms.

The box of step 26, as yet still another example, calls for voters posting votes with authentication, more generally than using coded votes.

The box of step 27, as yet again another example, calls for a generic cryptographic election verification process of whatever type.

And finally, the box of step 28, as still again another example, refers to voter identity information more generally as contrasted with the more specific voter addresses.

Turning now to Figure 3, a detailed exemplary combination cryptographic protocol, functional, flow chart, and block diagram of a requesting voter non-count verification is provided in accordance with the teachings of the invention. A party who requests a ballot, it is believed, may advantageously verify that votes cast using a particular ballot will not be included in the tally of the election. Box 39 shows such a verification step and or cryptographic process; boxes 30 through 38 are essentially the same as boxes 20 through 28, as already described with reference to Figure 2 and will not be described again here for clarity.

It will be appreciated that the requesting voter in the protocol already described has submitted the mix input or onion that will be peeled to reveal the voter address, as already described. It will now also be understood that if those performing the mixing, already described with reference to step 14 of Figure 1, were to publish the intermediate outputs of the mixing rounds (such publishing being known and two such rounds being shown in the example), then the secrecy of the mix permutation(s) would not be compromised; however, the requesting voter would, accordingly, be able to check in at least some exemplary mixing embodiments that the onion supplied was in fact included in the input and even that it was properly decrypted in stages and resulted in the output including the address. Thus, the requesting voter can verify that the ballot corresponds to a row in the tables 10 shown.

In order to allow the requesting voter to ensure that the ballot received pursuant to the request will not be counted in the tally, the election authority can further open the rows in the tables 10 that correspond to the ballot. Such opening is preferably what may here be called a "private opening," an opening available only to the corresponding requesting voter. An example way to create such a private opening would be for the election authority to encrypt the data that would be revealed by the opening and supply the data to the requesting voter in encrypted form. In one example, such encryption could be by a key secret to the requesting voter and the election authority; in another example, for instance, the encryption by the election authority could be using a public key for which the requesting voter knows the corresponding private key.

Corresponding to current election practice, in some exemplary embodiments, the randomly-selected voters can include essentially all voters, as will readily be understood. Choosing all among all is a trivial or boundary or special case of a random selection of a proper subset, as will readily be appreciated. In such a setting, for clarity, the randomly- selected voters may here be called "regular voters" for clarity.

The requesting voters, who are believed typically in such examples to be performing the role of regular voters as well, will accordingly receive two ballots: one ballot whose votes should be counted and one ballot whose votes should not be counted. The ballots are identified by their serial numbers, for instance, as already explained and shown with reference to step 10 of Figure 1. Accordingly, the voter will be able to distinguish between the two ballots. Thus, in the role of requesting voter, the requested ballot is received and recognized as such and can be sold to a vote buyer with significant confidence that both a vote cast with it will not be counted and that the fact that it was a requested ballot will not be revealed to the vote buyer, ideally even after the election.

In some examples, some or all of the regular voters (that can obviously also here be called "unrequesting" voters who receive "unrequested" ballots) may not be requesting voters. It will be understood that such an assignment of voters to roles could, in some examples and settings, it is believed, help a vote buyer to distinguish whether a ballot being offered for sale is an unrequested ballot or a requested ballot. Nevertheless, the inventive aspects already described here are believed to still provide protection apart from this aspect. One example way to address such potential distinguishability, however, would be to hide the identities of one or both class of voter, by whatever means, as will be appreciated.

Turning now to Figure 4A-D, a detailed exemplary combination cryptographic protocol, functional, and block diagram of an exemplary voting system with integrity that can be verified by any interested party in accordance with the teachings of the invention is shown. Figure 4A shows two example ballots; 4B is the initial commitments; 4C the bulletin board data; and 4D the partially opened commitments after the election.

Referring more specifically now to Figure 4A, two example printed paper what may here be called "double ballots" are shown in plan view. Each double ballot includes indicia for an optional title, some optional instructions, and two individual ballot parts. The double ballots have serial numbers "100" and "101" while what may here be called the "single" or "individual" ballots that make up double ballot 100, for instance, have serial numbers "100a" and "100b," as will be seen. Each individual ballot has two columns of values; in the example with a single binary question, each column contains two values, though with more options it is believed that there can be correspondingly more rows, as will readily be understood. The left column of values are what may be called "vote codes" and the right column the "choices" or "votes" available to voters. (It will be appreciated that in some examples the choices are also randomly ordered.)

For instance, the double ballot with serial# "100" contains two vote codes for the voter choice "yes," "9343" and "1134." Single ballot "101a" has vote code 2843 for voter choice "yes." Each voter in this example receives a double ballot and, according to the example instructions, is to choose one of the two individual ballots to vote and supply the electronic bulletin board, as already described, with die vote code that corresponds to the voter choice. For instance, a voter receiving double ballot 101 and wishing to vote "no" may either (a) select individual ballot 101a and then supply code "6533" to the electronic bulletin board; or (b) select individual ballot 101b and then supply code "8282" to the electronic bulletin board. The ballots are supplied voters before the voting, at least before it closes.

Referring to Figure 4B, an example instance is shown of a table of values committed to, for instance by the election authority already mentioned. The dotted lines indicate that the values below them are not public but are posted in at least a kind of encrypted form, already described here, called a commitment. The example corresponds to the two example ballots just described with reference to Figure 4A. Each "row" of the table corresponds to a triple: the serial number of the individual ballot, the vote code, and the vote. For instance, a row for individual ballot "101a" contains this serial number as its first column entry, vote code "2843" as its middle entry, and the vote of "yes" in its third column. The commitment is made before the voting, at least before it opens. The same values printed on the ballots are to be used in the table; these values would ideally at least include unpredictable vote codes. Other aspects may, it is believed, be chosen at random or with certain relationships and/or distributions. In whatever way the values are chosen, they would be copied into the corresponding portions of the table and ballots. But, as will be understood, the rows of the table can be thought of as randomly permuted and/or the row assignments as randomly selected; the ballots in some examples can be printed or used in a fixed or randomized order.

Referring to Figure 4C, the electronic bulletin board state is shown with example values that would be present once the two example ballots already described with reference to Figure 4A, and with data corresponding to that described with reference to Figure 4B, are voted. The electronic bulletin board has already been described and in some examples may also be described as a provision on computer network servers allowing voters to make values pubic in a way that ideally cannot readily be altered. In particular, the voter who received double-ballot "100" has apparently chosen individual ballot "100a" to vote and has chosen to vote "yes" by providing the vote code "9343" to the electronic bulletin board. Similarly, as will be understood, the voter who received double-ballot "101" has apparently chosen individual ballot "100b" to vote and has chosen to vote "no" by providing the vote code "8282" to the electronic bulletin board.

Referring finally to Figure 4D, an example instance of a table of values committed to as described with reference to Figure 4B is shown, but now with some of the values opened as indicated for those values missing the surrounding dotted rectangle. In an example rule and with the example ballots, votes and values already described, the two vote codes that were voted each correspond to a row that remains committed except that its votes are shown. Thus, the tally is readily seen computed based on these two rows uniquely identified by the patterns of the first two column commitment not being opened The other data shown still committed is the votes of the other rows of the corresponding individual ballots voted; the so-called "vote" values are shown still committed to. This, it is believed helps protect so-called "ballot secrecy," that is, how the voter voted. Ballots that are not voted, for whatever reason, can be opened fully.

A variation, as will be appreciated, reveals the voted codes but hides the vote for them and reveals the votes for the unvoted codes; accordingly, the votes are flipped for purposes of tally.

Turning now to Figure 5, a detailed exemplary combination flow chart, cryptographic protocol, functional, and block diagram of an exemplary voting system with integrity that can be verified by any interested party in accordance with the teachings of the invention is shown. The process described was also illustrated by Figure 4A-D and the corresponding description.

Box SI shows the creation of a ballot pair information per serial number, each with distinct vote codes per choice, as will be understood. The vote codes are believed at least different for different voter choices within the individual ballot serial number, however, it may be advantageous in some settings to keep the vote codes distinct over a larger range of occurrences, such as even over a complete election or related elections.

Box 52 shows the printing of the ballot pairs. These are as shown in Figure 4 in the example two individual ballots, with the same serial number, attached such as by perforation.

Box 53 is the encryption of each element of <serial#, vote code, vote> separately and the posting of each triple in a random row. This has already been described with reference to Figure 4B, as will be understood. The terminology of "encryption and posting" will be appreciated as an alternate way to describe the "commitment" process as already mentioned; what may be called "decryption" can then be considered similar to "opening" as also already mentioned.

Box 54 indicates that voters are each given a printed ballot pair. It will be understood that if the election authority, 'ΈΑ," were to learn the correspondence between serial numbers and voters, then the EA could link votes to voters. Accordingly, ideally ballots are provided in a randomized order. For attendance voting, ballots are randomly selected by voters from a stack or hopper or the like. For remote voting, paper or electronic ballots may be mailed or otherwise delivered to voters; the linking of the particular instances corresponding to particular voters is preferably kept from the EA. In a practical example, a stack of ballots that have already been folded or covered with scratch off is shuffled repeatedly before being stuff into envelopes for mailing.

Box 55 depicts one ballot being accepted from each voter. If at a polling place unmarked ballots could be accepted into a ballot box, a malfeasant EA could claim that a ballot was not voted when in fact the voter had marked it. One example way to prevent this kind of potential vote cancelling in attendance voting, or the unfounded allegation that it had occurred, would be for the ballot box to be "guarded" by means, human and/or automated, that prevents or at least detects unmarked ballots from being inserted. For instance, the ballots could be folded so that an unmarked position us visible but what vote the correspond to is hidden. In some other examples, the vote codes are protected by scratch-off coating to be removed by the voter, as has been mentioned with reference to Figure 4A, and the ballot identity is protected by being placed in an envelope that contains a window that exposes the un- scratched vote code.

Box 56 is the opening, in case there are unvoted ballots, of all encryptions related to such ballots. It will be understood that by so opening these ballots they are cancelled from the tables and so ballots that remain in the table can, in some examples, be considered ideally one per voter. (In some further examples to be described, such as with reference to Figure 7 and Figure 8, there may be ballots that are known to be so-called requested or that may be called "decoy" ballots, and the initial total number of ballots in the commitment table can be the sum of the decoy ballots and the regular ballots) Once polls close, any unvoted ballots are believed preferably removed from consideration by being fully opened, as already mentioned.

Finally, now, box 57 is processing for ballots voted. For each row voted, the vote element of the triple is opened; if the row is unvoted, both the serial and vote code elements are opened. At this point the tally can be computed by adding the opened votes. Also, anyone should, ideally, be able to verify that the codes voted, as seen on the electronic bulletin board described with reference to Figure 4, are not shown; if they are opened, an error or malfeasance is believed to be indicated and in some examples the corresponding voter might request the voted individual ballot be shown. In some optional example embodiments, the vote codes are only revealed in part during a first period to allow voters to register complaints; a complaint would include the remainder of the vote code, as it should be known to the voter. During the corresponding second period, the remaining portions of the vote codes are revealed; if there is a match with a complaint, malfeasance is believed indicated, at least with some probability.

Turning now to Figure 6, a detailed exemplary combination flow chart, cryptographic protocol, functional, and block diagram of an exemplary remote voting system with randomly selected voters and integrity that can be verified by any interested party is shown in accordance with the teachings of the invention. The process described was also illustrated by Figure 4A-D and the corresponding description.

Box 61 is the creation of a ballot pair per serial number, each with distinct vote codes per choice, much as already described with reference to Figure 5 box 51. Box 62 is the ballot printing much as already described with reference to Figure S box 52, or the equivalent forming of the corresponding electronic image.

Box 63 is the commitment to each element of <serial, vote code, vote> separately, much as already described with reference to box Figure 5 box 53.

Box 64 is the sending of ballots to voters, such as physically by mail or electronically, such as by email. In this embodiment, ballots can be in some examples be sent a randomly selected subset of voters. For instance, a batch of ballots may be paired each with a mailing label chosen randomly from a large collection of such labels.

Box 65 is the accepting of one ballot from each of the randomly selected voters (e.g., online with serial number and code posted on bulletin board).

Box 66, like box 56 already described with reference to Figure 5, is the opening of all the encryptions of any ballot not voted.

Box 67, like box 56 already described with reference to Figure 5, is the opening related to voted ballots: if row voted, open vote only; if row unvoted, open serial and vote code.

Turning now to Figure 7A-D, a detailed exemplary combination cryptographic protocol, functional, and block diagram of an exemplary remote voting system with decoy ballots and integrity that may be verified by any interested party is shown in accordance with the teachings of the invention. The figure is organized much as with Figure 4: figure 7A shows two example ballots; 7B is the initial commitments; 7C the bulletin board data; and 4D the partially opened commitments after the election. As will be appreciated, and for clarity, the description already provided with reference to Figure 4 will be relied on and what are believed example difference between this and the setting of Figure 4 will be highlighted described in detail here.

Referring now more particularly to Figure 7A, two ballots are shown. They are the same as of Figure 4A, for clarity and simplicity, but one of them will not be counted in the tally because it is what will be called here a "decoy" ballot, which is essentially what has been called elsewhere here a requested ballot. The ballot is believed "indistinguishable" from what may here be called a "countable" ballot; put differently, the two look the same but the table has encoded ballot "101" as a decoy, as will be described more fully below.

Referring to Figure 7B, the committed table is essentially the same as that already described with reference to Figure 4B, apart from the inclusion here of a new column, labeled "countable/dummy." The entries in this new column are the letter codes C" for countable and "D" for dummy. As can be seen, ballot "100" has been marked countable and ballot "101" dummy, in each of their rows.

Referring to Figure 7C, the electronic bulletin board has the same end state as already described with reference to Figure 4C, again as will be appreciated for simplicity and clarity.

Referring to Figure 7D, there is an additional column compared to Figure 4D, just as with Figure 7B, compared to Figure 4B. It will be seen that there is a further column on the right for the respective countable dummy indicators. Furthermore, it will be appreciated that the only rows for which these indicators are opened correspond to the two codes voted. Thus, voted "yes" voted from ballots "100a" with code "9343" is counted, as indicated by the "C"; but, the "no" voted from ballots "101b" with code "8282" is a dummy and not counted in the tally total, as indicated by the "c." Which of the double ballots, "100" or "101," was the dummy, however, remains hidden.

Turning now, finally, to Figure 8, a detailed exemplary combination flow chart, cryptographic protocol, functional, and block diagram of an exemplary remote voting system with randomly selected voters, decoy ballots, and integrity that may be verified by any interested party in accordance with the teachings of the invention is shown. The process described was also illustrated by Figure 7A-D and the corresponding description; it is also similar to that already described, such as with reference to the process of Figure 6, with some differences. As will be appreciated, again, the description will highlight the differences of this embodiment with those already described, for clarity.

Box 81 is again the creation of a ballot pair per serial number, each with distinct vote codes per choice; most it is believed can be expected to be marked countable, some marked dummy.

Box 82 is the printing of ballot pairs, or the electronic equivalent of rendering them, without countable/dummy indication.

Box 83 is the formation of the commitment table. This entails encrypting each element of <serial, vote code, vote, countable dummy> separately and posts each quadruple in a random row.

Box 84 is the sending of ballots to each regular voter and fulfilling accepted dummy ballot requests by providing a corresponding dummy ballot to each.

Box 85 shows that ballots voted online result in serial number and code posted on bulletin board. Box 86 is the opening of serial, vote code, and vote encryptions of ballots not voted. It will be appreciated that such opening is for reasons and has advantages already described; however, opening the counted dummy tag is not believed advantageous as it is believed that a vote buyer for instance might opt to not to vote it or have it voted and then learn if the seller were supplying a decoy.

Box 87, finally, is the opening of commitments. As already described with reference to figure 7D: if the row was voted, open vote and countable/dummy; if the row was unvoted, open serial and vote code.

While these descriptions of the present invention have been given as examples, it will be appreciated by those of ordinary skill in the art that various modifications, alternate configurations and equivalents may be employed without departing from the spirit and scope of the present invention.

All manner of variations, generalizations and extensions are anticipated. As just one example, each verifier is provided with a voter identity and each voter optionally with a confirmation code. The verifier contacts the voter and obtains the confirmation code. A random selection of the digits of the confirmation code are provided to the verifier along with the voter identity, so that the verifier can check the validity of the confirmation code and the voter cannot, at least with significant probably of detection, cheat the verifier. The verifiers may be selected by a third portion of the input batch as described, with random identities, and be paired with voter identities. The confirmation codes and random selections of digits may, for instance, be constructed by the election authority. As another example, a multiparty protocol may be employed, instead of using a single election authority, as has been mentioned and will be understood.

Claims

What is claimed is: 1. A cryptographic method for conducting an election where at least some voters vote remotely and the integrity of the corresponding tally can substantially be verified by any interested party, comprising:

first commitment to first information to determine randomly-sampled voters from a first pre-a greed public random process result, the first public random process result to be realized later and the first committed information substantially encrypted using first cryptographic key information;

second commitment to second information, including for audit of ballot tally information, responsive to at least a second pre-agreed public random process, the second public random process results to be realized later and the second committed information substantially encrypted using second cryptographic key information;

providing ballot information, after the first public random process results are realized, to the randomly-selected voters, where the selection of voters depends on the first cryptographic key information and the first random process results;

accepting, and making public, at least portions of the ballot information corresponding to votes cast by the randomly-selected voters;

making public a tally corresponding to the ballot information of votes cast by the randomly-selected voters;

establishing, by opening at least portions of at least the second commitments, using the second cryptographic key information, that the tally corresponds at least substantially with high probability to ballot information corresponding to votes cast by the randomly-selected voters; and

where determining which voters are randomly-sampled is publicly verifiable as substantially secure from manipulation by those posting the first commitments, provided the realization of the public random process results is secure from substantial manipulation by those conducting the pre-agreed public random processes, and which voters comprise those randomly sampled is publicly verifiable as unpredictable until the pre-agreed first public random process is realized.

2. The ciyptographic method of claim 1, further comprising:

submitting, by at least potential self-selected requesting volunteer voters, request information;

providing, to at least an allowed one of the requesting volunteer voters, a ballot not contributing votes to the tally of the election; and

the overall election process such mat a ballot supplied to a requesting volunteer voter, and information made public that is related to such a volunteer voter ballot, is substantially indistinguishable as to whether it is related to a volunteer voter or related to a randomly-selected voter.

3. The cryptographic method of claims 1 or 2, further comprising: determining verifier persons, by committing to encrypted information that determines the choice of verifier persons based on third ciyptographic key information and public random values determined later; revealing the identity of a respective voter only to a corresponding verifier person; and making the identity of the verifier person public.

4. In the cryptographic method of claim 1, 2, or 3, where ballots are mailed to voters and voters can vote on an electronic bulletin board.

5. In the cryptographic method of claim 2, 3, or 4, where the requesting volunteer voter can verify that the vote of the ballot received will not be included in the tally.

6. A cryptographic method for conducting an election in which the integrity of the election tally can be verified substantially by any interested party, comprising:

commitment to information, including for audit of ballot information and related tally information, responsive at least to a pre-agreed public random process, the public random process results to be realized later and the committed information substantially encrypted using cryptographic key information;

submitting ballot request information;

providing, responsive to at least an allowed one of the ballot request information submittals, a ballot;

making public a tally corresponding to the ballot information of votes with corresponding general ballots; establishing, by opening at least portions of at least the commitments, using the cryptographic key information, that the tally corresponds at least substantially with high probability to the voted ballot information of general ballots; and the overall election process such that a ballot supplied responsive to a request, and information made public related to such a ballot, is substantially indistinguishable as to whether it is related to a requested ballot or related to a general ballot.

7. In the cryptographic method of claim 6, including: where the person requesting a ballot is able, before the requested ballot is submitted, to verify opened commitments in order to check that the vote of the requested ballot will not be included in the tally.

8. In the cryptographic method of claim 6 or 7, including: where ballots are mailed to voters and voters can vote on an electronic bulletin board.

9. In the cryptographic method of claim 6, 7, or 8, including: where the voters of unrequested ballots are chosen randomly responsive to a second commitment and to second cryptographic key information.

10. A cryptographic method for conducting an election in which the integrity of the election tally can be verified substantially by any interested party, comprising:

creating ballot pairs including two individual ballots in each pair and a vote code for each choice of each individual ballot;

commitment to the ballot pair information;

printing the ballot pairs with indicia consistent with the ballot pair information;

opening the votes associated with vote codes that have been voted;

opening at least the vote codes of individual ballots for which a different vote code was voted; and

leaving committed the votes within the same an individual ballot as a voted code.

11. A cryptographic method for conducting an election in which the integrity of the election tally can be verified substantially by any interested party, comprising:

creating ballot pairs including two individual ballots in each pair and a vote code for each choice of each individual ballot; commitment to the ballot pair information;

printing the ballot pairs with indicia consistent with the ballot pair information; opening the votes associated with vote codes other than those voted;

opening the vote codes voted; and

leaving committed the votes within the same individual ballot as a voted code.

12. In the cryptographic method of claim 10 or 11, including: opening rows of double ballots not voted.