\documentclass[dvipsnames,14pt,t]{beamer}

\usepackage{../slides}

\usepackage{../graphics}

\usepackage{../langs}

\setmonofont[Scale=.88]{Consolas}

\newfontfamily{\consolas}{Consolas}

\hfuzz=220pt 

% beamer stuff 

\renewcommand{\slidecaption}{APP 02, King's College London}

%Bank vs Voting

%http://www.parliament.vic.gov.au/images/stories/committees/emc/2010_Election/submissions/13_VTeague_EMC_Inquiry_No.6.pdf

% first cyber attack

%http://investigations.nbcnews.com/_news/2013/03/18/17314818-cyberattack-on-florida-election-is-first-known-case-in-us-experts-say

\newcommand{\bl}[1]{\textcolor{blue}{#1}}  

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{%

  \begin{tabular}{@ {}c@ {}}

  \\

  \LARGE Access Control and \\[-3mm] 

  \LARGE Privacy Policies (2)\\[-6mm] 

  \end{tabular}}\bigskip\bigskip\bigskip

\normalsize

  \begin{center}

  \begin{tabular}{ll}

  Email:  & christian.urban at kcl.ac.uk\\

  Office: & S1.27 (1st floor Strand Building)\\

  Slides: & KEATS (also homework is there)\\

  \end{tabular}

  \end{center}

\end{frame}

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{\begin{tabular}{c}This Course is about\\[-2mm]  ``Satan's Computer''\end{tabular}}

Ross Anderson and Roger Needham wrote:\bigskip

\begin{bubble}[10cm]

\small

``In effect, our task is to program a computer which gives 

answers which are subtly and maliciously wrong at the most 

inconvenient possible moment\ldots{} we hope that the lessons 

learned from programming Satan's computer may be helpful 

in tackling the more common problem of programming Murphy's.''

\end{bubble}\\[30mm]

\only<2>{

\begin{textblock}{11}(3.5,12)

\begin{tabular}{c}

\footnotesize Murphy's computer

\end{tabular}

\begin{tabular}{c}

\footnotesize Satan's computers

\end{tabular}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Defence in Depth}

\begin{center}\small

\pcode{urbanc:$6$3WWbKfr1$4vblknvGr6FcDeF92R5xFn3mskfdnEn...:...}

\end{center}

\begin{itemize}

\item hashes help when password databases are leaked

\item salts help with protecting against dictionary attacks

  and help people who have the same password on different sites\medskip

\item but they do not protect against a focused attack against a single 

  password and also do not make poorly chosen passwords any better

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Subtle Points}

\begin{itemize}

\item in our web-application the salt needed to remain secret;

  in password files the salt is public\bigskip

\item the NYT has the ``resource'' unlocked at first

  and locks it depending on the cookie data

\item our ``web-application'' has the resource locked at first,

  and unlocks it depending on the cookie data

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{How to Salt?}

\begin{center}\tt\small

\begin{tabular}{lcl}

1salt & $\Rightarrow$ & 8189effef4d4f7411f4153b13ff72546dd682c69\\

2salt & $\Rightarrow$ & 1528375d5ceb7d71597053e6877cc570067a738f\\

3salt & $\Rightarrow$ & d646e213d4f87e3971d9dd6d9f435840eb6a1c06\\

4salt & $\Rightarrow$ & 5b9e85269e4461de0238a6bf463ed3f25778cbba\\

\end{tabular}

\end{center}

\begin{itemize}

\item in Unix systems: \texttt{hash(salt + password)}, or even

\texttt{hash$^{\texttt{1500}}$(salt + password)}\smallskip\pause

\item Bruce Schneier in cases messages are long: \\

instead of \texttt{m $\mapsto$ hash(m)},\\ use \texttt{m $\mapsto$ hash(hash(m) + m)}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{Today's Lecture}

\begin{center}

\begin{tabular}{ccc}

\large online banking  & \hspace{3mm}\large{}vs\hspace{3mm} & \large e-voting\\

\textcolor{gray}{solved} & & \textcolor{gray}{unsolved}\\

\end{tabular}

\end{center}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[c]

\frametitle{E-Voting}

\begin{bubble}[9cm]

``Any electronic voting system should provide at least the same

security, privacy and transparency as the system it replaces.''

\end{bubble}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Voting as Security Problem}

What are the security requirements of a voting system?\bigskip

\begin{itemize}

\item<2->Integrity 

\item<3->Ballot Secrecy

\item<5->Voter Authentication

\item<6->Enfranchisement

\item<7->Availability

\end{itemize}

\only<2>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item The outcome matches with the voters' intend.

\item There might be gigantic sums at stake and need to be defended against.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<4>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item Nobody can find out how you voted.

\item (Stronger) Even if you try, you cannot prove how you voted.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<5>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item Only authorised voters can vote up to the permitted number of votes.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<6>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item Authorised voters should have the opportunity to vote.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\only<7>{

\begin{textblock}{5.5}(8,5)

\begin{bubble}[5cm]\small

\begin{center}

\begin{minipage}{4.5cm}

\begin{itemize}

\item The voting system should accept all authorised votes and produce results in a timely manner.

\end{itemize}

\end{minipage}

\end{center}

\end{bubble}

\end{textblock}}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Problems with Voting}

\begin{center}\large

\begin{tabular}{rcl}

Integrity & vs. & Ballot Secrecy\bigskip\\

Authentication & vs. &Enfranchisement   

\end{tabular}

\end{center}\bigskip\bigskip\pause

Further constraints:

\begin{itemize}

\item costs

\item accessibility

\item convenience

\item intelligibility 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{Traditional Ballot Boxes}

\begin{center}

\end{center}\pause\bigskip

mechanical, but they need a ``protocol''

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}

\frametitle{Motives for E-Voting}

\begin{itemize}

\item 76\% of pensioners in the UK vote, but only 44\% of the under-25s\bigskip

\item convenience\bigskip

\item speed 

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{E-Voting}

\begin{itemize}

\item The Netherlands between 1997 - 2006 had electronic voting

  machines\\ \textcolor{gray}{(hacktivists had found: they can be

    hacked and also emitted radio signals revealing how you voted)}

\item Germany had used them in pilot studies\\ \textcolor{gray}{(in

  2007 a law suit has reached the highest court and it rejected

  electronic voting on the grounds of not being understandable by the

  general public)}

\item UK used optical scan voting systems in a few test polls, but

  abandoned any wide deployment

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{E-Voting}

\mbox{}\\[-12mm]

\begin{itemize}

\item US used mechanical machines since the 30s, later punch cards,

  now DREs and optical scan voting machines

\item Estonia used in 2007 the Internet for national elections

  \textcolor{gray}{(there were earlier pilot studies in other

    countries)}

\item India uses e-voting devices since at least

  2003\\ \textcolor{gray}{(``keep-it-simple'' machines produced by a

    government owned company)}

\item South Africa used software for its tallying in the 1993

  elections (when Nelson Mandela was elected) \textcolor{gray}{(they

    found the tallying software was rigged, but they were able to

    tally manually)}

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{E-Voting in Estonia}

\begin{itemize}

\item worlds first general election that used internet voting (2007)

\item builds on the Estonian ID card (a smartcard like CC)

\item Internet voting can be used before the election (votes can be changed an

unlimited amount of times, last vote is tabulated, you can even change your

vote on the polling day in person)

\item in the 2011 parliamentary election 24\% voted via Internet\bigskip\pause

\item needs to trust the integrity of voters' computers, 

  central server components and the election staff

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\footnotesize

\lstinputlisting[language=Python,xleftmargin=0mm]{../progs/estonia.py}

\begin{textblock}{5.5}(7.8,0.5)

\begin{bubble}[5cm]\small

from \url{https://github.com/vvk-ehk/evalimine/}

\end{bubble}

\end{textblock}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

E-Voting in \textbf{Theory}

\small

\begin{itemize}

\item Alice prepares and audits a ballot, then casts an encrypted 

  ballot, which requires her to authenticate to a server.

\item A bulletin board posts Alice's name and encrypted ballot. 

  Anyone, including Alice, can check the bulletin board and find her 

  encrypted vote posted.

\item When the election closes, all votes are shuffled and the system produces 

  a non-interactive proof of a correct shuffling. (zero-knowledge-proofs)

\item After a reasonable complaint period to let auditors check the 

  shuffling, all shuffled ballots are decrypted, and the system provides 

  a decryption proof for each decrypted ballot. (zero-knowledge-proofs)

\item Perform a tally of the decrypted votes.

\item An auditor can download the entire election data and verify the 

  shuffle, decryptions and tally.

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[t]

\frametitle{A Brief History of Voting}

\begin{itemize}

\item Athenians

\begin{itemize}

\item show of hands

\item ballots on pieces of pottery

\item different colours of stones

\item ``facebook''-like authorisation 

\end{itemize}\bigskip

\textcolor{gray}{problems with vote buying / no ballot privacy}\bigskip

\item French Revolution and the US Constitution got things ``started'' with 

paper ballots (you first had to bring your own; later they were pre-printed by parties)

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[t]

\frametitle{\begin{tabular}{@ {}c@ {}}Ballot Boxes\end{tabular}}

Security policies with paper ballots:

\begin{enumerate}

\item you need to check that the ballot box is empty at the start of the poll / no false bottom (to prevent ballot stuffing)

\item you need to guard the ballot box during the poll until counting

\item tallied by a team at the end of the poll (independent observers) 

\end{enumerate}

\begin{center}

\end{center}

\end{frame}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

\begin{frame}[c]

Which security requirements do paper ballots satisfy better than voice voting?\bigskip

\begin{itemize}

\item Integrity

\item Enfranchisement

\item Ballot secrecy

\item Voter authentication

\item Availability

\end{itemize}

\end{frame}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%  

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\mode<presentation>{

\begin{frame}[t]

\frametitle{\begin{tabular}{@ {}c@ {}}Paper Ballots\end{tabular}}

What can go wrong with paper ballots?

\only<2>{

\begin{center}

\footnotesize William M.~Tweed, US Politician in 1860's\\

``As long as I count the votes, what are you going to do about it?''

\end{center}}

\only<3>{

\medskip

\begin{center}

\begin{minipage}{10cm}

{\bf Chain Voting Attack}

\begin{enumerate}

\item you obtain a blank ballot and fill it out as you want

\item you give it to a voter outside the polling station

\item voter receives a new blank ballot

\item voter submits prefilled ballot

\item voter gives blank ballot to you, you give money

\item goto 1

\end{enumerate}

\end{minipage}

\end{center}