Ballot stuffing in a postal voting system

Véronique Cortier (1) , Jérémie Detrey (2) , Pierrick Gaudry (2) , Frédéric Sur (3) , Emmanuel Thomé (2) , Mathieu Turuani (1) , Paul Zimmermann (2)

1 CASSIS - Combination of approaches to the security of infinite states systems
2 CARAMEL - Cryptology, Arithmetic: Hardware and Software
3 MAGRIT - Visual Augmentation of Complex Environments

We review a postal voting system used in spring 2011 by the French research institute CNRS and designed by a French company (Tagg Informatique). We explain how the structure of the material can be easily understood out of a few samples of voting material (distributed to the voters), without any prior knowledge of the system. Taking advantage of some flaws in the design of the system, we show how to perform major ballot stuffing, making possible to change the outcome of the election. Our attack has been tested and confirmed by the CNRS. A fixed postal voting system has been quickly proposed by Tagg Informatique in collaboration with the CNRS, preventing this attack for the next elections.

Domaines: Cryptographie et sécurité [cs.CR]

Véronique Cortier, Jérémie Detrey, Pierrick Gaudry, Frédéric Sur, Emmanuel Thomé, et al.. Ballot stuffing in a postal voting system. 2011 International Workshop on Requirements Engineering for Electronic Voting Systems (REVOTE 2011), 2011, Trento, Italy. pp.27 - 36, ⟨10.1109/REVOTE.2011.6045913⟩. ⟨inria-00612418⟩