hi guys my name is Patrick McCrory I'm a
researcher at UCL and I'm gonna talk to
you about some work I did last summer
while I was doing my PhD at Newcastle I
did it in Calabria so my colleagues Fong
how and see a Mac so this toast gonna be
about a voting but before I really get
into it I like to highlight what
researchers tend to think about when we
say e-voting so we normally think about
end-to-end verifiable systems and the
break that down the idea is that when I
go to a polling station and I cast my
vote I did have confidence that Mary
vote has been cast as intended when I
leave the polling station I should be
able to look at this public bulletin
board and verify the my vote has been
included in the tally we're not in the
tally my vote has been cast and then
after the election I should be able to
verify that my vote was indeed included
in the tally so that is an N the N
verifiable system and we achieve this
system we normally assume the existence
of his public bulletin board that
everybody can see but for the past I
guess 30 years we've not really been
able to achieve a practical public
bulletin board the best we have is a
single web server where I contact the
web server i download theater and i have
to try to detect that that web server is
cheating me so that's not really good
enough so now people are thinking okay
can we use the blockchain for a voting
does this pervade the consistency
property that we want and I'm going to
argue potentially and I'm going to say
it's probably very useful for
small-scale accents a boardroom voting
because it does pervade this consistency
property where anybody who don't lose
the blockchain you can turn over the
Genesis block and you can verify the
entire history of that blockchain
so like every Bitcoin transaction in
every aetherium transaction and I don't
need to trust anyone to get the ensure
that I have a consistent view of
everybody else so we sort of think is
ideal world and I'm not the first person
to notice this so last year I did a
Google search and lots of people were
getting excited about the blockchain and
e-voting
so now we needed to say it okay what
blockchain are we going to use
what about Bitcoin should we use Bitcoin
for a voting and I want to summarize and
say no I don't think bitcoins are very
good players to do this because we can
only store 80 bytes of arbitrary data on
Bitcoin can only store the information
it cannot verify that our protocol was
correctly executed so then I'm going to
go okay what about aetherium and I don't
really need a preach to the choir here
do i I think everybody in this room
understands that a theorem is gonna be
amazing and when I made this slide a
theorem was worth 20 billion dollars
it's worth more now I don't really know
how much it's worth now but the point of
a theorem is that we can run expressive
but bounded programs ie new the gas
metric and as a bit like a computer from
the 1970s that everybody has access to
it's Sloane as expensive but we're going
to get away and we're going to do some
avoiding on it and of course as I said
this votes about voting and not
necessary blockchains so last who this
actually it's a bit of a story behind us
here okay so two years ago at end of the
conference and everybody was really
excited about a theorem and smart
contracts and I was drinking a pina
colada and then I got really excited
about it
so when I go back to the England I went
on the solidity online compiler and I
noticed that this voting program this
was like there's some sample code and
I'm sure most people in this room have
already seen it but the idea is that
there's a list of proposals and when I
want to cast my vote I call the vote
function and I say I want to vote for
this proposal now the guarantee voter
privacy and this program the assumption
is that we cannot link of orders
real-world identity to their aetherium
account because if you can then you can
see how somebody voted because the food
is in plain text so I wanted to see if
we can do something better can we build
a smart contract I can guarantee voter
privacy and there's two different ways
to approach this one is Blayne
signatures and the other one is where I
can encrypt my vote under a well-known
public key I could store that on the
blockchain and then I could shut some I
then there could be an Italian authority
who after the election will decrypt the
vote and reveal the tally but both of
those approaches rely on some type of a
and I wanted to follow the example of
cryptocurrencies can we remove the need
for an Italian Authority and an election
and can we do it in such a way where a
voter is in control of the room privacy
and there's brought me to self tallying
elections which was first made back in
2002 and these elections have three
different properties first is perfect
ballot secrecy a voters privacy can only
be breached by a full collusion of all
other voters and is also self tallying
so after the election anybody can count
the votes we don't have to rely on
anybody to do that for us honest dispute
free as then if you give me the election
transcript I can verify myself that the
election was run correctly or at least
the protocol but my disclaimer is that
this protocol is not and - and
verifiable as I mentioned at the very
beginning because in an end-to-end
verifiable is a system we also assume
the voting machine cannot be trusted but
this is a fully decentralized voting
protocol we have no central authority to
provide hardware for us so we have to
assume the voting machine is trustworthy
and I think that's a reasonable
assumption because if you break my if
you hack my machine
you're probably gonna steal all my coins
so have an incentive that do my best to
keep my machine somewhat trustworthy but
these protocols have had a short-lived
history there has never been a practical
implementation of a self Italian
election because one it requires an
authenticated broadcast channel where
everybody can communicate and it's also
very beneficial to have a public
bulletin board to store the election
transcript and these protocols also have
two other issues a single voter can stop
the entire election so they don't cast
their vote we don't get the tally they
also have an adoptive issue where the
final voter can view the tally before
everybody else but now I thought okay
can we combine these self-tanning
elections with the blockchain so I built
the voting protocol as a smart contract
and as I mentioned most beautiful of it
what's beautiful about aetherium is that
it can enforce the voting protocols
correct execution and we can also have
this incentive that sort of the crypto
economic security engineering philosophy
where when you register for the election
you leave a deposit and when you cast
your vote you get your deposit
so now we can access some Tiffin's
incentive for people to participate and
there's three different self tallying
protocols we could have chosen my
disclaimer is that we choose the one by
my adviser but we didn't do it because
it's a we didn't did because it's his
protocol we did it because of the Meuse
efficient in the literature it requires
two rounds and there's only two zero and
all these proofs per voter so it's
highly efficient as a protocol so now
I'm going to explain how the open boot
network over aetherium works
we do have an election administrator and
his only job is one authenticate voters
with their theorem account and then
update the smart contract with that
whitelist so we can at least know who's
going to vote in this election and then
his other job is to poke etherium tutor
to transition to the next stage although
anyone could really do that next
he sets the wait list available eligible
voters he will set the voting question
and then he'll notify etherion to move
on to the sign-up stage and I Annie
voter can look at the question and then
register for the election to register
the voter has to compute a
public/private key pair and this is
their voting key and then alongside
their voting key they critias your own
ollies proof with pretty much says that
they knew the private key that
corresponds to the public key ie they're
the owner of that voting key and now
what they do is that they create an
aetherium transaction they include the
voting key there's proof that they own
this voting key on a very small deposit
and every voter will send us two
aetherium
and a very earthy Rifai the proof it
will verify the proof store their
deposit and store the encrypted vote and
once enough voters have done this the
elected administrator can poke aetherium
to move on to the voting stage and
during this transition from the sign up
to the voting stage a theorem will
compute a second key for every single
voter and we call this the reconstructed
key and this is where all the magic
happens in terms of the cryptography so
I've got this really ugly formula and
that means not nothing to anybody in
this room so I'm going to explain it
using a little robot so if I'm voter 3
the way I can put my reconstructed
key is that I get the booting key of
order one and two and I multiply them
together I get the voting key of three
are four and five and I multiply them
together I divide those two you know
results and then I end up with my own
voting key and we do this for every
single voter in fact aetherium does that
for every single voter and then after
that we've transitioned and once we
reach the voting stage every single
voter has a voting key on a
reconstructed key now at a cast our vote
we have to be an El Gamal encryption of
the vote and that is essentially this
little formula so it hits in the voting
key the reconstructed key and then the
vote is either G to the power of 0 or G
to the power of 1 and that pretty much
is a yes or no vote and then what we do
is we construct a 1 out of 2 0 nollies
proof and this pretty much says that I
prove to you that my encrypted vote is
either yes or no and that means the vote
is well formed and I reveal nothing else
about my vote and then I created
aetherium transaction that includes my
elgamal encrypted vote my one out of two
zero nollies proof and I send that to
the contract the contract will verify
that my vote is well formed and then
store it and then it will release the
deposit and give me my money back and
every single voter will do this and once
the final vote has been cast the
election is over and anybody can compute
the tally and in fact so can aetherium
so the election administrator can poke
aetherium to finally compute the tally
theorem does this and the way we compute
the tally is really straightforward we
just have the odd or the encrypted votes
together and once you add the final
encrypted vote be instant heard that
el-gamal encryption was set up all the
random factors are cancelled out and all
we're left with is G ^ vs votes as a
very small discrete log there can be
brute forced by the smart contract which
it does and then once we have the number
of yes votes it's really straightforward
to get the number of no votes
now before I did this last summer before
the byzantium heart Fork and the problem
was that elliptic curve mathematics was
not natively supported by aetherium
so these are some of the gas costs of
trying to do elliptic curve
monix back then so the cast of vote was
2.5 million gasps so that means today
you'd be able to fit three votes in a
block and it was $2 on the register for
the election was 60 cents now
unfortunately I haven't monies to get
the new opcode to work yet cuz I really
wanted to have exactly the new gas costs
but what I did this morning was I worked
at roughly how much it would be using
the new heart forked up codes because my
aetherium support elliptic earth
mathematics so the cost an encrypted
vote with the one out of two zero
Knollys proofs it goes from two dollars
the 60 cents and we see if 1.7 million
gasps so ever maybe we have a big club
for high achievers back to God that
makes me really happy
thank you yeah
so it's those 700,000 gasps but that's a
very expensive zero knowledge proof and
now we can fit what nearly 10 of them
inside a block so that's much better
than what we could do before so that's
basically you know the new cost to run
this protocol roughly and now I have
some time to show a video that's
fantastic I try my best to see of some
time so I'll quickly play the video that
was the code else looking at this
morning they get the stats unnecessary
so I actually built it as a website and
I spoke to someone last night Annapurna
he gets really easy and decreed in the
mist so I'd love to see that happen but
essentially this is the election
administrator screen he's logging in and
he's gonna set up the election he sets
the list of eligible voters all they
have hard-coded it because I'm lazy and
really struggled with it as well we send
that off to the contract and now the
list of eligible voters are set up we
set a bunch of timers for the election
so that way the election runs in a
timely manner we set the voting question
is you Satoshi Nakamoto reveal Israel
world identity
hopefully everybody says no and then we
start the election and now all the
voters they upload their voting codes
although that's more of an
implementation but I'm necessary they
log into their theorem account and then
they can look at the question and
register for the election now in this
example I'm going to show you there
actually three stages to the protocol
because there's a third round you can
odd to get around that adoptive issue so
I mentioned the Feiner voter can see the
vote the tally before everybody else so
what you can do is that everybody can
register everybody can commit to their
encrypted vote and then once everyone
actually causes their vote you can't
change your mind if you can compute the
tally so it really depends if you think
that's a big issue it was a big issue
that the fan of voter can compute the
tally before everybody else
yeah that's out third round if you don't
think that's a big issue you keep the
two rounds you know you vote a new
register so now every voters you know
yeah they're registering for the
election yep and then eventually yeah
neither basically cost in their vote
while they're committing to their vote
so they're saying yes no and yes so
these guys are going to say yes Satoshi
Nakamoto should reveal his real world
identity I'm neither going to cast their
vote and I know the designs horrible I'm
not really a good designer graphic
design was never my forte but now that
all the votes have been cast anyway we
will eventually be able to see the tally
so the election administrator will
eventually pop up and he'll say okay I
want you to compute the tally etherium
so he does it and I should hopefully say
yep two years foots I'm one no vote and
there's actually a live feed pH as well
where we can actually watch the election
in real time because what's really cool
about this system is that you can
actually registered where you can see
that Patrick has cast his vote so you
can actually see what's a theorem
accounts have voted but you can't see
their vote and that is the end of my
video
[Applause]
and I just want the ended to say that it
is on github and I've been really lucky
to say that it's night house 113 stars
which for me was amazing because when I
did this last summer I was finishing my
PhD and I wanted to build something that
people could use in the community and it
looks like the people have actually
picked it up and they're trying to do
cool things of it so thank you very much
guys for
[Applause]
[Music]