As seems universally the case in security design, there must
be ugly tradeoffs.  In particular (and without quoting acres
of prior material), the proposed requirements for verifiability
and non-coercibility are at odds and one must yield to the
other.  Paper systems make this tradeoff by, on the one hand,
the polling booth (non-coercibility once within) and, on the
other hand, the supervision of the counting process by opponents
(verifiability by proxy), at a cost of zero technology.  Bettering
this in the real world is challenging.


as used here

  -- voter may verify that his vote counted as he intended it to count
  -- voter cannot be compelled to show how he voted, during or after

 If the voter can verify, then he can be coerced to do so.
 If voter cannot be coerced, then he cannot verify.


Reply via email to