A verifiable secret shuffle and its application to e-voting

By Andrew Neff. 2001

653 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Bulletproofs: Short Proofs for Confidential Transactions and More (2018, background): “It has many applications in voting [18], [19], mix-nets [20], and solvency proofs [17].”
Prio: Private, Robust, and Scalable Computation of Aggregate Statistics (2017, background): “These anonymity systems provide strong privacy properties, but require expensive “verifiable mixing” techniques [8, 95], or require work at the servers that is quadratic in the number of client messages sent through the system [38, 121].”
Proactively Accountable Anonymous Messaging in Verdict (2012, background): “Dissent [14, 52] uses verifiable shuffles [10, 36] to establish a transmission schedule for DC-nets, enabling groups to guarantee a one-to-one correspondence of group members to anonymous transmission slots.”
Riposte: An Anonymous Messaging System Handling Millions of Users (2015, background): “), though most e-voting sy stems cannot provide the forward security property that Riposte offers (Section III-C) [1], [19], [33], [46], [47], [66], [70].”
Coercion-resistant electronic elections (2005, methodology): “A drawback of our scheme is that, even with use of asymptotically efficient mix networks as in [22, 34], the overhead for tallying authorities is quadratic in the number of voters.”
Stadium: A Distributed Metadata-Private Messaging System (2017, background): “Verifiable shuffles were originally proposed to allow globally verifiable e-voting [3, 13, 23, 35], another privacy related scenario; but they have typically been considered prohibitively expensive for low-latency applications such as messaging.”
Privacy-Preserving Set Union (2007, background): “Such a robust mix can be made from standard protocols [20,19,15].”
Breaking and Mending Resilient Mix-Nets (2003, methodology): “The first attack that is shown against Furukawa-Sako01 mix-net and Millimix can also be used against a number of other mix-nets, more specifically, in breaking proofs of correctness of the mixing phase in MiP-1, MiP-2 [2,3] and Ne01 [ 19 ], and breaking proofs of correctness of the decryption phase ”
Privacy-Preserving Set Operations (2005, background): “Shuffling can be easily accomplished with standard techniques [4,17,8,13,22], with communication complexity at most O(n(2)k).”
Universal Re-encryption for Mixnets (2004, methodology): “For example, to achieve universal verifiability, it is possible to employ the proof techniques in [8, 15, 13].”
Provisions: Privacy-preserving Proofs of Solvency for Bitcoin Exchanges (2015, methodology): “, hn ) using a zero knowledge proof used as a component of the Neff mix net [24].”
Distributed Differential Privacy and Applications (2015, background): “The curators then securely re-randomize and shuffle (Neff, 2001) the vi j, such that each curator learns all the vi j but cannot tell which curator it came from.”
A Practical Voter-Verifiable Election Scheme (2005, methodology): “Another scheme, that also uses encrypted receipts and has similar goals, is the VoteHere scheme of Adler and Neff, [6].”
Distributed Measurement with Private Set-Union Cardinality (2017, methodology): “Several zero-knowledge proofs of ElGamal shuffles of increasing efficiency have been presented [2, 23, 27, 40] (some require an honest verifier and must be strengthened for the malicious setting [24]).”
Dissent: accountable anonymous group messaging (2010, background): “We are not aware of any other verifiable shuffles [20, 26] for which working implementations and performance data are available, but given their typical assumption of small, equal-length messages, we expect their performance on unbalanced loads to be at best on par with our shuffle protocol alone.”
ANONIZE: A Large-Scale Anonymous Survey System (2014, neutral): “Voting schemes [4], [5], [6], [7], [8] on the other hand do provide both the anonymity and the authenticity properties we require; however, they do not allow for the authenticated users to be selected ad-hoc for multiple elections.”
Hang with your buddies to resist intersection attacks (2013, positive): “However, particular variants such as MIX cascades [24, 1] and verifiable shuffles [22, 11] offer formally provable anonymity guarantees even against limited traffic analysis (though not against intersection attacks when messages are linkable).”