Is E2E Verifiability a Magic Bullet for Online Voting
Explains why End-to-End Verifiability (E2E-V) fails to protect online voting systems against client-side endpoint malware and server infrastructure tampering.
Summary
The Promise and Rhetoric of E2E Verifiability
End-to-End Verifiability (E2E-V) is a cryptographic paradigm allowing voters to verify that their votes were cast as intended, recorded as cast, and tallied as recorded, often promoted as a magic bullet for internet voting.
Client-Side Vulnerabilities Outside the Cryptographic Loop
John Odum demonstrates how E2E-V fails to mitigate client-side malware on voter endpoints. Malicious software running on a voter's device can alter ballot selections or deceive voters before cryptographic proofs are generated.
Server-Side and Infrastructure Attack Surfaces
Beyond endpoint risks, centralized election servers and backend tallying infrastructure outside the cryptographic loop remain susceptible to denial of service, configuration sabotage, and server-side compromise.
Disputing Commercial Internet Voting Claims
Evaluating the technical reality of E2E-V against commercial marketing claims highlights that cryptographic verification alone cannot compensate for fundamentally insecure digital voting platforms.
Related talks
Voting Village·36 min
Michael Specter
Examines the systemic security, cryptographic, and client-side malware risks of internet voting in commercial and public election deployments.
OWASP Foundation·44 min
Presenters detail vulnerability discovery and exploitation in AppSec EU 2017 An Introduction To Quantum Safe Cryptography by Liz O'Sullivan.
Main Stage·20 min
Farzan Karim
Introduces Real-time Re-encryption (RRE), a technique that defeats commercial DRM and streaming paywalls across digital media platforms.