V God: Why is blockchain voting underestimated?

Original title: "Vitalik: Why do you need blockchain voting?" ", by Vitalik Buterin, Co-Founder of Ethereum

Voting is a process that requires a lot of process integrity. The result of the vote must be correct, and there must be a transparent process to ensure this, so that everyone can trust that the result is correct. There should be no possibility of successfully interfering with anyone's willingness to vote or preventing their vote from being counted.

Blockchain is a technology that provides assurance of process integrity. If a process runs on the blockchain, it is guaranteed that the process will run according to some pre-agreed code and provide the correct output. No one can prevent its execution, no one can tamper with this execution, and no one can censor and prevent any user input from being processed.

So at first glance, blockchain seems to provide exactly what voting needs. I'm not the only one with this thought; plenty of major potential users are interested. But it turns out that some people have very different opinions on this....

overview

overview

Critics of blockchain voting protocols typically make two key criticisms:

• Blockchain is not a software tool for conducting elections. The trust properties provided by the blockchain do not match the properties required for voting, and other types of software tools with different information flow and trust properties would be more useful.

• Software generally cannot be trusted to conduct elections, no matter what it is. The risk of software and hardware bugs going undetected is too high, no matter how the platform is organized.

This article will discuss these two views in turn ("refuting" is too strong a word, but I absolutely disagree with both views). First, I'll discuss the security issues of existing attempts to use blockchains for voting, and how the correct solution is not to abandon blockchains, but to combine them with other cryptographic technologies. Second, I'll address the question of software (and hardware) trustworthiness. My answer is: computer security is actually getting better, and we can strive to continue this trend.

In the long run, sticking to paper forever will be a huge impediment to improving voting. Voting every N years is a 250-year-old form of democracy, and we could have a better democracy if voting could be made more accessible and simple so we could vote more often.

There is no doubt that this article is based on the premise that good blockchain scalability technology (such as sharding) is available. Of course, none of this would be possible if the blockchain could not scale. But so far, the technology is advancing so rapidly that there's no reason to think it won't happen.

Bad Blockchain Voting Protocol

Blockchain voting protocols are always under attack. Two years ago, Voatz, a blockchain voting technology company, was all the rage and a lot of people were very excited about it. But last year, some researchers at MIT found a series of critical security flaws in their platform [6]. Meanwhile, in Moscow, a blockchain voting system that was about to be used for elections was hacked [7]. Fortunately, the attack happened a month before the elections.

These hacks are pretty serious. Below is a table of attack capabilities that researchers who analyzed Voatz successfully discovered:

That in itself is not an argument against using blockchain voting. But blockchain voting software should be designed more carefully and scaled up over time.

Privacy Protection & Coercion Resistance

But even blockchain voting protocols that aren't technically broken are usually bad. To understand why, we need to dig a little deeper into what specific security properties blockchains provide, and what specific security properties are required for voting -- and as we dig deeper, we'll see that there is a mismatch between the two .

Blockchain provides two key properties: correct execution and censorship resistance. Correct execution simply means that the blockchain accepts user inputs ("transactions"), processes them correctly according to some predefined rules, and returns the correct output (or adjusts the blockchain's "state" in the correct way); Censorship resistance is also easy to understand: any user who wants to send a transaction and is willing to pay a high enough fee can send it and expect it to be included on the chain soon.

These two properties are very important for voting: the result of the vote you want must be the result of adding up the votes of each candidate to select the candidate with the most votes, and you must want anyone who is eligible to vote to participate Vote, even if some powerful people try to stop them. But voting also requires some key properties that blockchains do not provide:

• Privacy protection: you should not know which candidate certain people voted for, or even if they voted;

• Coercion resistance: You shouldn't be able to prove to others how you voted, even if you wanted to.

The need for the first requirement above (i.e. privacy) is obvious: you want people to vote based on how they feel personally, regardless of how they feel about them from those around them, their employers, the police, or random thugs on the street. The feeling of voting.

The second requirement (coercive resistance) needs to be used to prevent the problem of "vote selling": if you can prove how you voted (i.e. who you voted for), then sell your Voting becomes very easy. Provability of ballots also enables forms of coercion, where the coercor demands to see some proof that (the coerced person, i.e., the voter) voted for a certain candidate. Most people, even those who are aware of the first requirement, don't think about the second requirement. But the second requirement is also necessary, and technically it is important to provide it. Needless to say, the general "blockchain voting systems" you see out there don't even try to provide the second property, and often fail to provide the first.

Secure Electronic Voting Without Blockchain

The concept of cryptographically securely enforced social mechanisms was not invented by blockchain geeks, and actually existed long before us. Outside of the blockchain space, there is a 20-year tradition of cryptographers working on the problem of secure electronic voting, and the good news is that there are solutions. Juels, Catalano, and Jakobsson's 2002 paper entitled "Coercion-Resistant Electronic Elections" (Coercion-Resistant Electronic Elections[8]) has been cited in many literatures over the past 20 years:

The concept has gone through many iterations since then; Civitas[9] is a prominent example, although there are many others. These protocols all use a similar set of core technologies: there is an agreed-upon set of “talliers,” or tellers, and a trust assumption that most talliers are honest. Each scrutineer holds a "part" of the private key for which the corresponding public key is published. The voter encrypts the vote by using the public key of the scrutineer and publishes the encrypted vote, and the scrutineer uses a secure multi-party computation (MPC) protocol [10] to decrypt and verify the ballot and count the votes . The counting of votes is done "inside the MPC": the scrutineers will never know their private keys, and when calculating the final result, they will not know any information about the individual vote, except from the final result itself. What information comes out.

Encrypting votes provides privacy, and some additional infrastructure (such as mixing networks) can be added to make privacy even stronger. At the same time, to provide stress resistance, one of two techniques can be used:

The first option is that during the registration phase (where the scrutineer learns the public key of each registered voter), the voter generates or receives a key. The corresponding public key is shared among the scrutineers, and the scrutineer's MPC will only count a vote if it is signed by the key. Voters cannot prove to a third party what their key is, so if they are bribed or coerced, they can simply present a wrong key and use the wrong key to sign their vote. Alternatively, the voter can send a message to change their key, the voter cannot prove to a third party that they did not send such a message, so the vote remains the same.

The second option is a technique where a voter can cast multiple votes, with a later vote overriding the previous one. If a voter is bribed or coerced, he can first vote for a candidate as requested by the briber/coercion, but can then send another vote to override the previous vote.

Empowering voters to overturn previous votes through subsequent votes is the key to the anti-coercion mechanism of the 2015 agreement above

Now, let's look at an important nuance in all of these protocols. They all rely on an external primitive for their security guarantees: the bulletin board ("BB" in the picture above). A bulletin board is a place where any voter can send a message, and it is guaranteed that: (1) anyone can read the bulletin board, and (2) anyone can send a message to an accepted bulletin board. Most bullying-resistant voting papers you can find casually mention the existence of bulletin boards, but few papers discuss how this bulletin board can actually be implemented. In this article, you can see my intent: the safest way to implement a bulletin board is to use an existing blockchain!

Secure Electronic Voting Using Blockchain

Of course, before the blockchain, there have been many attempts to make an electronic bulletin board. This 2008 paper [12] is such an attempt, and its trust model is a standard requirement that "k out of n servers must be honest" (commonly k = n/2). For example, this 2021 literature review [13] covers and explores the use of blockchain in some previous bulletin board implementation attempts that also rely on k-of -n Trust model.

The blockchain is also a k-of-n trust model, which requires at least half of the miners or PoS validators to follow the agreement. If this assumption fails, it usually leads to a "51% attack". So why is a blockchain better than a special-purpose electronic bulletin board? The answer is: building a truly trusted k-of-n system is difficult, and blockchain is the only system that has solved this problem on a large scale. Suppose a government announces that it is building a voting system and provides a list of 15 local organizations and universities that will run a special-purpose bulletin board. As an outside observer, how do you know that the government didn't choose these 15 organizations out of 1,000 based on its desire to collude with an intelligence agency?

Public chains, on the other hand, have a permissionless economic consensus mechanism (PoW or PoS) that anyone can participate in, and an existing diverse and highly incentivized base of block explorers, exchanges, and other monitoring nodes facility to constantly verify in real time that nothing bad is happening.

These more complex voting systems don't just use blockchains; they also rely on cryptography such as zero-knowledge proofs for correctness and multi-party computation for duress resistance. Thus, they avoid the weaknesses of more "naive" voting systems that simply "vote directly to the blockchain" and ignore the resulting privacy protection and coercion resistance issues. But the blockchain bulletin board remains a key part of the security model of the entire design: if the committee is compromised but the blockchain is not, the duress-resistant properties are lost, although all other guarantees around the voting process remain.

MACI: Coercion Resistant Blockchain Voting on Ethereum

The Ethereum ecosystem is currently experimenting with a system called MACI [14], which combines blockchains, ZK-SNARKs, and a central actor that ensures duress resistance (but apart from ability to destroy any feature). MACI is not very difficult technically. Users can participate in the following ways: use their own private key to sign a message, then encrypt the signed message with the public key issued by the central server, and publish the encrypted signed message to the blockchain. The server downloads these messages from the blockchain, decrypts and processes them, and outputs a result and a ZK-SNARK proof that the computation was done correctly.

Users can't prove how they got involved, because they can send a "change key" message to trick anyone trying to audit them: they can first send a change key message, changing their key from A for B, and then send a "fake message" signed by A. The server would reject the fake message, but no one else would have any way of knowing that the key change message was sent. There is a trust requirement on the server, albeit only for privacy protection and coercion resistance; the server cannot publish wrong results by computing incorrectly or by censoring messages. In the long run, multi-party computation can be used to some extent Realize the decentralization of the server on the server, thereby strengthening the guarantee of privacy protection and anti-coercion.

summary

summary

• The voting process has four important security requirements that must be met: correctness, censorship resistance, privacy protection, and duress resistance.

• Blockchain is good at the first two, but not at the latter two.

• Putting voting encryption on the blockchain increases privacy. Zero-knowledge proofs lead to correctness, and outside observers cannot directly aggregate votes because they are encrypted.

• MPC decryption and checking votes can provide duress-resistant properties when combined with mechanisms where users can interact with the system multiple times: either a previous vote invalidates a subsequent vote, or vice versa.

• Using the blockchain ensures that you have very high security censorship resistance, and even if the committee colludes to break the duress resistance, you will still maintain this censorship resistance. The introduction of blockchain can significantly improve the security of the system.

But can we trust technology?

But now we come back to a second, deeper criticism of any kind of electronic voting (blockchain or not): the technology itself is too insecure and should not be trusted.

A recent paper from the Massachusetts Institute of Technology (MIT) [16] criticized blockchain voting, including this table below, describing how paperless voting of any kind is fundamentally too difficult to secure:

The key property that the authors of this paper focus on is software-independence, which they define as "the property that undetected changes or bugs in the software of a system cannot cause imperceptible changes in election outcomes." ". Basically, a bug in the code shouldn't accidentally make Prezzy McPresidentface the new president of some country (or more realistically, a bug that was deliberately embedded shouldn't be able to knock a candidate's vote share from 42% to 52%).

But there are other ways to deal with bugs. For example, any blockchain-based voting system that uses publicly verifiable zero-knowledge proofs can be independently verified. Someone could write their own implementation of a proof verifier and verify the ZK-SNARK themselves. He could even write his own voting software. Of course, the technical complexity of actually doing this exceeds 99.99% of any actual voter base, but if thousands of independent experts have the ability to do it, and verify that the software works, that's in practice Simply not too good.

However, for the MIT authors, this was not enough:

Therefore, any electronic-only system, even one that is verifiable end-to-end, does not appear to be suitable for political elections in the foreseeable future. The American Voting Foundation has noted the promise of the E2E-V method to improve online voting security, but has published a detailed report recommending avoiding its use for online voting unless and until the technology is more mature and in voting Get fully tested.

Others have proposed extensions to these ideas. For example, the proposal by Juels et al. emphasizes the use of cryptography to provide multiple forms of "duress resistance". The Civitas proposal by Clarkson et al. implemented additional mechanisms for stress resistance, which were further incorporated and refined into their Selene system by Iovino et al. From our perspective, these proposals are innovative but unrealistic: they are quite complex and, most seriously, their security relies on the voter's device not being compromised and functioning as intended, which is an unrealistic assumption .

The concern of these MIT authors is not the hardware security of the voting system; this risk can actually be mitigated with the use of zero-knowledge proofs. Instead, they focus on a different security question: Are users' devices secure, even in principle?

Given the long history of various exploits and hacks on consumer devices, it's reasonable to assume the answer is "not secure." The following quotes an article I wrote in 2013 on Bitcoin wallet security:

besides:

1Es3QVvKN1qA2p6me7jLCVMZpQXVXWPNTC

besides:

In June 2011, the computer of Bitcointalk member "allinvain" was directly hacked by unknown intruders, and he lost 25,000 BTC (valued at $500,000 at the time). The attackers were able to access allinvain's wallet.dat file and quickly emptied the wallet -- either by sending transactions from allinvain's computer, or by uploading the wallet.dat file and then emptying the wallet on their own computer.

But these disasters mask a larger truth: Computer security has actually been slowly but steadily improving over the past two decades [17]. Attacks are much harder to do now, often requiring attackers to look for vulnerabilities in multiple subsystems rather than a single vulnerability in a large, complex piece of code. High-profile incidents are now bigger than ever, but that's not a sign that anything is becoming less secure; rather, it's just a sign that we're becoming more and more dependent on the internet.

Trusted hardware (trusted hardware [18]) is a very important source of recent improvements. Some new "blockchain phones" (such as a phone from HTC[19]) go quite far with this technology and install a minimalist operating system with a focus on security on a trusted hardware chip, Allows applications with high security requirements, such as cryptocurrency wallets, to remain separate from other applications. Samsung has already started making phones that use similar technology. Even devices that are never advertised as "blockchain devices" (such as iPhones) often have some kind of trusted hardware.

A cryptocurrency hardware wallet is effectively the same thing, except this trusted hardware module is physically located on the outside of the computer instead of inside. But trusted hardware (deservedly!) often gets a bad rap in security circles, especially in the blockchain community, because it is always broken again and again [20]. Indeed, you certainly don't want to use it to replace your security protection. But as an augmentation technology, it's a huge step forward.

In the end, a single application, like a cryptocurrency wallet and voting system, is much simpler than an entire consumer operating system, with less room for error -- even if you have to integrate quadratic voting, draws, quadratic draws, etc. support. The benefit of tools like trusted hardware is that they isolate the simple from the complex and potentially hackable, and they are having some success.

So the risk may decrease over time

But what are the benefits?

These improvements in security technology bode well for a future where consumer hardware may be more trusted than it is today. Investments in this area over the past few years are likely to continue to pay off over the next decade, and we can expect further significant improvements. But what are the benefits of making voting electronic (blockchain-based or otherwise) to make it worth exploring this whole field?

My answer is simple: Voting will become more efficient, allowing us to vote more often. Currently, formal democratic input to an organization (government or business) is often limited to one vote every 1-6 years. Perhaps largely for this reason, decentralized decision-making in our society is sharply divided into two extremes: pure democracy and pure market. Democracy is either very inefficient (corporate and government voting) or very insecure (social media likes/retweets). Markets are technically far more efficient and safer than social media, but their underlying economic logic makes them ill-suited for many types of decision problems, especially those related to public goods.

Yes, I know it's another triangle, and I'm really, really sorry to have to use it. But forgive me this time....(well, I'm sure I'll be making more triangles in the future; bear with me)

We can do a lot if we can build more systems that sit somewhere between democracy and the market, benefiting from the egalitarianism of the former, the technical efficiency of the latter, and the economic properties in between. Quadratic funding is a good example; liquid democracy is another. Even if we don't introduce novel delegation mechanisms or quadratic math, there's a lot we can do to make voting more tailored to the information available to each voter by having more votes on a smaller scale. The challenge with all of these ideas is that in order to have a scheme that sustains any degree of democracy durably, you need some form of Sybil resistance and reduced vote-buying: this is exactly what these promising ZK-SNARK + MPC + blockchains are all about. The problem that the voting scheme tries to solve.

The crypto space can help

An underrated benefit of the cryptocurrency space is that it is an excellent "virtual special economic zone" where economic and crypto ideas can be tested in a highly hostile environment. No matter what you build and release, once the economic power it controls exceeds a certain size, a large number of participants of all stripes (sometimes altruistic, sometimes profit-driven, and sometimes malicious) individuals, many of whom remain completely anonymous) would pop into the system and try to twist its economic power for their own various goals.

The motivation of the attacker is high: if an attacker steals $100 from your cryptoeconomic tool, they can usually get the full $100 reward, and they can usually get away with it. But defenders are also highly motivated: if you build a tool that helps users avoid losing money, you can (at least sometimes) turn it into a tool and make millions. Cryptocurrencies are the ultimate training zone: if you can build something that can survive at scale in this environment, it might as well survive in the larger world.

This applies to quadratic funding [21], to multisig [22] and social recovery wallets [23], and to voting systems. The blockchain space has already helped drive the rise of important security technologies:

• hardware wallet;

• Efficient general-purpose zero-knowledge proofs;

• Formal verification tools;

• "Blockchain mobile phone" equipped with a trusted hardware chip;

• Anti-Sybil attack mechanism, such as Proof of Humanity[24]

Summarize

Summarize

In the short term, blockchain voting of any kind should be limited to small experiments, either for more mainstream applications or for the blockchain space itself. Current security is clearly not good enough to rely on computers for everything. But it's improving, and if I'm wrong and security isn't improving, it's going to be very difficult for not only blockchain voting, but cryptocurrencies as a whole to succeed. So there is a lot of incentive for this technology to continue to improve.

We should all continue to pay attention to this technology and the efforts being made around the world to improve safety and slowly become more comfortable using technology in very important societal processes. Technology is already key to our financial markets, and encrypting a large portion of the economy will hand over an even greater portion of the economy to our encryption algorithms and the hardware that runs them. We should carefully observe and support this process, and use its benefits over time to bring our governance techniques into the 21st century.