On Wed, Apr 07, 2004 at 03:42:47PM -0400, Ian Grigg wrote:
It seems to me that the requirement for after-the-vote verification ("to prove your vote was counted") clashes rather directly with the requirement to protect voters from coercion ("I can't prove I voted in a particular way.") or other incentives-based attacks.
You can have one, or the other, but not both, right?
Suppose individual ballots weren't usable to verify a vote, but instead confirming data was distributed across 2-3 future ballot receipts such that all of them were needed to reconstruct another ballot's vote.
It would then be possible to verify an election with reasonable confidence if a large number of ballot receipts were collected, but individual ballot receipts would be worthless.
If I'm happy to pervert the electoral process, then I'm quite happy to do it in busloads. In fact, this is a common approach, busses are paid for by a party candidate, the 1st stop is the polling booth, the 2nd stop is the party booth.
In the west, this is done with old people's homes, so I hear.
Now, one could say that we'd distribute the verifiability over a random set of pollees, but that would make the verification impractically expensive.
iang
