I still don't get it. The ballot is effectively a pivot between the voter and the result. You can't just disconnect this without sacrificing the integrity of the system. If you scramble it so that the vote and the ballot are disconnected, there is no way to prove the results are valid. And if you disconnect the voter from the ballot, you can make up all the votes you want.
But let's say the Input->Output is reproducible all the time with no chain between the voter and the result. You /still/ have no way to ensure that the checkbox corresponded with the name, and that you cast the vote you think you did. Perhaps this is outside the scope of the article, but its a fairly glaring deficiency.
Perhaps I'm misunderstanding. But all you can tell with this system is that "your" ballot went into the magic box and a (presumably reproducible) result came out the other side.
I think you're saying that you don't understand how mixnets guarantee integrity -- if that's incorrect, I apologize. Mixnets allow you to verify that the data in is _identical_ to data out (modulo the salts) that serve an anonymize the data. It isn't just reproducible, but verifiable. The results coming out the other end are the final decrypted ballots which anyone can count and verify the totals.
You can't know which final ballot was your vote, but you can know that your ballot was in the mix coming in, and that the mix going out wasn't altered (within some probabilistic bounds).
Mixnets allow you to verify that the data in is _identical_ to data out (modulo the salts) to make it so that data an anonymized.
I think this is the part I don't understand. Partly because I don't know anything about mixnets, and it feels like its paradoxical. But if that's how it is, then I can accept it.
Not OP, but that helped me at least, so thank you. The description of the mixnet seems a bit similar to the way Tor anonymizes where requests come. What I'm not clear on is how a voter can know that the mixnet is working correctly. I.e. I understand how the voter can verify that their second bubble from the top was recorded, but can they also verify that that was correctly counted as a vote for John Jackson?
You /still/ have no way to ensure that the checkbox corresponded with the name, and that you cast the vote you think you did
Well the voter can verify if the voting machine is acting honestly by querying the salt used for encryption (refer to "How do you know your ballot was properly constructed?"). From an adversarial voting machine's perspective the chances of the voter validating the ballot is 0.5 and given the sensitivity of the elections, I'd imagine even one incident of foul play spreading like wildfire to raise alarms
Comments
I still don't get it. The ballot is effectively a pivot between the voter and the result. You can't just disconnect this without sacrificing the integrity of the system. If you scramble it so that the vote and the ballot are disconnected, there is no way to prove the results are valid. And if you disconnect the voter from the ballot, you can make up all the votes you want.
But let's say the Input->Output is reproducible all the time with no chain between the voter and the result. You /still/ have no way to ensure that the checkbox corresponded with the name, and that you cast the vote you think you did. Perhaps this is outside the scope of the article, but its a fairly glaring deficiency.
Perhaps I'm misunderstanding. But all you can tell with this system is that "your" ballot went into the magic box and a (presumably reproducible) result came out the other side.
I think you're saying that you don't understand how mixnets guarantee integrity -- if that's incorrect, I apologize. Mixnets allow you to verify that the data in is _identical_ to data out (modulo the salts) that serve an anonymize the data. It isn't just reproducible, but verifiable. The results coming out the other end are the final decrypted ballots which anyone can count and verify the totals.
You can't know which final ballot was your vote, but you can know that your ballot was in the mix coming in, and that the mix going out wasn't altered (within some probabilistic bounds).
I think this is the part I don't understand. Partly because I don't know anything about mixnets, and it feels like its paradoxical. But if that's how it is, then I can accept it.
Not OP, but that helped me at least, so thank you. The description of the mixnet seems a bit similar to the way Tor anonymizes where requests come. What I'm not clear on is how a voter can know that the mixnet is working correctly. I.e. I understand how the voter can verify that their second bubble from the top was recorded, but can they also verify that that was correctly counted as a vote for John Jackson?
Well the voter can verify if the voting machine is acting honestly by querying the salt used for encryption (refer to "How do you know your ballot was properly constructed?"). From an adversarial voting machine's perspective the chances of the voter validating the ballot is 0.5 and given the sensitivity of the elections, I'd imagine even one incident of foul play spreading like wildfire to raise alarms