![](bg5.png)
Nonce Nv ∈ a; V /∈ bad; V 6= Adm; V 6= Col; evs ∈ foo]]
=⇒ Agent V /∈ a
Although this statement is protocol-dependent, it
is simple enough be adapted to any e-voting proto-
col — precisely as the current literature shows with
the confidentiality goal. No honesty assumptions are
made about the election officials Administrator and
Collector.
The proof involvescase-splitsabout possibleasso-
ciations arising from each protocol step, and a num-
ber of lemmas specifying possible associations, such
as the following one:
lemma aanalz PR:
[[a ∈ aanalz Spy evs; Crypt P R ∈ a; evs ∈ foo]] =⇒
(Agent Col /∈ a ∨
(Agent V ∈ a −→ V ∈ bad ∨ V = Col) ∨
(Nonce Nv /∈ parts {R})) ∧
((Nonce Nv /∈ a) ∨
(Key (invKey P) ∈ analz (spies evs) ∧
Agent V /∈ parts {R}))
This lemma establishes properties of association
sets from the protocol model that contain at least one
ciphertext. It states that if a nonce appears as an
atomic component of the body of the ciphertext, then
either the name of the election official Collector does
not appear in the association, or all agent names ap-
pearing in it are either dishonest agents or the Collec-
tor.
Specifying and verifying the unlinkability model
involved substantial effort. About 20 subsidiary lem-
mas had to be proved beforehand. Many of them, like
the one just mentioned, analz PR, establish properties
of association sets. Remarkably, the generic nature of
the proof has great potential for reuse over other pro-
tocols. Also, its redundant parts may be programmed
as ML tactics for greater automation. In cases where
unlinkability does not hold, the subgoal that cannot
be proven indicates which protocol step can lead to
an attack.
5 CONCLUSIONS
We shed a different light on voter privacy by seeing
it as unlinkability property between two pieces of in-
formation. The feasibility of this model is shown by
a specification in the Inductive Method and a suc-
cessful privacy proof for a classic e-voting proto-
col. While the process equivalence model is show-
ing steady progress through new trace equivalence
approximations, our machine-assisted analysis is pre-
cise for an unbounded number of sessions, and sup-
ports proof reuse. Its interactive nature also provides
broader protocol understanding to the analyst. Since
process equivalence-based methods are not currently
able to deal with all protocols, it seems worthwhile to
investigate alternative approaches like this one.
A submission of our Isabelle theories to the online
Archive of Formal Proofs (Klein et al., 2012) is being
prepared.
Future Work. Demonstrating the flexibility and
reusability of our specification through additional ex-
amples is our main next task. The proofs must be
adapted to a generalised association synthesiser. We
then intend to analyse protocols that cannot be han-
dled in current implementations of the indistinguisha-
bility model, such as e-passport protocols, and in-
vestigate the specification of associative/commutative
operators. Finally, we plan to model other privacy-
type properties, such as coercion resistance.
REFERENCES
Bella, G. (2007). Formal Correctness of Security Protocols.
Information Security and Cryptography. Springer.
Blanchet, B. (1998). An efficient cryptographic proto-
col verifier based on Prolog rules. In Proc. of the
14th IEEE Computer Security Foundations Workshop
(CSFW’01), pages 82–96. IEEE Press.
Blanchet, B., Abadi, M., and Fournet, C. (2008). Auto-
mated verification of selected equivalences for secu-
rity protocols. Journal of Logic and Algebraic Pro-
gramming, 75(1):3–51.
Blanchet, B. and Podelski, A. (2005). Verification of
cryptographic protocols: tagging enforces termina-
tion. Theoretical Computer Science, 333(1-2):67–90.
Special issue FoSSaCS’03.
Chadha, R., Ciobˆac˘a, S¸., and Kremer, S. (2012). Auto-
mated verification of equivalence properties of cryp-
tographic protocols. In Programming Languages and
Systems —Proceedings of the 21th European Sympo-
sium on Programming (ESOP’12), Lecture Notes in
Computer Science. Springer. To appear.
Delaune, S., Kremer, S., and Ryan, M. (2009). Verifying
privacy-type properties of electronic voting protocols.
Journal of Computer Security, 17(4):435–487.
Delaune, S., Kremer, S., and Ryan, M. D. (2010). Verifying
privacy-type properties of electronic voting protocols:
A taster. In Towards Trustworthy Elections – New Di-
rections in Electronic Voting, volume 6000 of Lecture
Notes in Computer Science, pages 289–309. Springer.
Delaune, S., Ryan, M., and Smyth, B. (2008). Automatic
verification of privacy properties in the applied pi cal-
culus. Syntax, 263/2008:263278.
Fujioka, A., Okamoto, T., and Ohta, K. (1993). A practical
secret voting scheme for large scale elections. In Pro-
ceedings of the Workshop on the Theory and Applica-
tion of Cryptographic Techniques: Advances in Cryp-
tology, ASIACRYPT ’a92, pages 244–251. Springer-
Verlag.
VerifyingPrivacybyLittleInteractionandNoProcessEquivalence
255