A comprehensive analysis of game-based ballot privacy definitions
Résumé
We critically survey game-based security definitions for the privacy of voting
schemes. In addition to known limitations, we unveil several previously
unnoticed shortcomings. Surprisingly, the conclusion of
our study is that none of the existing definitions is satisfactory: they either
provide only weak guarantees, or can be applied only to a limited class of
schemes, or both.
Based on our findings, we propose a new game-based definition of privacy
which we call BPRIV. We also identify a new property which we call {\em strong
consistency}, needed to express that tallying does not leak sensitive
information. We validate our security notions by showing that BPRIV, strong
consistency (and an additional simple property called strong correctness) for a voting scheme imply its security in
a simulation-based sense.
This result also yields a proof technique for proving entropy-based
notions of privacy which offer the strongest security guarantees but are hard
to prove directly: first prove your scheme BPRIV, strongly consistent (and correct),
then study the entropy-based privacy of the result function of the election,
which is a much easier task.