Survey on Remote Electronic Voting <s> D. Coercion Evidence <s> We introduce a model for electronic election schemes that involves a more powerful adversary than previous work. In particular, we allow the adversary to demand of coerced voters that they vote in a particular manner, abstain from voting, or even disclose their secret keys. We define a scheme to be coercion-resistant if it is infeasible for the adversary to determine if a coerced voter complies with the demands.A first contribution of this paper is to describe and characterize a new and strengthened adversary for coercion in elections. (In doing so, we additionally present what we believe to be the first formal security definitions for electronic elections of any type.) A second contribution is to demonstrate a protocol that is secure against this adversary. While it is clear that a strengthening of attack models is of theoretical relevance, it is important to note that our results lie close to practicality. This is true both in that we model real-life threats (such as vote-buying and vote-canceling), and in that our proposed protocol combines a fair degree of efficiency with an unusual lack of structural complexity. Furthermore, previous schemes have required use of an untappable channel throughout. Ours only carries the much more practical requirement of an anonymous channel during the casting of ballots, and an untappable channel during registration (potentially using postal mail).This extended abstract is a heavily truncated version of the full paper available at http://eprint.iacr.org/2002/165. <s> BIB001 </s> Survey on Remote Electronic Voting <s> D. Coercion Evidence <s> The balance between coercion-resistance, election verifiability and usability remains unresolved in remote electronic voting despite significant research over the last few years. We propose a change of perspective, replacing the requirement of coercion-resistance with a new requirement of coercion-evidence: there should be public evidence of the amount of coercion that has taken place during a particular execution of the voting system. We provide a formal definition of coercion-evidence that has two parts. Firstly, there should be a coercion-evidence test that can be performed against the bulletin board to accurately determine the degree of coercion that has taken place in any given run. Secondly, we require coercer independence, that is the ability of the voter to follow the protocol without being detected by the coercer. To show how coercion-evidence can be achieved, we propose a new remote voting scheme, Caveat Coercitor, and we prove that it satisfies coercion-evidence. Moreover, Caveat Coercitor makes weaker trust assumptions than other remote voting systems, such as JCJ/Civitas and Helios, and has better usability properties. <s> BIB002
There are many schemes which claim to achieve coercion-resistance or at least receiptfreeness, but to our knowledge all of them do so by requiring either a lot of resources on the side of the voting officials or impend the usability for the typical voter by requiring her to perform tasks which are either too complicated or not realistic (e.g. providing untappable channels). Grewal et al. BIB002 argue similarly and define coercion-evidence. Coercion-evidence is fulfilled if the two con- BIB001 . In Caveat Coercitor multiple votes can be made and a heuristic, utilizing multiple votes of the same voter who chose different candidates, can determine coerced votes. The benefit of that approach is that the coerced voter does not have to be aware of the coercion. Even coercion due to leaked credentials is successfully recognized if the voter follows normal protocol for voting. The drawback is that enough voters who want to manipulate the election can choose not to follow the protocol and that way push the upper bound on coerced votes to a percentage where the election is rendered invalid. To solve this Grewal et al. propose to either disincentive dishonest voting by making it an offence or by replacing the coercion-evidencetest with a probabilistic variant, but leave the decision up to future work.