Medusa found vulnerability in the Internet voting system. Part of the vote can be decrypted even before the official count

At the all-Russian vote on amendments to the Constitution of the Russian Federation, an experiment with Internet voting continued. The developers have changed the voting system so that the voter can now guaranteed to decipher his own voice. On the one hand, it is easier to force to participate in the vote. On the other hand, it is possible to partially control the honesty of vote count.

The Moscow Information Technology Department changed the voter encryption scheme

In 2019, the Moscow Information Technology Department developed a remote voting system using blockchain. Then the votes of voters were encrypted using their own implementation of the El Hamal scheme . Experts twice found various kinds of vulnerabilities in it.

Now, in the voter browser, his voice is encrypted using the Tweetnacl.js JavaScript library. Its author Dmitry honest learned from Medusa about the use of his program developers of remote electronic voting.

What is this program

Honest ones portended on the JavaScript program Tweetnacl - the compact implementation of the NACL (Networking and Cryptography Library) program, developed by the famous cryptographs Daniel J. Bernstein), Tanya Lange and the Piter) Schwabe (Peter Schwabe). All these programs use the Elliptical Curve25519 curve to coordinate the keys, and the Poly1305 algorithms for messages and SALSA20 authentication for encryption.

Now, before the official counting of the votes (!), The Internet recovery can decipher his voice himself or allow it to make it to outsiders

The previous system with the El Hamal scheme provided probabilistic encryption of the vote of the vote: when using the same parameters in practice, a new cipher text has always been obtained. The message could not have been deciphered for sure, without getting the secret key to the recipient (election commission).

The new system is distinguished by deterministic encryption: the use of the same parameters leads to the formation of identical ciphertexts. Moreover, the sender and recipient form a common key (Shared Key), which is suitable for both encryption of the message and for its decoding.

That is, the voter now not only can send an encrypted choice to the exaggeration server, from where he will get into the blockchain, but also successfully decipher it. He does not need to wait for the beginning of the official counting of votes and the publication of the secret key of the election commission - it is enough to save your secret key formed in the browser on the electronic ballot page.

We conducted an experiment, and it turned out that getting your secret key is relatively easy.

In order to maintain a secret key generated in the browser, we received an electronic ballot at Google Chrome, opened the “Development tools”, chose the Sources tab, found the Election.js library, found a line with the generation of a secret and public keys, put a logpoint after it (a point, reaching which a browser is a brows He will write down the required debuging information in the console): 'Voter Secret Key Is', Encryptor.keypair.Secretkey. And only after that they voted.

We successfully deciphered the votes of voters who participated in our experiment

Necessary keys and script

General data for all voters

• 1a434CEB91EFB84F17E9A8103E2CE12C1479797C585BB8F142E978DE707 (public key
• 83DCEFB7 (as the Voice "For" is encoded)
• 1AD5BE0D (as the voice "against" is encoded)

Unique data of the first voter

Public voter voting data

• F7F4E6A567563E09052CB2C13BC81E98531424 (encrypted message)
• 39D48319E36FC40B30E9254441E071CFF16CEFDAF434 (Nonce)
• 76D57D4CD3B83D8897A74003BCBC1BD2EC1F1F1F1F1F10A286A407D272999AE36CEB37B (public key of the voter)

The secret key to the voter from his browser

• CBAAA9D43A5ECDFD3A5F0882335801F50DA6F988CF2C31FEFB5481C69C0EFD

Unique data of the second voter

Public voter voting data

• B685E869BB3AF8CE294B788D135ABE7C4E72ACB7 (encrypted message)
• FC2FCB210D5CE41F3EC715BDABCC7BDA43F5A407959D6E (Nonce)
• 0a19b933335BF068021D5E6B09FE64F45504D29D5137D4FF125EDA75EBF05 (public key of the voter)

The secret key to the voter from his browser

• 7DF5EBFB215458153DD695B2F02A66895CF86E285C363D68A2A83A7FB11A6F

Now you can decipher these voices yourself

Here is a script that allows you to decipher the voices of Internet recipients who have retained their secret keys.

1. Download the Votes.js file (the data of the first and second voters have already been entered)
2. Put it in some folder (directory)
3. Inside this folder in the terminal, dial and run the NPM Install Tweetnacl command (to install Tweetnacl.js)
4. After this, run node votes.js and check for which voters cast their votes
5. If the CEC publishes official results, it will be possible to follow the links to transactions with the votes of two voters and compare this decoding with what will be recorded in the blockchain.

If you have not retained your secret key, then you will not be able to decipher your voice yourself - until the publication of the secret key of the election commission.

Bad news: so you can force voting

Now, in theory, the employer can not only check that his employee was precisely voted (demanding to indicate a specific transaction with the voice ), but also find out how he ordered his voice (demanding to maintain a secret key). At the same time, it is not necessary for the employee to be technically savvy. He, for example, may ask to establish a special expansion for a browser, which will replace generated keys to static. Thus, the task of deciphering votes will be greatly simplified.

Good news: so you can control the calculation

But the same feature can be used to control the honesty of votes, when the election commander refuses to release the decoding of each specific voice ( as was the case in 2019 ). For example, supporters of one of the candidates may agree on the installation of the same extension for the browser. In this case, right during the vote, they can track a minimum of votes that their candidate should definitely receive after the count.

Developers of the Internet voting system can prohibit voters with the same pair of keys, but this will not save them. Dmitry honest offered possible ways to bypass such a ban: “For example, such an extension can generate the keys determinically, taking a hash from a static secret and a name (and some voter number)-then it will be difficult to detect, because the keys to the keys will be different, but the one who owns a secrecy can reduce them again.” That is, for an external observer, the keys generated by the expansion will look random, but the authors of this extension will be able to restore the keys, knowing certain additional parameters. Another option proposed by the author Tweetnacl.js: “Expansion can simply write the keys to the central base. The Curve25519 algorithm is very fast, so it is not difficult to decipher millions of votes. ”

“In any case, this, of course, is complete nonsense, and not a system of electronic voting,” Dmitry honest summed up.

To close this loophole, the Moscow Information Technology Department will again have to completely change the vote encryption scheme. It is unlikely that this can be done before a single voting day in September 2020.

An unexpected bonus! Voters will be able to leave messages in electronic ballots - like inscriptions on paper

On the Electronic Bulletin page in the voter browser, not only a pair of keys is generated, but also Nonce - a special number that should change when creating a new cipher sequel ( n umber used only only only only ).

It is generated randomly, but theoretically it can also be replaced by expansion. This number is long enough to personalize the ballot. 24 bytes allow you to record a few words in Russian in the UTF-8 encoding (or a whole phrase in English), put a few emoji or speak out in some other way. In this case, this will not affect the quality of encryption.

True, in order to read such a message, most likely, it will also be necessary to install a special extension or wait for the collections of “decrypted” messages from observers.

Denis Dmitriev

The author thanks for participating in the experiment of Mikhail Zelensky , Evgeny Davydov and Dmitry Kartsev