# The Open Vote Network: Decentralised Internet Voting as a Smart Contract - Channel: [Devcon](https://streameth.org/devcon) - Date: 2018-10-07 - Duration: 15:53 - Watch: https://streameth.org/watch/yt-4GvRYRUrwRA - YouTube: https://www.youtube.com/watch?v=4GvRYRUrwRA ## Description Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more. https://archive.devcon.org/archive/watch/3/the-open-vote-network-decentralised-internet-voting-as-a-smart-contract The Open Vote Network (OV-net) is a self-tallying (and self-enforcing) e-voting protocol i.e. there are no tallying authorities – anyone can count the votes. It is also the first extensive cryptographic protocol to be implemented as a smart contract (i.e. zero knowledge proofs) that *can work* on Ethereum’s official network today. I’d like to present the protocol, the technical difficulties I faced while building it (and the gas costs before/after hardfork if feasible), and the beauty of combining both cryptographic protocols and smart contracts. Speaker(s): Patrick McCorry Skill level: Intermediate Track: Society and Systems Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum Learn more about devcon: https://www.devcon.org/ Learn more about ethereum: https://ethereum.org/ Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. Devcon 3 was held in Cancún, Mexico on Nov 1 - 4, 2017 Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/ ## Transcript hi guys my name is Patrick McCrory I'm a researcher at UCL and I'm gonna talk to you about some work I did last summer while I was doing my PhD at Newcastle I did it in Calabria so my colleagues Fong how and see a Mac so this toast gonna be about a voting but before I really get into it I like to highlight what researchers tend to think about when we say e-voting so we normally think about end-to-end verifiable systems and the break that down the idea is that when I go to a polling station and I cast my vote I did have confidence that Mary vote has been cast as intended when I leave the polling station I should be able to look at this public bulletin board and verify the my vote has been included in the tally we're not in the tally my vote has been cast and then after the election I should be able to verify that my vote was indeed included in the tally so that is an N the N verifiable system and we achieve this system we normally assume the existence of his public bulletin board that everybody can see but for the past I guess 30 years we've not really been able to achieve a practical public bulletin board the best we have is a single web server where I contact the web server i download theater and i have to try to detect that that web server is cheating me so that's not really good enough so now people are thinking okay can we use the blockchain for a voting does this pervade the consistency property that we want and I'm going to argue potentially and I'm going to say it's probably very useful for small-scale accents a boardroom voting because it does pervade this consistency property where anybody who don't lose the blockchain you can turn over the Genesis block and you can verify the entire history of that blockchain so like every Bitcoin transaction in every aetherium transaction and I don't need to trust anyone to get the ensure that I have a consistent view of everybody else so we sort of think is ideal world and I'm not the first person to notice this so last year I did a Google search and lots of people were getting excited about the blockchain and e-voting so now we needed to say it okay what blockchain are we going to use what about Bitcoin should we use Bitcoin for a voting and I want to summarize and say no I don't think bitcoins are very good players to do this because we can only store 80 bytes of arbitrary data on Bitcoin can only store the information it cannot verify that our protocol was correctly executed so then I'm going to go okay what about aetherium and I don't really need a preach to the choir here do i I think everybody in this room understands that a theorem is gonna be amazing and when I made this slide a theorem was worth 20 billion dollars it's worth more now I don't really know how much it's worth now but the point of a theorem is that we can run expressive but bounded programs ie new the gas metric and as a bit like a computer from the 1970s that everybody has access to it's Sloane as expensive but we're going to get away and we're going to do some avoiding on it and of course as I said this votes about voting and not necessary blockchains so last who this actually it's a bit of a story behind us here okay so two years ago at end of the conference and everybody was really excited about a theorem and smart contracts and I was drinking a pina colada and then I got really excited about it so when I go back to the England I went on the solidity online compiler and I noticed that this voting program this was like there's some sample code and I'm sure most people in this room have already seen it but the idea is that there's a list of proposals and when I want to cast my vote I call the vote function and I say I want to vote for this proposal now the guarantee voter privacy and this program the assumption is that we cannot link of orders real-world identity to their aetherium account because if you can then you can see how somebody voted because the food is in plain text so I wanted to see if we can do something better can we build a smart contract I can guarantee voter privacy and there's two different ways to approach this one is Blayne signatures and the other one is where I can encrypt my vote under a well-known public key I could store that on the blockchain and then I could shut some I then there could be an Italian authority who after the election will decrypt the vote and reveal the tally but both of those approaches rely on some type of a and I wanted to follow the example of cryptocurrencies can we remove the need for an Italian Authority and an election and can we do it in such a way where a voter is in control of the room privacy and there's brought me to self tallying elections which was first made back in 2002 and these elections have three different properties first is perfect ballot secrecy a voters privacy can only be breached by a full collusion of all other voters and is also self tallying so after the election anybody can count the votes we don't have to rely on anybody to do that for us honest dispute free as then if you give me the election transcript I can verify myself that the election was run correctly or at least the protocol but my disclaimer is that this protocol is not and - and verifiable as I mentioned at the very beginning because in an end-to-end verifiable is a system we also assume the voting machine cannot be trusted but this is a fully decentralized voting protocol we have no central authority to provide hardware for us so we have to assume the voting machine is trustworthy and I think that's a reasonable assumption because if you break my if you hack my machine you're probably gonna steal all my coins so have an incentive that do my best to keep my machine somewhat trustworthy but these protocols have had a short-lived history there has never been a practical implementation of a self Italian election because one it requires an authenticated broadcast channel where everybody can communicate and it's also very beneficial to have a public bulletin board to store the election transcript and these protocols also have two other issues a single voter can stop the entire election so they don't cast their vote we don't get the tally they also have an adoptive issue where the final voter can view the tally before everybody else but now I thought okay can we combine these self-tanning elections with the blockchain so I built the voting protocol as a smart contract and as I mentioned most beautiful of it what's beautiful about aetherium is that it can enforce the voting protocols correct execution and we can also have this incentive that sort of the crypto economic security engineering philosophy where when you register for the election you leave a deposit and when you cast your vote you get your deposit so now we can access some Tiffin's incentive for people to participate and there's three different self tallying protocols we could have chosen my disclaimer is that we choose the one by my adviser but we didn't do it because it's a we didn't did because it's his protocol we did it because of the Meuse efficient in the literature it requires two rounds and there's only two zero and all these proofs per voter so it's highly efficient as a protocol so now I'm going to explain how the open boot network over aetherium works we do have an election administrator and his only job is one authenticate voters with their theorem account and then update the smart contract with that whitelist so we can at least know who's going to vote in this election and then his other job is to poke etherium tutor to transition to the next stage although anyone could really do that next he sets the wait list available eligible voters he will set the voting question and then he'll notify etherion to move on to the sign-up stage and I Annie voter can look at the question and then register for the election to register the voter has to compute a public/private key pair and this is their voting key and then alongside their voting key they critias your own ollies proof with pretty much says that they knew the private key that corresponds to the public key ie they're the owner of that voting key and now what they do is that they create an aetherium transaction they include the voting key there's proof that they own this voting key on a very small deposit and every voter will send us two aetherium and a very earthy Rifai the proof it will verify the proof store their deposit and store the encrypted vote and once enough voters have done this the elected administrator can poke aetherium to move on to the voting stage and during this transition from the sign up to the voting stage a theorem will compute a second key for every single voter and we call this the reconstructed key and this is where all the magic happens in terms of the cryptography so I've got this really ugly formula and that means not nothing to anybody in this room so I'm going to explain it using a little robot so if I'm voter 3 the way I can put my reconstructed key is that I get the booting key of order one and two and I multiply them together I get the voting key of three are four and five and I multiply them together I divide those two you know results and then I end up with my own voting key and we do this for every single voter in fact aetherium does that for every single voter and then after that we've transitioned and once we reach the voting stage every single voter has a voting key on a reconstructed key now at a cast our vote we have to be an El Gamal encryption of the vote and that is essentially this little formula so it hits in the voting key the reconstructed key and then the vote is either G to the power of 0 or G to the power of 1 and that pretty much is a yes or no vote and then what we do is we construct a 1 out of 2 0 nollies proof and this pretty much says that I prove to you that my encrypted vote is either yes or no and that means the vote is well formed and I reveal nothing else about my vote and then I created aetherium transaction that includes my elgamal encrypted vote my one out of two zero nollies proof and I send that to the contract the contract will verify that my vote is well formed and then store it and then it will release the deposit and give me my money back and every single voter will do this and once the final vote has been cast the election is over and anybody can compute the tally and in fact so can aetherium so the election administrator can poke aetherium to finally compute the tally theorem does this and the way we compute the tally is really straightforward we just have the odd or the encrypted votes together and once you add the final encrypted vote be instant heard that el-gamal encryption was set up all the random factors are cancelled out and all we're left with is G ^ vs votes as a very small discrete log there can be brute forced by the smart contract which it does and then once we have the number of yes votes it's really straightforward to get the number of no votes now before I did this last summer before the byzantium heart Fork and the problem was that elliptic curve mathematics was not natively supported by aetherium so these are some of the gas costs of trying to do elliptic curve monix back then so the cast of vote was 2.5 million gasps so that means today you'd be able to fit three votes in a block and it was $2 on the register for the election was 60 cents now unfortunately I haven't monies to get the new opcode to work yet cuz I really wanted to have exactly the new gas costs but what I did this morning was I worked at roughly how much it would be using the new heart forked up codes because my aetherium support elliptic earth mathematics so the cost an encrypted vote with the one out of two zero Knollys proofs it goes from two dollars the 60 cents and we see if 1.7 million gasps so ever maybe we have a big club for high achievers back to God that makes me really happy thank you yeah so it's those 700,000 gasps but that's a very expensive zero knowledge proof and now we can fit what nearly 10 of them inside a block so that's much better than what we could do before so that's basically you know the new cost to run this protocol roughly and now I have some time to show a video that's fantastic I try my best to see of some time so I'll quickly play the video that was the code else looking at this morning they get the stats unnecessary so I actually built it as a website and I spoke to someone last night Annapurna he gets really easy and decreed in the mist so I'd love to see that happen but essentially this is the election administrator screen he's logging in and he's gonna set up the election he sets the list of eligible voters all they have hard-coded it because I'm lazy and really struggled with it as well we send that off to the contract and now the list of eligible voters are set up we set a bunch of timers for the election so that way the election runs in a timely manner we set the voting question is you Satoshi Nakamoto reveal Israel world identity hopefully everybody says no and then we start the election and now all the voters they upload their voting codes although that's more of an implementation but I'm necessary they log into their theorem account and then they can look at the question and register for the election now in this example I'm going to show you there actually three stages to the protocol because there's a third round you can odd to get around that adoptive issue so I mentioned the Feiner voter can see the vote the tally before everybody else so what you can do is that everybody can register everybody can commit to their encrypted vote and then once everyone actually causes their vote you can't change your mind if you can compute the tally so it really depends if you think that's a big issue it was a big issue that the fan of voter can compute the tally before everybody else yeah that's out third round if you don't think that's a big issue you keep the two rounds you know you vote a new register so now every voters you know yeah they're registering for the election yep and then eventually yeah neither basically cost in their vote while they're committing to their vote so they're saying yes no and yes so these guys are going to say yes Satoshi Nakamoto should reveal his real world identity I'm neither going to cast their vote and I know the designs horrible I'm not really a good designer graphic design was never my forte but now that all the votes have been cast anyway we will eventually be able to see the tally so the election administrator will eventually pop up and he'll say okay I want you to compute the tally etherium so he does it and I should hopefully say yep two years foots I'm one no vote and there's actually a live feed pH as well where we can actually watch the election in real time because what's really cool about this system is that you can actually registered where you can see that Patrick has cast his vote so you can actually see what's a theorem accounts have voted but you can't see their vote and that is the end of my video [Applause] and I just want the ended to say that it is on github and I've been really lucky to say that it's night house 113 stars which for me was amazing because when I did this last summer I was finishing my PhD and I wanted to build something that people could use in the community and it looks like the people have actually picked it up and they're trying to do cool things of it so thank you very much guys for [Applause] [Music]