JP3529073B2 - Electronic secret ballot method - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic secret ballot method for realizing a safe and fair secret ballot vote when a vote or a questionnaire survey is conducted using electronic means.

[0002]

2. Description of the Related Art Electronic secret balloting can keep the correspondence between voter and vote contents secret, and is suitable for protecting the privacy of an individual's ideological belief. Therefore, voting by two-way communication such as electronic conference and CATV, It can be used for questionnaire surveys.
In order to conduct a secure and fair anonymous vote in telecommunications, it is necessary to prevent voter disguise, double voting, and leakage of voting content due to wiretapping of voting text. As a method for solving these problems, an electronic voting method using a digital signature has been proposed. For example, Kazuo Ohta: “Electronic Voting Method Using a Single Election Administrator”, 1988 IEICE. There is the national convention in spring, A-294 (Showa 63-3).

However, this method has the following drawbacks. The voter's election content is published (without a note) on a bulletin board, etc., so that the voter can easily distinguish it from other votes. This feature allows you to file an opposition when your vote is ignored (not published) and helps ensure the legitimacy of the election results.

On the other hand, this feature means that information known only to the voter himself / herself can be used as evidence of the vote. In other words, there is a risk that the evidence of the vote will be used to buy the voter and prove that the voter bought the vote as it was said. There is also a risk of being used to force voting due to intimidation.

[0005]

SUMMARY OF THE INVENTION An object of the present invention is to provide a safe electronic secret balloting method in which no evidence of voting can be made.

[0006]

The present invention uses two techniques. One is used in the invention of claim 1 and uses an encryption method that can be decrypted in any number of ways as long as it has secret information. That is, the voter V _i encrypts the voting content v _i into m _i = E (v _i , r _i ) using the random number r _i ,
It will be disclosed as voting information, but the voter himself V
_i is, your own E by using the secret information a _i have is _{(v i, r i) =} E (v i ", r i") to become like _{(v i ", r i"} ) (v i ≠ v _i ″). Due to this property, voters are actually (v _i , r
_i ), even if you vote for
Evidence falsely saying that (v _i ″, r _i ″) has been voted can be presented. Therefore, the cryptographic function E is used to eliminate the evidence of voting.

In the invention of claim 2, E is the above-mentioned property
Even if you have the_i, R_i)
If so, that is evidence of the vote. To prevent this
First, m _i= E (v_i, R_i) And v_iKeep the correspondence of secret
Leave it, v_iIs adopted.

[0008]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described below. FIG. 1 shows a system configuration example to which the present invention is applied. Voter apparatus of I's voter V _i 100
Is the administrator device 200 of the election administrator A, the aggregator, the aggregator device 300, the list display 400, and the communication path 5
Assume that they are connected via 00. In addition, it is assumed that all the voters can access the list display 400.
FIG. 2 shows an example of a communication sequence of the present invention. Hereinafter, FIG. 3 shows a functional configuration example of the voter device 100, FIG. 4 shows a functional configuration example of the totalizer device 300, and FIG. 5 shows a list display 4 respectively.
The following are examples of postings of 00.

In the following, the voter V _i (i = 1, 2,
, I) will vote for the totalizer device 300 after the vote content v _i has been approved by the election manager A. The voting procedure is shown below. First, as a parameter commonly used in the system, a value p, which satisfies the following conditions,
It is assumed that q, g, and h are set. p, q: prime q | p-1 (q is a divisor of p-1) q, hεZ _p ^* (multiplication group) and the order is q, that is, g ^q ≡h
^q ≡ 1 (mod p), and g ≠ h ≠ 1, and a
The value of (h = g ^a mod p) shall not one knows (e.g., by using a common pseudo-random number generation algorithm, published g, to produce independently h).

1. The voter device 100 of the voter V _i prepares for voting as follows. First, the random number generator 101 is used to generate a _i εZ _q , and the remainder calculator 102 is used to calculate G _i = g ^ai mod p. Next, voter V _i
Determines the voting content v _i and inputs it to the voter apparatus 100. The voter apparatus 100 uses the random number generator 101 to generate a random number r _i , and uses the remainder calculator 103 to calculate m _i = BC ( v _i , r _i ) = g ^vi G _i ^ri mod p,

2. The voter V _i device 100 uses the blind signature method (David Chaum: "Security without identifica
tion: Transaction systems to make big brother obso
lete ", Communications of the ACM, Vol.28, No.10, p
p.1030-1044 (described in Oct., 1985)) to obtain the signature s _i of the election manager device 200 for (m _i , G _i ).

3. Voter V_iThe device 100 is (m_i，
G_i, S_i) Is anonymously sent to the list display device 400 and posted.
To do. Voter V_iThe device 100 is the totalizer device 30.
To 0 (v _i, R_i, M_i) In secret (for example, encrypted communication
Send) 4. The aggregator device 300 appropriately divides voters into groups.
All (most) candidates in each group.
Be included in the vote content. For example, below
In a group of five voters to simplify the story
I will explain about it.

In this example, the list display 400 is displayed.
The following are ((m₁, G₁), ..., (m_Five, G
_Five)) Corresponds to this group, the aggregator device 30
Declared by 0. Furthermore, the voting contents (v₁，
v₂, V₃, V_Four, V_Five) Is an aggregator in random order
It is published by Oki 300. Where the order is random
Let π be the substitution to₁′, V
₂′, V₃′, V_Four′, V _Five′ ＝ {π (v₁), Π (v
₂), ..., π (v_Five)}. For example, the substitution π
(1, 2, 3, 4, 5) → (2, 4, 1, 5, 3)
Then, (v₁′, V ₂′, V₃′, V_Four′, V_Five′) ＝
(V₂, V_Four, V₁, V_Five, V₃). Note that π is
This is a secret that only the totalizer device 300 knows.

5. The totalizer device 300 uses the following method (v
₁′, V₂′, V₃′, V_Four′, V _Five′) Is the correct vote
Π, (r₁, ..., r_Five) Was kept secret
As it is, the proof information σ is announced. Below, the raw of σ
I will show you how. The totalizer device 300 arranges the five elements
Replace replace δ_jRandomly using the random number generator 301
, K (j = 1, ..., k) are selected, and the random number u_ij, S
_ij, T _ij∈ Z_q(I = 1, ..., 5; j = 1, ..., k)
Choose.

Next, the remainder calculator 302 is used to calculate the following. Z _ij = m _i G _i ^Sij h ^uij mod p, W _ij = g ^v ′ ⁱ ′ h ^tij mod p, i = δ _j (i) (i = 1, ..., 5 ij = 1, ..., k) , F as a function for compressing data of arbitrary length into k bits, (e ₁ , e ₂ , ..., E _k ) = F (Z ₁₁ , ..., Z _5k ,
W ₁₁ , ..., W _5k ) is calculated. Here, e _j ε {0,1} (j = 1, ...,
k).

Next, a judgment is made using the comparator 305 according to the value of e _j , and if e _j = 0 (j = 1, ..., K), then Y _j = (δ _j , u _ij , s) _ij , t _ij (i = 1, ..., 5))
If e _j = 1 (j = 1, ..., K), the aggregator apparatus 300 uses the permutation operator 304 and the remainder operator 306 to calculate ρ _j = π ⁻¹ oδ _j ⁻¹ , (AoB Represents the combination of the functions A and B) x _ij = r _i + s _ij mod p, y _ij = u _ij −t ρ _{j (i)} mod p, and Y _j = (ρ _j , x _ij , y _ij (I = 1, ...,
5)).

From the above, the proof information σ is defined as follows. σ = (Z ₁₁ , ..., Z _5k , W ₁₁ , ..., W _5k , Y ₁ , ..., Y
_k ) 6. Verification of the correctness of the proof information σ is performed as follows.
(In the following, an example in which the voter apparatus 100 performs verification will be described.) First, the function calculator 104 of F has a value of (Z ₁₁ , ..., Z _5k ,
W ₁₁ , ..., W _5k ) is input (e ₁ , e ₂ , ..., E _k )
Ask for.

Next, a judgment is made using the comparator 106 according to the value of e _j , and if e _j = 0 (j = 1, ..., K),
Using the remainder calculator 107 and the comparator 108, Z _ij = m _i G _i ^Sij h ^uij mod p, W _ij = g ^v ′ ⁱ ′ h ^tij mod p, i ′ = δ _j (i) (i = 1, 1 ..., 5) is confirmed.

If e _j = 1 (j = 1, ..., K), the voter unit 100 uses the remainder calculator 109 and the comparator 110 to obtain W _i'j G _i ^xij h ^yij ≡Z _ij ( mod p), i ′ = ρ _j
Verify whether (i) holds. In the above, the signature by the election manager device is not necessarily required.

[0020]

First, in the invention of claim 1, m _i = BC
(V _i , r _i ) = g ^vi G _i ^ri mod In p, the voter V _i owns the confidential information a _i (G _i = g ^ai mod)
p) after determining m _i = g ^vi G _i ^ri mod p, then for any v _i ′ εZ _q , m _i = g ^vi G _i ^ri mod p = g ^vi ′ G _i ^ri ′ It is possible to calculate r _i ′ εZ _q such that mod p. Thus, a voter, even if he actually voted for (v _i , r _i ), would be given to any v _i ″ εZ _q
False evidence (v _i ″, r _i ″) that the user has voted can be presented.

In addition, the aggregator is a proof of voting._iTo
Keep it secret, m_iAnd v_iKeeping the correspondence relationship of
As such, there is no evidence of voting. Meanwhile, billing
In the invention of Item 2, the aggregator publishes σ_i
= BC (v _i, R_i) And v_iKeep the correspondence of
Well, v_iHas proved that the content of the vote is correct,
When such a proof is attached, the aggregator is not allowed to vote
_i ^*Is almost impossible to publish. That is, aggregator
You can verify fraud, such as changing the voting content of
It

[Brief description of drawings]

FIG. 1 is a block diagram showing a system configuration example to which the method of the present invention is applied.

FIG. 2 is a diagram showing a sequence example of the method of the present invention.

FIG. 3 is a block diagram showing a functional configuration example of a voter device 100.

FIG. 4 is a block diagram showing a functional configuration example of a totalizer device 300.

FIG. 5 is a diagram showing a bulletin example.

Claims (2)

(57) [Claims] 1. A method of electronically realizing a secret ballot by a voter device of a voter V _i , an election manager device of an election manager, and an aggregate manager device of an aggregator, wherein the voter V _i device comprises: , The voting content v _i using the random number r _i
By encrypting _i = E (v _i , r _i ) and using the secret information a _i which only the voter V _i device has, E (v _i , r _i ) = E (v _i ″, r _i ″) And calculate (v _i ″, r _i ″) (v _i ≠ v _i ″) such that
_{(V i ", r i"} ) was retained as evidence under False, the m _i
Send to the aggregator device and collect (v _i , r _i ) by encrypted communication
Electronic secret ballot wherein the Rukoto sent to a total of user device. 2. The voter V _i device sends m _i to the display device, and the display device publishes the vote (m ₁ , ..., M _b ) (b is the total number of voters) and the aggregator device is v _{, 1} , ..., V _b are in random order v ₁ ′, ..., V _b ′, and any v _i ′ (i =
l, ..., b) also has information σ and v ₁ ′, ..., v that prove that the correct voting content of any of (m ₁ , ..., _mb ).
_2. The electronic secret balloting method according to claim 1, wherein b'is sent to the display unit and disclosed.