Security Innovations in the Punchscan Voting System

Punchscan is a so-called end-to-end (E2E) voting system that uses cryptographic techniques to give each voter or observer an unprecedented degree of confidence in voting results while preserving the secret ballot.It is unique because it uses a special dual-layer paper ballot that permits each voter to make choices in secret, preventing a machine or person from learning or changing the choices on the ballot at the polling place.Unfortunately, while Punchscan provides significant integrity properties it does not prevent choices from being discovered if someone sees the ballot before the voter, or if a central workstation is compromised.We propose two improvements that mitigate these privacy problems:1. We design a trusted workstation that distributes trust across multiple trustees.Each trustee brings a separate read-only copy of approved election software and compares it to copies brought by other trustees.Chosen at random after all copies are verified by each trustee, the software manages a secret sharing scheme that prevents any trustee from performing election functions without a minimum number of other trustees present.2. Currently, Punchscan can print only ballot layers together.We modify it to treat each ballot layer separately, allowing each to be combined independently by a voter in the voting booth.This permits more efficient distribution strategies that protect voter privacy.Keywords.Punchscan,