siv-org / siv

Secure Internet Voting protocol
https://siv.org
Other
12 stars 6 forks source link

Duplicate Verification Numbers #229

Open GABuras opened 1 month ago

GABuras commented 1 month ago

Based on the procedures page, it appears that the voter's verification number is being randomly generated on their own device. If this is the implementation, then there will always be a chance (however small) that multiple voters will end up with identical verification numbers.

When duplicate verification numbers appear in the public list at the end, they will undermine voter confidence that one's vote was counted. There will likely be conspiracies spread that use the duplicate verification numbers as evidence. If the votes with identical verification numbers are the same with respect to their choices in candidate and everything as well, it would be challenging to convince the public that a voter did not get counted twice.

It would be challenging to resolve this issue without undermining voter anonymity. However, one thing that we can do is remove references to the verification number as a "unique value". Such terminology would be used to undermine the legitimacy of the election when duplicates occur by rightfully concerned observers. I think it would be most appropriate to simply stick to "random value".

GABuras commented 1 month ago

This issue could also be partially mitigated by increasing the length of the verification number. It would be good to look at the math the calculate the likelihood of duplicates appearing at different verification number lengths.

dsernst commented 1 month ago

Duplicate of https://github.com/siv-org/siv/issues/87

GABuras commented 1 month ago

Duplicate of #87

Thanks, I didn't see this

arianabuilds commented 2 weeks ago

Entry Summary for HACK SIV @ DEF CON 2024

Thanks again for participating! This submission earned $22.68 from SIV and $197.92 from the Public Vote, for a total of $220.60.

Here's what we noted in our evaluation:

What's interesting about this submission

What takes away from it

Issue to track getting paid: https://github.com/siv-org/hack.siv.org/issues/9