Coercion-Resistance and End-to-End Verifiability in the Estonian and Swiss CHVote 2.0 eVoting Systems

Coercion-resistance and end-to-end verifiability are properties that real electronic voting systems aim to achieve concurrently. However, theoretical results suggest it is impossible to fully achieve them concurrently without strong assumptions about the existence of private channels. This thesis aims to evaluate how well two voting systems designed for national elections, the Swiss CHVote 2.0 system and the Estonian voting system, achieve these properties. In order to evaluate how well these systems fulfill coercion-resistance and end-to-end verifiability, their protocols are first concisely described using up-to-date documentation and source code. Then, this thesis evaluates how well they fulfill technical definitions such as cryptographic security definitions, national law and international guidelines provided by the Council of Europe, OCSE, Carter Center and US Vote Foundation. I make a high-level attempt at analyzing these schemes using several game-based definitions of verifiability subproperties and coercion-resistance. The results showed that the Estonian voting system only partially achieves both individual and universal verifiability, and partially achieves coercion-resistance. On the other hand, the Swiss CHVote 2.0 system achieves full end-to-end verifiability according to most definitions, but only very limited coercion-resistance. The results provide practical evidence to support the theoretical result that coercion-resistance and end-to-end verifiability cannot be fully achieved at the same time. Additionally, this paper concludes that coercion-resistance and end-to-end verifiability can be realistically improved in both cases through relatively simple and user-friendly solutions such as providing an extra notification when a vote is cast on behalf of a voter