Paper 2020/909 Original: eprint.iacr.org/2020/909 ↗
When is a test not a proof?
Abstract
A common primitive in election and auction protocols is plaintext equivalence test (PET) in which two ciphertexts are tested for equality of their plaintexts, and a verifiable proof of the test's outcome is provided. The most commonly-cited PETs require at least one honest party, but many applications claim universal verifiability, at odds with this requirement. If a test that relies on at least one honest participant is mistakenly used in a place where universally verifiable proof is needed, then a collusion by all participants can insert a forged proof of equality into the tallying transcript. We show this breaks universal verifiability for the JCJ/Civitas scheme among others, because the only PETs they reference are not universally verifiable. We then demonstrate how to fix the problem.
Metadata
- Available format(s)
PDF- Category
- Cryptographic protocols
- Publication info
- Preprint.
- History
- 2020-09-03: last updated
- 2020-07-18: published
- Short URL
- https://ia.cr/2020/909
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2020/909,
author = {Eleanor McMurtry and Olivier Pereira and Vanessa Teague},
title = {When is a test not a proof?},
howpublished = {Cryptology {ePrint} Archive, Paper 2020/909},
year = {2020},
url = {https://eprint.iacr.org/2020/909}
}