Dr David Basin

Dr Bruno Blanchet

Dr Cédric Fournet

David Pointcheval

Nicolas Halbwachs

Susanne Graf

, . . . Claire Maiza

Jean-Noël Bouvier

Philippe Genin

Loïc Thillier

Jacques

Sophie

Marc

Benoît, Claude Valentin

Keywords: Privacy, Electronic Voting, Electronic Auctions, Authentication, Fairness, Formal Verification, Symbolic Model, Computational Model, ProVerif, CryptoVerif, Applied Pi-Calculus, Unique Decomposition, Normal Bisimilarity . . . . . . 28 Bisimilarity . . . . . . 36 2.5 Conclusion . . . . . . . . . . .

I n this document, we formally analyze security in electronic voting and electronic auctions. On-line voting is now available in several countries, for example in Estonia [Est] or parts of Switzerland [Gen13, Reg13]. Similarly, electronic auctions are increasingly used: eBay had over 112 million active users and over 350 million listings in 2012, and achieved a revenue of more than 14 billion US Dollars [Don12]. In both applications, security is a main concern, as fairness is important and money is at stake.

In the case of voting protocols, privacy is crucial to ensure free elections. We propose a hierarchy of privacy notions in the Applied π-Calculus, including different levels of coercion, special attacks such as forced-abstention attacks, and inside attackers. We also provide generalized notions for situations where votes are weighted (e.g. according to the number of shares in a company), and show that for many protocols the case with multiple coerced voters can be reduced to the case with one coerced voter. This result is made possible by a unique decomposition result we proved in the Applied π-Calculus, showing that any finite process has a unique normal form with respect to labeled bisimilarity. Moreover we provide multiple case studies illustrating how our taxonomy allows to assess the level of privacy ensured by a voting protocol.

In the case of auction protocols we also consider a hierarchy of privacy notions, and several fairness and authentication properties such as Non-Interference, Non-Cancellation and Non-Repudiation. We analyze all these properties automatically using ProVerif on three case studies, and identify several flaws. Moreover we give an abstract definition of verifiability in auctions and provide case studies in the symbolic and computational model using ProVerif and CryptoVerif respectively. Again, we identify several shortcomings, but also give a computational proof for one protocol.

Finally we explore the idea of "true bidder-verifiable auctions", i.e. auctions that can be verified by a non-expert, as the property is ensured through physical properties instead of complex cryptography. We propose two such protocols, discuss how to model the underlying physical properties, and provide a formal analysis of both protocols using ProVerif.

Résumé

D ans cette thèse nous étudions formellement la sécurité des protocoles de vote et d'enchère en ligne. Le vote en ligne est utilisé en Estonie [Est] et dans certaines régions de la Suisse [Gen13, Reg13]. D'autre part, les enchères en ligne sont de plus en plus populaires : eBay comptait plus de 112 millions utilisateurs actifs et plus de 350 millions d'objets à vendre en 2012, avec un chiffre d'affaires de 14 milliards de dollars [START_REF] Donahoe | To our stockholders[END_REF]. Dans ces deux applications, la sécurité est primordiale, à cause d'enjeux financiers et politiques.

Dans le cas des protocoles de vote, le secret du vote est crucial pour le libre choix des votants. Nous proposons une hiérarchie des notions de secret du vote par rapport à plusieurs niveaux de coercition, des attaques spécifiques (comme l'abstention forcé), et des votants corrompus. Nous généralisons ces notions pour le cas des votes pondérés (par exemple par rapport au nombre d'actions dans une société). Nous montrons aussi que sous certaines conditions le cas avec plusieurs votants sous attaque se réduit au cas avec un seul votant sous attaque. Ce résultat a été obtenu grâce à un autre résultat démontré dans le Π-calcul appliqué, montrant que tout processus fini peut se décomposer de manière unique en processus premiers. Nous illustrons notre hiérarchie sur plusieurs exemples, soulignant comment elle permet d'évaluer le niveau d'anonymat d'un protocole donné.

Dans le cas des protocoles d'enchère en ligne, nous proposons aussi une hiérarchie de notions d'anonymat, et plusieurs notions d'équité et d'authentification comme la non-interférence, la non-annulation et la non-répudiation. Nous analysons ces propriétés automatiquement à l'aide de l'outil ProVerif sur trois exemples, et découvrons plusieurs faiblesses. De plus, nous proposons une définition abstraite de la vérifiabilité, et l'appliquons sur des exemples aussi bien dans le modèle calculatoire que dans le modèle symbolique en utilisant CryptoVerif et ProVerif respectivement. Nous démontrons dans le modèle calculatoire qu'un des protocoles est vérifiable, et découvrons plusieurs faiblesses sur les autres exemples.

Finalement nous étudions le concept d'«enchères vraiment vérifiable par les enchérisseurs», c'est-à-dire des protocoles d'enchère où le bon déroulement peut être vérifié par un non-expert, car la sécurité est assurée par des moyens physiques, et non cryptographiques. Nous proposons deux tels protocoles, et une analyse formelle de ces protocoles grâce à une modélisation des propriétés physiques avec ProVerif.

Mots-clés : vie privée, vote électronique, enchère en ligne, authentification, équité, vérification formelle, modèle symbolique, modèle calculatoire, ProVerif, CryptoVerif, pi-calcul appliqué, décomposition unique, forme normale Chapter 1 Introduction I n this chapter we introduce the context of the thesis and motivate our work. We also give an overview of related work, and outline the thesis and its contributions. Finally we list previous publications of preliminary results concerning the work presented in this thesis.

Introduction and Motivation

More and more commerce is done using the Internet, for example on-line shopping -Amazon.com achieved a revenue of more than 61 billion US Dollars in 2012 [Ama13] -or on-line auctions (eAuctions) such as eBay with a revenue of more than 14 billion US Dollars in 2012 [START_REF] Donahoe | To our stockholders[END_REF]. Moreover administration and government rely more and more on computer system for electronic government (eGovernment) applications or electronic voting (eVoting), which is used for example in Estonia [Est] or parts of Switzerland [Gen13, Reg13].

To connect different systems or to implement such distributed applications, many protocols are developed. These protocols specify how the different participants interact, and are designed to ensure security properties (for example authentication or secrecy of the exchanged messages) as well as functional properties (for example to fulfill efficiency or real-time constraints). However, the design of complex protocols is notoriously difficult and errorprone. One approach to tackle this problem is the use of formal methods. Formal methods rely on the use of formal models such as dedicated logics, process algebras or probabilistic arguments to analyze the security of systems or protocols. They can be used to find bugs, but also to prove that a system is secure within a given model and with respect to given security properties. The Common Criteria for Information Technology Security Evaluation [START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF], an international standard for the certification of security critical information systems, requires formal analysis for its two highest Evaluation Assurance Levels (EALs) 6 and 7 [Com12b].

The use of formal methods has achieved many results in recent years. Since the seminal works by Dolev and Yao [START_REF] Dolev | On the security of public key protocols (extended abstract)[END_REF][START_REF] Dolev | On the security of public key protocols[END_REF] and Millen [START_REF] Millen | The interrogator: A tool for cryptographic protocol security[END_REF] on public key protocols, the development of the BAN-logic [START_REF] Burrows | A logic of authentication[END_REF], and the famous results by Lowe [Low96] on the automatic analysis of the Needham-Schroeder protocol, many weaknesses in existing and deployed protocols and standards have been identified. For example Mitchell, Shmatikov and Stern [START_REF] Mitchell | Finite-state analysis of ssl 3.0[END_REF] found anomalies in SSL (Secure Socket Layer) 3.0 using finite-state analysis. Moreover, Delaune, Kremer and Steel [START_REF] Delaune | Formal security analysis of pkcs#11 and proprietary extensions[END_REF] discovered several flaws in the PKCS#11 standard for cryptographic tokens using a formal model and an automated decision procedure. Similarly Smyth and Cortier [START_REF] Smyth | Attacking and fixing helios: An analysis of ballot secrecy[END_REF] identified weaknesses concerning the voter's privacy in the Helios voting system [START_REF] Adida | Helios: Web-based open-audit voting[END_REF], again using formal analysis. More issues with Helios were discovered by Bernhard et al. [BCP + 11, BPW12]. Finally the automated analysis of the YubiHSM hardware security module, designed to protect secret keys even when an intruder corrupted the rest of the machine, also revealed a flaw, leading to a redesign of the protocol [START_REF] Künnemann | Yubisecure? formal security analysis results for the yubikey and yubihsm[END_REF].

Formal methods cannot only be used to discover attacks, but also to obtain secure and certified protocols and implementations. For example He et al. [HSD + 05] 1.1. Introduction and Motivation completed a modular proof of IEEE 802.11i and Transport Layer Security (TLS), one of the most widely used security protocols on the internet. More recently, a verified reference implementation of TLS was completed [BFK + 13].

The main challenges however in both situations (certification and verification) remain the choice of the model, the formalization of complex security properties, and the development of automated verification tools.

In this thesis we discuss two main applications: electronic voting (eVoting) and electronic auctions (eAuction). Electronic Voting systems have been used in many countries all over the world, and even on-line voting is available in some countries such as Estonia [Est], parts of Switzerland [Gen13, Reg13] or for French expatriates [Min13]. As voting is a crucial act in modern democracies, the security requirements are high and complex, and there have been controversial discussions about the security of such systems [Par07, UK 07, Min08, Bun09].

As our second application we discuss electronic auctions. They are widely used, for example eBay had over 112 million active users and over 350 million listings in 2012 [START_REF] Donahoe | To our stockholders[END_REF]. Since an auction includes several competing partiesmultiple bidders striving for the lowest possible price, and the seller looking to achieve the highest possible price -and money is at stake, security is a major concern in such transactions as frauds are common [NTJ13].

In both applications we deal with complex systems and non-trivial properties such as Privacy, Fairness, and Verifiability. Privacy can simply mean the secrecy of the vote (or bid), but also unlinkability of the voter and his vote, or anonymity of the winning bidder. Fairness often is related to Privacy, since for example preliminary results in an election can influence the choice of the remaining voters. Yet fairness also includes robustness against cheating, for example by ensuring that a voter cannot vote twice, or that a bidder cannot modify or cancel his bid (depending on the rules of the auction). Finally Verifiability ensures that a participant can verify the correct behavior of some (un-)trusted parties, for example of the tallier in a voting protocol. In such a case a voter can check the correctness of the result after the election is over, without having to trust the authorities. This is particularly interesting if the systems are complex and difficult to understand for the participants, as the verification can be noticeably easier than the protocol execution.

As the definitions in natural language tend to contain imprecisions, one of the main challenges in formal verification is the development of formal definitions for the different properties. These definitions need to be precise, and should ideally also be suitable for automated verification, as human proofs tend to be error-prone as complexity increases. Finally the definitions should also be as complete (i.e. containing all aspects and covering all possible attacks) as possible, yet this is often difficult to achieve -how to include types of attacks which are not yet

Introduction known?

The goal of this thesis is to propose models and definitions to express and verify such security properties in both contexts. For voting we focus on Privacy properties including Receipt-Freeness and Coercion-Resistance. Receipt-Freeness means that a voter cannot construct a receipt proving to an attacker that he voted for a particular candidate, to prevent vote-buying. Coercion-Resistance allows a voter to vote for a candidate of his choice, even if the attacker tries to force him to vote for a certain candidate by interacting with him throughout the entire voting process. For auctions, we propose models and definitions for Privacy (also including Receipt-Freeness and Coercion-Resistance), Fairness and Verifiability. We also discuss several case studies to test our models on existing examples. In particular we prove one protocol secure with respect to our model and definitions, but also identify multiple flaws with other protocols. Moreover we provide a theoretical result in the Applied π-Calculus which allows us to show that some privacy notions coincide.

Related Work

Here we give only a high-level overview of the different approaches, models and tools used for formal verification of protocols. In each chapter we discuss in more detail the work related to the chapter's content. Now we start by discussing the symbolic and computational models as well as their relationship, then we give an overview of the techniques and tools used in the symbolic model. Finally we also give a short overview over tools supporting computationally sound proofs.

In general, we distinguish two main approaches for the formal verification of protocols: the symbolic and computational models.

The Symbolic Model. In the symbolic model, cryptographic building blocks such as encryption, signatures, commitments etc. are treated as black boxes and assumed to be perfectly secure. This means that for example the decryption of an encrypted message is only possible if one knows the key, or that the only way generate a valid signature is using the secret key. Usually the intruder has full control of the network, i.e. can intercept, create, modify and delete messages, which are terms. Then there are rules specifying which operations the intruder can apply on these terms. Such a formal model was first proposed by Dolev and Yao [DY81, DY83] 1 , and their technique allows for automatic verification of reachability properties such as "Can the intruder access this secret value?". The Computational Model. In the computational model on the contrary, messages are bitstrings, and the intruder is a (usually probabilistic polynomialtime) Turing-machine. Security properties are then typically defined as games played by the intruder. If he manages to win the game, he breaks the property. The goal is then to prove that the probability of the adversary winning the game is very low, for example close to random guessing. Usually one shows that his advantage is negligible, i.e. smaller than the inverse of any positive polynomial function of the security parameter (for example the key length). The common technique to prove such statements is a proof by reduction, i.e. one proves that if the adversary is able to win the security game with a high probability, he can break a supposedly hard mathematical problem such as the factorization of large numbers or computing the discrete logarithm. These proofs are often realized as a "sequence of games", where the first game corresponds to the initial security game, and the last game corresponds to the supposedly hard problem, which concludes the proof. In between these two games there can be many intermediate games, and each two games in the sequence differ only in a small detail. This is to decompose the proofs, as one proves that in each game the adversary has the same advantage as in the previous one, or that there is only a negligible difference. Such computational proofs tend to be more difficult to automate, in particular the sequence of games is often difficult to generate automatically.

Links between the Symbolic and Computational Model. Although both models are quite different, there are soundness results showing a link between both. In 2000 Abadi and Rogaway [START_REF] Abadi | Reconciling two views of cryptography (the computational soundness of formal encryption)[END_REF] showed that a protocol using encryption shown secure in the symbolic model with respect to certain properties, is also secure in the computational model with respect to the computational equivalent of these properties. Since then many more results have been obtained for various properties and combinations of different cryptographic primitives (e.g. [BP05, BDK07, CLC08, KT09b, BMU12, CLHKS12, BBU13] or [START_REF] Cortier | A survey of symbolic methods in computational analysis of cryptographic systems[END_REF] for an overview), however also some limitations of this approach were discovered [START_REF] Backes | Soundness limits of dolev-yao models[END_REF].

Symbolic Techniques and Tools. Within the symbolic model there is a big variety of techniques. There is the initial Dolev-Yao model [START_REF] Dolev | On the security of public key protocols[END_REF] based on deduction rules, there are logics such as the BAN-logic [START_REF] Burrows | A logic of authentication[END_REF] to model authentication, process algebras such as the Spi-Calculus [START_REF] Abadi | A calculus for cryptographic protocols: the spi calculus[END_REF] or the Applied π-Calculus [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF], and methods based on typing such as F7 [BFG10, BBF + 11].

Although protocol verification problems are often undecidable in the general case [START_REF] Even | On the security of multi-party ping-pong protocols[END_REF][START_REF] Durgin | Multiset rewriting and the complexity of bounded security protocols[END_REF] -in particular with unbounded message length and and an unbounded number of instances in parallel -there are various tools supporting automated protocol verification in different symbolic models. To deal with 1. Introduction such undecidable problems, they employ various techniques: approximations, restrictions to the case with a bounded number of instances or limited attacker capabilities, or algorithms that do not always terminate. We now discuss several tools that employ such techniques. AVISPA [ABB + 05] is a tool supporting four different back-ends for protocol verification with different techniques:

-the On-the-fly Model-Checker (OFMC) [START_REF] Basin | Ofmc: A symbolic model checker for security protocols[END_REF] works by exploring the transition system of the protocol in a demand-driven way.

-the Constraint-Logic-based Attack Searcher (CL-AtSe) [START_REF] Turuani | The CL-Atse Protocol Analyser[END_REF] analyzes a bounded number of instances of the protocol using constraint logic.

-the SAT-based Model-Checker (SATMC) [START_REF] Armando | Satmc: a sat-based model checker for security protocols[END_REF] translates the possible (finite) protocol runs into a logical formula, which is then solved by a SAT-solver.

-Finally Tree Automata based on Automatic Approximations for the Analysis of Security Protocols (TA4SP) [START_REF] Boichut | Improvements on the genet and klay technique to automatically verify security protocols[END_REF] is the only back-end supporting an unbounded number of sessions by over-approximation.

AVISPA can analyze authentication as well as (weak) secrecy, modeled as reachability. We distinguish weak secrecy, i.e. "Can the secret value be computed by an adversary?", from strong secrecy, i.e. "Can the adversary distinguish two instances which only differ in the secret value?". The latter is stronger in the sense that the adversary might be incapable of computing the exact value, but still be able to test if it is equal to a specific value, for example zero. Strong secrecy can be expressed using observational equivalence. AVISPA was extended in the AVANTSSAR [AAA + 12] project, but still relies on the same (although improved) back-ends.

Scyther [START_REF] Cas | The Scyther Tool: Verification, falsification, and analysis of security protocols[END_REF][START_REF] Cas | Unbounded verification, falsification, and characterization of security protocols by pattern refinement[END_REF] verifies protocol using a symbolic backwards search based on patterns. It supports bounded and unbounded number of runs, however it does not always conclude for the unbounded case. In such a situation however it still gives a verdict for the bounded case. It supports authentication and weak secrecy (i.e. reachability) properties. A variant of Scyther can also be used to generate machine-checked proofs [START_REF] Meier | Strong invariants for the efficient construction of machine-checked protocol security proofs[END_REF].

Recently the Tamarin prover [SMCB12, [START_REF] Meier | The tamarin prover for the symbolic analysis of security protocols[END_REF] was developed, it supports verification of security protocols with an unbounded number of sessions. The security properties can be expressed with respect to a special subset of (temporal) first-order logic. It also supports Diffie-Hellman exponentiation and a user-defined subterm-convergent rewriting theory.

ProVerif is an automatic verification tool based on Horn clauses originally developed by Bruno Blanchet [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF]. It features a mechanical translation from the Applied π-Calculus to Horn clauses, so it can directly verify a protocol given in the Applied π-Calculus. ProVerif uses approximations and is sound but not complete, and sometimes does not terminate. Originally designed to verify weak secrecy, it was extended to support correspondence properties between events to verify authentication properties [Bla02] and strong secrecy [START_REF] Blanchet | Automatic Proof of Strong Secrecy for Security Protocols[END_REF]. Another extension was made to reconstruct attack traces if possible to help identifying false attacks [START_REF] Allamigeon | Reconstruction of Attacks against Cryptographic Protocols[END_REF]. Finally support for the verification of equivalences [START_REF] Blanchet | Automated verification of selected equivalences for security protocols[END_REF] was added, which was recently improved to obtain a finer approximation [START_REF] Cheval | Proving more observational equivalences with ProVerif[END_REF]. It also supports user-defined equational theories [START_REF] Abadi | Analyzing Security Protocols with Secrecy Types and Logic Programs[END_REF].

AKISS [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] is a recent tool that allows to prove trace equivalence properties for bounded processes, featuring user-defined equational theories. It is based on KISS [START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF], a tool allowing to prove static equivalence for complex equational theories.

For a comparison of the performance of different tools (in particular Scyther, ProVerif and the different AVISPA backends) see [START_REF] Cas | Comparing state spaces in automatic security protocol analysis[END_REF]. We chose ProVerif for many verification tasks throughout the thesis because of its performance, its support for authentication and equivalence properties (to analyze different notions of Privacy) and its support of user-defined equational theories (to model special cryptographic operations as well as the properties of physical objects).

Computational Tools. There are also tools working in the computational model. CryptoVerif [START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF]BP06,[START_REF] Blanchet | Computationally sound mechanized proofs of correspondence assertions[END_REF][START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF] is a tool supporting proofs based on sequences of games. It allows for manual or (semi-)automatic proofs. CryptoVerif provides an exact upper bound on the probability of the adversary winning the game in terms of how often he calls the oracles (called concrete security). Recently it was extended to also directly provide implementations based on the verified protocol model [START_REF] Cadé | Proved generation of implementations from computationally-secure protocol specifications[END_REF].

CertiCrypt [START_REF] Barthe | Formal certification of code-based cryptographic proofs[END_REF] allows for certified cryptographic proofs in the computational model using the Coq proof assistant [START_REF]The coq proof assistant[END_REF][START_REF] Coquand | The calculus of constructions[END_REF]. It also uses a sequence of games and provides strong guarantees, however the proofs are manual and tend to be cumbersome. To address this, EasyCrypt [START_REF] Barthe | Computer-aided security proofs for the working cryptographer[END_REF] was developed. In Easy-Crypt the user specifies the sequence of games, and the tool tries to automatically prove the equivalences between the games using SMT 2 -solvers. When it succeeds, it also provides a proof that can be checked using the Coq proof assistant.

A different approach is used by the Computational Indistinguishability Logic (CIL) [BDKL10], allowing to formalize computational indistinguishability proofs based on a special logic, which can also be implemented in the Coq assistant.

A recent extension to F7 also permits computationally sound proofs [START_REF] Fournet | Modular code-based cryptographic verification[END_REF].

In our computational proofs, we use CryptoVerif because of its high grade of automation, and syntactical similarity to ProVerif, which allows us to re-use big parts of the models.

1. Introduction

Contributions and Organization of the Thesis

In Chapter 2, we recall the Applied π-Calculus, which is used throughout the thesis. We also present two results on the unique decomposition of processes. We start by defining the subclasses of finite and normed processes, i.e. processes where all complete traces are finite, and processes where there exists at least one complete finite trace respectively. In the first result we show that any process in the subclass of normed processes can be rewritten as a composition of parallel factors in a unique (up to permutation and strong labeled bisimilarity) way, i.e. we can decompose a normed process P into factors P 1 | . . . |P n , where each P i is prime in the sense that it cannot be further decomposed without obtaining trivial (i.e. equivalent to 0) factors. In our second result, we show that similarly any finite process can be rewritten in a unique (up to permutation and weak labeled bisimilarity) way as a composition of parallel prime factors. Such results are handy as they provide a normal form, and a cancellation result in the sense that A|B ∼ C|B implies A ∼ C. We use our second decomposition result in Chapter 3 in a proof showing the equivalence of two privacy notions.

In Chapter 3, we discuss privacy in electronic voting (eVoting). In a first contribution we provide a formal taxonomy of privacy in the Applied π-Calculus. This taxonomy accounts for different attacker capabilities (such as an inside or outside attacker), particular attacks (forced-abstention attacks) as well as the level of coercion possible by the attacker (simple privacy, receipt-freeness, or full coercion-resistance). We apply this taxonomy on several existing protocols (the protocol by Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], the protocol by Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF], the protocol by Lee et al [LBD + 03], and Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF]) to illustrate the different levels of privacy achieved by these protocols.

In our second contribution, we generalize the privacy definition to accommodate protocols with weighted votes, for example according to the percentage of shares in a company. In such a case the previous definitions based on two voters swapping their votes are unsuitable as swapping votes can lead to different outcomes and hence trivially distinguishable situations. Our solution is to abstract away from the result, and simply consider all distributions of votes giving the same result. We apply these new notions on a protocol implementing weighted votes (based on the protocol by Eliasson and Zúquete [START_REF] Eliasson | An electronic voting system supporting vote weights[END_REF]). We also establish precise links between these new notions and the notions from our taxonomy: we can show that the corresponding notions coincide if the votes are not weighted. In a next step, we can also show that if the protocol ensures a certain modularity condition (which is the case for most of our examples), single-voter coercion (i.e. only one voter under coercion by the attacker) and multi-voter coercion (i.e. several voters simultaneously under coercion) are equivalent. This means that a modular protocol ensuring single-voter coercion-resistance also ensures multi-voter coercion-resistance. We can also show that for modular protocol we do not need to consider corrupted voters, a situation including corrupted voters can be reduced to a situation without corrupted voters.

In Chapter 4, we consider electronic auctions (eAuctions). In the first part, we provide formal definitions of authentication properties such as Non-Repudiation and Non-Cancellation, fairness properties such as Weak or Strong Non-Interference and "Highest Price Wins" as well as different notions of privacy and anonymity, including receipt-freeness and coercion-resistance in the Applied π-Calculus. We then consider three case studies: The protocol by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], the protocol by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and the protocol by Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. We identify several problems for the first two protocols automatically using ProVerif, and provide automated proofs for all properties except receipt-freeness and coercion-resistance for the latter protocol.

In the second part of the chapter we analyze verifiability in eAuctions. We introduce a high-level model and definition, which allows for instantiations in the symbolic and computational model. Then we provide two case studies: the protocols by Sako and Curtis et al. For the protocol by Sako, we give a symbolic proof in the Applied π-Calculus with help of ProVerif (and some manual generalizations), and also a computational proof using CryptoVerif (and one manual proof). For the protocol by Curtis et al. we use ProVerif to analyze verifiability, and identify several shortcomings.

In the last part, we explore the idea of "true bidder-verifiable auctions", i.e. auction protocols that achieve verifiability without relying on complex cryptography, and can hence be verified without any specialist knowledge. To achieve such a property we propose to exploit the physical properties of certain objects, and develop two protocols inspired by Sako's protocol. The first one, called "Cardako", only uses office material, i.e. cardboard and envelopes. The second one, called "Woodako", uses a wooden box, that determines the winner in a private, secure and verifiable way. Although these protocols have their limitations with respect to scalability, they illustrate how we can realize secure auctions by exclusively relying on physical objects and their properties. We also discuss how we can apply the formal models and definitions we developed before on these protocols, and investigate a first possibility using special equational theories in ProVerif to model the physical properties. Using this model, we can automatically verify both protocols, and show that they achieve the desired security properties.

We sum up our results in Chapter 5 and discuss directions for future work.

Introduction

Publications

Much of the work presented in this thesis has already been published at different conferences.

The unique decomposition results of Chapter 2 were presented at FoSSaCS 2013 [START_REF] Dreier | On unique decomposition of processes in the applied pi-calculus[END_REF]. Preliminary results of the work presented in Chapter 3 were published at several occasions: the notion of Vote-Independence was presented at FPS 2011 [START_REF] Dreier | Voteindependence: A powerful privacy notion for voting protocols[END_REF], the hierarchy of privacy notions at ICC-SFCS 2012 [START_REF] Dreier | A formal taxonomy of privacy in voting protocols[END_REF] and the work on weighted votes and multi-voter coercion at ESORICS 2012 [START_REF] Dreier | Defining privacy for weighted votes, single and multi-voter coercion[END_REF]. Many of the results of Chapter 4 have also been presented before: the work on authentication, fairness and privacy at POST 2013 [START_REF] Dreier | Formal verification of e-auction protocols[END_REF], and the definition of verifiability at ASIACCS 2013 [START_REF] Dreier | Defining verifiability in e-auction protocols[END_REF].

Although not included in this thesis, we also provided a detailed cryptanalysis of Brandt's auction protocol [START_REF] Brandt | How to obtain full privacy in auctions[END_REF], identifying several shortcomings. This work was presented at Africacrypt 2013 [START_REF] Dreier | Brandt's fully private auction protocol revisited[END_REF].

Introduction

Process Algebras or Calculi are used to formally model and analyze distributed systems. Famous examples include the Calculus of Communicating Systems (CCS) due to Milner [START_REF] Milner | Communication and Concurrency[END_REF], or Basic Parallel Processes (BPP) [Chr93]. These calculi contain basic operations such as emission and reception of messages as well as parallel composition or interleaving. In an extension to CCS, Milner, Parrow and Walker developed the π-Calculus [START_REF] Milner | A calculus of mobile processes, part i[END_REF], which also features channel passing and scope extrusion. Abadi and Fournet [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF] subsequently proposed the Applied π-Calculus, a variant of the π-Calculus designed for the verification of cryptographic protocols. It additionally features equational theories and active substitutions.

-Outline of the Chapter

In the next section we recall the syntax and semantics of the Applied π-Calculus. In Section 2.3 we present several equivalence and bisimilarity notions. We then discuss related work concerning unique decomposition of processes in Section 2.4.1, and define the depth and norm of a process in Section 2.4.2. Finally we present our unique decomposition for strong and weak bisimilarity in Section 2.4.3 and 2.4.4, respectively. Finally we conclude the chapter.

Syntax and Semantics

The Applied π-Calculus relies on a type or sort system for terms. It includes a set of base types such as Integer, Key or Data. Additionally, if τ is a type, then Channel τ is a type (intuitively the type of a channel transmitting terms of type τ ).

We suppose a signature Σ of functions, which consists of a finite set of function symbols with the associated arity and sorts. For example enc(message, key), dec(message, key) are of arity two with two parameters of sorts Data and Key, returning a value of type Data. A function with arity zero is a constant. M , N := terms a, b, c, n, m, k names x, y, z variables f (M 1 , . . . , M l ) function application Terms in the Applied π-Calculus are combinations of names (which typically correspond to data or channels), variables and function symbols from the signature Σ following the grammar depicted in Figure 2.1. These combinations have to be correct with respect to arity and sorts of the function symbols, variables and names. Variables and names can have any type, and functions take and return only values of base types. We assume infinite sets of names and variables.

Functions typically include encryption and decryption, hashing, signing and so on. Equalities are modeled using an equational theory E which defines a relation = E . A classical example, which describes the correctness of symmetric encryption, is dec(enc(message, key), key) = E message. To simplify the notation we sometimes omit the subscript E if this is clear from the context.

Tuples can be implemented e.g. using a function tuple n (M 1 , . . . , M n ) and the equations ∀i :

proj i (tuple n (M 1 , . . . , M n )) = M i
To simplify notation we also write (M 1 , . . . , M n ) for tuple n (M 1 , . . . , M n ), this assumes the function tuple n and the destructors proj i with the equations as defined above.

P , Q := plain processes 0 null process P |Q parallel composition !P replication νn.P name restriction ("new") if M = N then P else Q conditional (M , N terms) in(u, x).P message input out(u, M ).P message output There are two types of processes in the Applied π-Calculus: plain processes and extended or active processes. Plain processes are constructed using the grammar depicted in Figure 2.2. The null process 0 does nothing, the parallel composition P |Q executes P and Q in parallel, and the replication !P executes infinitely many copies of P in parallel. νn.P creates a new, private name n and continues as P .

if M = N then P else Q behaves as P if N = E M or as Q otherwise. Note the equality with respect to the equational theory, and that we require M and N to have the same type. The process in(u, x).P inputs a message on channel u, 2. The Applied π-Calculus and Unique Parallel Decomposition of Processes assigns it to the variable x of type τ x and continues as P . We assume that u is of type Channel τ x . Finally out(u, M ).P outputs M (of type τ M ) on channel u and continues as P . Again, u has to be of of type Channel τ M .

Active or extended processes are plain processes or active substitutions as shown in Figure 2.3. Note that the Applied π-Calculus does not include the "+"-operator which implements a nondeterministic choice, yet we can implement something similar using a restricted channel (see Example 7 on page 28). For more details on encoding the operator with respect to different semantics, see [START_REF] Nestmann | Decoding choice encodings[END_REF][START_REF] Palamidessi | A randomized encoding of the pi-calculus with mixed choice[END_REF].

The substitution { M /x} replaces the variable x with a term M . Note that we do not allow two active substitutions to define the same variable, as this might lead to situations with unclear semantics. We also require substitutions to be well-sorted and circle-free, and only allow active substitutions on variables of base sorts. We denote by f v(A), bv(A), f n(A), bn(A) the free variables, bound variables, free names or bound names respectively. A name n is bound if it is in the scope of a restriction νn, a variable x is bound if it is in the scope of a restriction νx or of an input in(u, x). All unbound names and variables are free.

As an additional notation we write νS.A for νs 1 .νs 2 . . . νs n .A where s 1 , . . . s n are the elements of a set of variables and names S. By abuse of notation we sometimes leave out ".0" at the end of a process. We also write A k for A| . . . |A (k times), in particular A 0 = 0 as 0 is the neutral element of parallel composition. Inspired by ProVerif's syntax, we write let x = M in P for νx. (P { M /x}), or even let (x 1 , . . . , x n ) = (M 1 , . . . , M n ) in P for νx 1 . . . νx n . (P { M 1/x 1 , . . . , Mn /xn}).

The frame Φ(A) of an active process A is obtained by replacing all plain processes in A by 0. This frame can be seen as a representation of what is statically known to the environment about a process. The domain dom(Φ) of a frame Φ is the set of variables for which Φ defines a substitution. By abuse of notation, we also write dom(A) to denote the domain of the frame Φ(A) of an active process A. Note that dom(A) ⊆ f v(A), and that as we cannot have two active substitutions for the same variable, P = Q|R implies dom(P ) = dom(Q) ∪ dom(R) and dom(Q) ∩ dom(R) = ∅. A frame or process is closed if all variables are bound or defined by an active substitution. An evaluation context C[_] denotes an active process with a hole for an active process that is not under replication, a conditional, an input or an output.

The semantics of the calculus presupposes a notion of Structural Equivalence (≡), which is defined as the smallest equivalence relation on extended processes that is closed under application of evaluation contexts, α-conversion on bound names and bound variables such that the rules in Figure 2.4 on the next page hold. Note the contagious nature of active substitutions: by rule SUBST they apply to any parallel process. -→) is the smallest relation on extended processes closed by structural equivalence and application of evaluation contexts such that the rules in Figure 2.5 hold. Note that in accordance with the original notations [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF], we sometimes omit the labels τ c , τ t and τ e , and write P → P for P γ -→ P with γ ∈ {τ c , τ t , τ e }. We also write P → * P for P → . . . → P .

COMM

out(a, x).P | in(a, x).Q

τc -→ P | Q THEN if M = M then P else Q τt -→ P ELSE if M = N then P else Q τe -→ Q for any ground terms such that M = E N Figure 2.5 -Internal Reduction
Interactions of extended processes are described using labeled operational semantics ( α -→, see Figure 2.6 on the following page), where α can be an input or an output of a channel name or variable of base type, e.g. out(a, u) where u is a variable or a name.

Labeled external transitions are not closed under evaluation contexts. Note that a term M (except for channel names and variables of base type) cannot be output directly. Instead, we have to assign M to a variable, which can then be output. We can also see that external transitions are not closed under evaluation contexts: by rule SCOPE νc.P ex cannot execute the transition νz.out(c,z)

-------→ any more.

1 Here and throughout the rest of the thesis we mark the differences between the steps in bold for better readability.

Observational Equivalence and Labeled Bisimilarity

Observational Equivalence and Labeled Bisimilarity

The Applied π-Calculus has two equivalence notions for processes: Observational Equivalence and Labeled Bisimilarity. They can be used to express strong secrecy or other privacy properties. Let A ⇓ a denote that A can send a message on the channel a, i.e. when A → * C[out(a, M ).P ] for some evaluation context C [_].

Definition 1 (Observational Equivalence [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]) Observational Equivalence (≈) is the largest symmetric relation relation R between closed extended processes with the same domain such that A R B implies:

1. if A ⇓ a, then B ⇓ a 2. if A → * A , then B → * B and A R B for some B

C[A] R C[B] for all closing evaluation contexts C[_]

The intuition is that two processes are observationally equivalent if each output or internal transition of one processes can be simulated by the other, and this holds for any context (corresponding for example to an attacker). Then we have P 0 ≈ P 1 as P 0 ⇓ c and P 1 ⇓ c, P 1 → νa.νd.out(c, a) ≡ P 0 , but neither P 0 ≈ P 2 nor P 1 ≈ P 2 as P 2 outputs a tuple instead of a single value, which can be tested by a context.

As Observational Equivalence can be difficult to prove due to the all-quantified context, we often use Labeled Bisimilarity instead. Labeled Bisimilarity is defined using the notion of Static Equivalence, which is based on the equivalence of two terms in a given frame.

Definition 2 (Equivalence in a Frame [AF01]

) Two terms M and N are equal in the frame φ, written (M = N )φ, if and only if for any names ñ and substitution σ such that φ ≡ ν ñ.σ and {ñ} ∩ (f n(M ) ∪ f n(N )) = ∅ we have M σ = E N σ.

Note that any frame φ can be written as ν ñ.σ modulo structural equivalence, i.e. using rule NEW-PAR.

Definition 3 (Static Equivalence (≈ s ) [AF01]

) Two closed frames φ and ψ are statically equivalent, written φ ≈ s ψ, when dom(φ) = dom(ψ) and when for all terms M and N we have (M = N )φ if and only if (M = N )ψ. Two extended processes A and B are statically equivalent (A ≈ s B) if their frames are statically equivalent.

The intuition behind this definition is that two processes are statically equivalent if the messages exchanged previously with the environment cannot be distinguished with respect to the equational theory, i.e. all operations on both sides were indistinguishable. Note that this only concerns what is statically known to the environment, not the possible interactions.

Example 4 ([AF01]

) Consider the following frames, where f and g are two functions with no equations (corresponding intuitively to two independent one-way hash functions):

φ 0 = νk. { k /x} |νs. { s /y} φ 1 = νk. { f (k) /x, g(k) /y} φ 2 = νk. { k /x, f (k) /y}
Then φ 0 ≈ s φ 1 , but φ 1 ≈ s φ 2 and φ 1 ≈ s φ 2 as (f (x) = y)φ 2 , but neither (f (x) = y)φ 0 nor (f (x) = y)φ 1 . Intuitively this expresses that the attacker is unable to distinguish the output of two independent one-way hash functions from two random values. In the last frame there is a link between the two values that an attacker can check, making it distinguishable from the other two frames.

We can then define (Weak) 2 Labeled Bisimilarity.

Definition 4 ((Weak) Labeled Bisimilarity (≈ l ) [AF01]) (Weak) Labeled

Bisimilarity is the largest symmetric relation R on closed active processes, such that A R B implies: As hinted above, Labeled Bisimilarity is often easier to prove than Observational Equivalence since there is no quantification over all contexts. However Observational Equivalence and Labeled Bisimilarity do not coincide if active substitutions are allowed on variables of channel type [START_REF] Liu | A proof of coincidence of labeled bisimilarity and observational equivalence in applied pi calculus[END_REF]LL12], this being the reason why we restrict active substitutions to variables of base sort. In this case, (Weak) Labeled Bisimilarity coincides with observational equivalence [START_REF] Liu | A proof of coincidence of labeled bisimilarity and observational equivalence in applied pi calculus[END_REF], and is thus is closed under the application of evaluation contexts.

1. A ≈ s B, 2. if A → A ,
In our work on unique decomposition of processes we also consider a stronger version of labeled bisimilarity.

Definition 5 (Strong Labeled Bisimilarity (∼ l )) Strong Labeled Bisimilarity is the largest symmetric relation R on closed active processes, such that A R B implies: This notion is stronger than Weak Labeled Bisimilarity in the sense that each step on one side has to be matched by exactly one on the other side, whereas in the case of Weak Labeled Bisimilarity a single transition could be simulated using several (internal) transitions.

1. A ≈ s B,
Example 5 Consider again the processes from Example 3 on page 21, where f is a function: (c,a) P 1 = νa.νd. (out(d,a)|(in(d,y).out(c, y))) P 2 = νa.νd.(out(d, a)|(in (d, y).out(c, (y, f (y)))))

P 0 = νa.out
Then we have P 0 ≈ l P 1 as P 0 νa.out(c,a)

-------→ 0 and P 1 → νa.νd.out (c, a) νa.out(c,a)

-------→ 0 and P 1 → νa.νd.out(c, a) ≈ l P 0 . Yet neither P 0 ≈ P 2 nor P 1 ≈ P 2 as P 2 → νa.νd.out(c, (a, f (a))) ≡ νa.νd.νz. { a,f (a) /z} out(c, z) νz.out(c,z) -------→ νa.νd. { (a,f (a)) /z} but neither P 0 nor P 1 can produce a frame that is statically equivalent. Note also that P 0 ∼ l P 1 and P 0 ∼ l P 2 as P 0 νa.out(c,a)

-------→ 0 but P 1 and P 2 cannot do any external transition without a previous internal reduction. Similarly P 1 ∼ l P 2 as P 1 cannot produce a frame that is statically equivalent to νa.νd. { (a,f (a)) /z}.

Note that restrictions can only forbid transitions, but not create new ones.

Lemma 1 Let A be a closed extended process and X ⊆ dom(A). Then νX.A µ -→ νX.A implies A µ -→ A where µ can be a silent or a visible transition, and we have either µ = µ or -for x ∈ X and µ = νx.out(a, x), µ = out(a, x) Proof Any transition by νX.A can be executed by A as the SCOPE-rule may only forbid certain transitions. Note that the STRUCT-rule allows to apply structural equivalence rules, yet none of these can enable transitions that could not be enabled without the restriction on X. The second case where µ and µ differ is more of a syntactical corner case: a transition revealing one of the restricted values corresponds to an output of an unrestricted term in the unrestricted case, yet the underlying out is the same.

Unique Parallel Decomposition of Processes

In a process algebra the question of unique process decomposition naturally arises: can we rewrite a process P as P =3 P 1 |P 2 | . . . |P n , where each P i is prime in the sense that it cannot be rewritten as the parallel composition of two non-zero processes?

Such a decomposition provides a maximally parallelized version of a given program P . Additionally, it is useful as it provides a normal form, and a cancellation result in the sense that P |Q = P |R implies Q = R. This is convenient in proofs, for example when proving the equivalence of different security notions in electronic voting (see Chapter 3.5).

If there is an efficient procedure to transform a process into its normal form, such a decomposition can also be used to verify the equivalence of two processes [START_REF] Friso | Verification of parallel systems via decomposition[END_REF]: once the processes are in normal form, one only has to verify if the factors on both sides are identical.

In the next section, we discuss related work. We then define the depth and norm of a process, and provide our first unique decomposition result with respect to strong bisimilarity. In the following section, we show the second result w.r.t. weak bisimilarity.

-Related Work

Unique decomposition (or factorization) has been a field of interest in process algebra for a long time. The first results for a subset of CCS were published by Moller and Milner [Mol89,[START_REF] Milner | Unique decomposition of processes[END_REF]. They showed that finite processes with interleaving can be uniquely decomposed with respect to strong bisimilarity. The same is true for finite processes with parallel composition, where -in contrast to interleaving -the parallel processes can synchronize. They also proved that finite processes with parallel composition can be uniquely decomposed w.r.t. weak bisimilarity.

Later on Christensen [Chr93] proved a unique decomposition result for normed processes (i.e. processes with a finite shortest complete trace) in BPP with interleaving or parallel composition w.r.t. strong bisimilarity.

Luttik and van Oostrom [START_REF] Luttik | Decomposition ordersanother generalisation of the fundamental theorem of arithmetic[END_REF] provided a generalization of the unique decomposition results for ordered monoids. They show that if the calculus satisfies certain properties, the unique decomposition result follows directly. Recently Luttik also extended this technique for weak bisimilarity [Lut12].

However, these existing results focus on "pure" calculi such as CCS or BPP or variants thereof. The Applied π-Calculus, as an "impure" variant of the π-Calculus Additionally, the Applied π-Calculus inherits the expressive power of the π-Calculus including channel or link passing (sometimes also called mobility) and scope extrusion. Consider three parallel processes P , Q and R, where P and Q synchronize using an internal reduction τ c , i.e. P |Q|R τc -→ P |Q |R (see Figures 2.7 and 2.8). Channel passing allows a process P to send a channel y he shares with R to process Q (Figure 2.7). Scope extrusion arises for example when P sends a restricted channel y he shares with R to Q, since the scope after the transition includes Q (Figure 2.8). This is of particular importance for unique decomposition since two parallel processes sharing a restricted channel might not be decomposable and hence a simple reduction might "fuse" two prime factors, which is not possible in BPP or CCS.

-Depth and Norm of Processes

In the following we prove unique decomposition for different subsets of processes, namely finite and normed processes. This requires to formally define the length of process traces. Let Int = {τ c , τ t , τ e } denote the set of labels corresponding to internal reductions or silent transitions, and Act = {in(a, M ), out(a, u), νu.out(a, u)} for any channel name a, term M and variable or name u, denote the set of labels of possible external or visible transitions. By construction we have Act ∩ Int = ∅.

The visible depth is defined as the length of the longest trace of visible actions, i.e. labeled transitions, excluding internal reductions. Note that this may be infinite for processes including replication. We write P → if P cannot execute any transition, and

P µ 1 µ 2 ...µn ------→ P for P µ 1 -→ P 1 µ 2 -→ P 2 µ 3 -→ . . . µn -→ P . Definition 6 (Visible Depth) Let length v : (Act ∪ Int) * → N be a function where length v ( ) = 0 and length v (µw) =    1 + length v (w) if µ ∈ Act length v (w)
otherwise Then the visible depth |P | v ∈ (N ∪ {∞}) of a closed process P is defined as follows:

|P | v = sup length v (w) : P w -→ P , w ∈ (Act ∪ Int) *
The total depth is defined as the length of the longest trace of actions (including internal reductions).

Definition 7 (Total Depth) Let length t : (Act∪Int) * → N be a function where length t ( ) = 0 and length t (µw) = 1 + length t (w). The total depth |P | t ∈ (N ∪ {∞}) of a closed process P is defined as follows:

|P | t = sup length t (w) : P w -→ P , w ∈ (Act ∪ Int) *
The norm of a process is defined as the length of the shortest complete trace, including internal reductions, where communications are counted as two. This is necessary to ensure that the norm of P |Q is the sum of the norm of P and the norm of Q.

Definition 8 (Norm of a Process) Let length n : (Act ∪ Int) * → N be a function where length n ( ) = 0 and length n (µw) =

   1 + length n (w) if µ = τ c 2 + length n (w) if µ = τ c
The norm N (P ) ∈ (N ∪ {∞}) of a closed process P is defined as follows:

N (P ) = inf length n (w) : P w -→ P →, w ∈ (Act ∪ Int) *

Example 6 Consider the processes from our running example (Example 1 on page 18). We have

|P ex | v = 2, |P ex | t = 3 and N (P ex ) = 4.
The above definitions admit some simple properties.

Lemma 2 For any closed extended processes P , Q and R we have

1. |P | v ≤ |P | t 2. P = Q|R implies |P | v = |Q| v + |R| v 3. P = Q|R implies |P | t = |Q| t + |R| t 4. P = Q|R implies N (P ) = N (Q) + N (R) 5. P ≈ l Q implies |P | v = |Q| v 6. P ∼ l Q implies |P | t = |Q| t 7. P ∼ l Q implies N (P ) = N (Q)
Proof Let P , Q and R be closed extended processes.

1. By definition of the length t and length v functions.

) = |Q| v and length v (w R ) = |R| v . Then w P = w Q w R is a complete sequence of transitions of P , hence |P | v ≥ |Q| v + |R| v , thus |P | v = |Q| v + |R| v .
= w Q w R is a complete sequence of transitions of P , hence N (P ) ≤ N (Q)+N (R). Assume N (P ) < N (Q) + N (R).
(P ) = N (Q).
Now we can define two important subclasses of processes: finite processes, i.e. processes with a finite longest complete trace, and normed processes, i.e. processes with a finite shortest complete trace.

Definition 9 (Finite and normed processes)

A closed process P is called finite if |P | t is finite (which implies |P | v is finite). A closed process P is called normed if N (P ) is finite.
It is easy to see that any finite process is normed, but not all normed processes are finite, as the following example illustrates.

Example 7 Consider P = νa.(out(a, m)|(in(a, x).(!in(b, y)))|in(a, x)). Then we have P → P ∼ l 0, hence P is normed. However we also have P → P ∼ l !in(b, y), which has infinite traces. Hence P is not finite.

It is also clear that not all processes are normed. Consider the following example. Note however that any process without replication ("!") is finite, as no other syntactic element allows to construct infinite traces.

-Decomposition w.r.t. Strong Labeled Bisimilarity

We begin with the simpler case of Strong Labeled Bisimilarity. Note that P ∼ l Q implies |P | t = |Q| t and N (P ) = N (Q) for any closed processes P and Q.

We define strong parallel primeness as follows: a process is prime if it cannot be decomposed into non-trivial subprocesses (w.r.t. strong labeled bisimilarity).

We require the processes to be closed, which is necessary as our bisimulation relation is only defined on closed processes.

Definition 10 (Strongly Parallel Prime) A closed process P is strongly parallel prime if -P ∼ l 0 and -for any two closed processes Q and R such that P ∼ l Q|R, we have Q ∼ l 0 or R ∼ l 0.

Example 9 Consider our running example:

P ex = νk.νl.νm.νd. ({ l /y} |out(c, enc(n, k))|out(d, m)|in(d, x).out(c, x))
We can decompose P ex as follows:

P ex ∼ l (νl. { l /y})|(νk.out(c, enc(n, k)))|(νd.(νm.out(d, m)|in(d, x).out(c, x)))
The first factor S 1 = νl. { l /y} is prime since it defines only one variable, and we cannot have two substitutions defining the same variable.

It is easy to see that the second factor S 2 = νk.out(c, enc(n, k)) is prime, as it can only perform one external transition.

The third factor

S 3 = νd.(νm.out(d, m)|in(d, x).out(c, x))
is prime because its two parts can synchronize using a shared restricted channel and then perform a visible external transition. Since dom(S 3 ) = ∅ any decomposition into two factors, i.e. such that S 3 ∼ l S 3 |S 3 , would mean that both factors can execute one transition each (otherwise they would be equivalent to 0 as they have an empty domain). However in that case both transitions of S 3 |S 3 can be executed in any order, whereas in S 3 we have to start with the internal reduction. Hence no such decomposition exists.

Remark With respect to applications in protocol analysis, Example 9 illustrates that shared restricted names, for example private channels or shared keys, can prohibit decomposition. This is unavoidable, since a decomposition should not change the behavior of the processes (up to ∼ l ). As our definition is solely based on the semantics and the bisimilarity notion, it allows to decompose a process as far as possible without changing the observed behavior, and thus any further decomposition will change the behavior. As a side-effect, the decomposition shows where shared restricted names (modeling for example keys) are actually used in a noticeable (w.r.t. to ∼ l ) way, and where they can be ignored and processes can be further decomposed.

Remark Note also that within a prime factor we can recursively apply the decomposition as our bisimilarity notion is closed under the application of contexts.

For example if we have a prime factor P = νa.P , we can bring P into normal form, i.e. P ∼ l P 1 |...|P n , and rewrite P = νa.P as P ∼ l νa.(P 1 |...|P n ).

It is clear that not all processes can be written as a unique decomposition of parallel primes according to our definition.

Example 10 Consider !P for a process P ∼ l 0. By definition we have !P = P |!P , hence !P is not prime. At the same time any such decomposition contains again !P , a non-prime factor, which needs to be decomposed again. Thus there is no decomposition into prime factors.

However we can show that any closed normed process has a unique decomposition with respect to strong labeled bisimilarity. To achieve this, we need some preliminary lemmas about transitions and the domain of processes. The first lemma captures the fact that any process which cannot perform any transition and has an empty domain, is bisimilar to 0 (the empty process).

Lemma 3 For any closed process

A with dom(A) = ∅ and N (A) = 0, we have A ∼ l 0.
Proof Consider the relation R = {(A, 0)}. We show that it fulfills the conditions of strong labeled bisimilarity:

1. We have dom(A) = ∅ = dom(0), hence A ≈ s 0.

2. Let (A, 0) ∈ R. Obviously 0 cannot do any transition. Since N (A) = 0, there exists a complete trace of length 0. Thus we have A →, i.e. A cannot do any transition either and the remaining conditions are trivially satisfied.

As we have (A, 0) ∈ R, this gives A ∼ l 0, which we wanted to show.

We also need to show that if a normed process can execute a transition, it can also execute a norm-reducing transition.

Lemma 4 Let A be a closed normed process with

A µ -→ A where µ is an internal reduction or visible transition. Then A µ -→ A with N (A ) < N (A). Proof As A is normed, we have ∞ > N (A). Moreover, A µ -→ A implies N (A) > 0,
as this transition contradicts a complete trace of length 0. Hence the shortest complete trace w has ∞ > length n (w) > 0. Hence there is a transition µ with

w = µ w which reduces norm, i.e. A µ -→ A with N (A ) < N (A).
In a first step, we prove the existence of a decomposition.

Theorem 5 (Existence of Factorization) Any closed normed process P can be expressed as the parallel product of strong parallel primes, i.e. P ∼ l P 1 | . . . |P n where for all 1 ≤ i ≤ n, P i is strongly parallel prime.

Proof By induction on the norm of P , and on the size of the domain dom(P ).

-If N (P ) = 0:

-If |dom(P )| = 0, then P ∼ l 0 (by Lemma 3), hence the factorization is the empty product.

-If |dom(P )| > 0, then P ∼ l 0, hence P is either strongly parallel prime itself (in which case we are done), or can be written as P ∼ l Q|R (by the definition of strongly parallel prime). As we have dom(P

) = dom(Q) ∪ dom(R) with dom(Q) ∩ dom(R) = ∅ and |dom(Q)| > 0, |dom(R)| > 0 (since Q ∼ l 0 and R ∼ l 0), we have |dom(Q)| < |dom(P )|, |dom(R)| < |dom(P )
|, hence we can use the induction hypothesis to conclude.

-If N (P ) > 0:

-If |dom(P )| = 0: P is either strongly parallel prime itself, or can be written as P ∼ l Q|R. Then we have dom(P

) = dom(Q) = dom(R) = ∅, and N (Q) > 0, N (R) > 0 by Lemma 3, hence N (Q) < N (P ), N (R) < N (P )
by Lemma 2 and we can apply the induction hypothesis.

-If |dom(P )| > 0, then P ∼ l 0, hence P is either strongly parallel prime itself, or can be written as P ∼ l Q|R. Suppose N (Q) > 0 and We now show the uniqueness of the decomposition. As an additional notation, let exp(A, R) denote the exponent (i.e. the number of occurrences) of prime A in the unique factorization4 of R.

N (R) > 0, hence N (Q) < N (P ), N (

Theorem 6 (Uniqueness of Factorization)

The strong parallel factorization of a closed normed process P is unique up to ∼ l and permutation of the prime factors.

Proof By induction on N (P ), and on the size of the domain dom(P ).

-If N (P ) = 0:

-If |dom(P )| = 0, then P ∼ l 0 (by Lemma 3), hence the factorization is the unique empty product.

P ∼ l A k 1 1 |A k 2 2 | . . . |A kn n Q ∼ l A l 1 1 |A l 2 2 | . . . |A ln n
where the A i 's are distinct (i.e. for i = j we have A i ∼ l A j ) and k i ≥ 0, l i ≥ 0.

Note that since all factors A i are prime we have ∀i A i ∼ l 0, and since we also know N (P ) = 0 we have ∀i N (A i ) = 0. By Lemma 3 we then have dom(A i ) = ∅, which implies k i , l i ≤ 1 as we cannot have two substitutions defining the same variable.

Let m be such that k m = l m . Without loss of generality we assume 1 = k m > l m = 0. Obviously we have dom(P ) = dom(Q). Let ṽ = dom(P ) \ dom(A m ). Then we have (by Lemma 2 and rules ALIAS and NEW-PAR):

ν ṽ.P ≡ A m |ν ṽ.P ∼ l A m
where P is P without the factor A m , since dom(ν ṽ.P ) = ∅ and N (ν ṽ.P ) = 0. Similarly

ν ṽ.Q ≡ | i∈I ν ṽi .A i | i / ∈I ν ṽi .A l i i ∼ l | i∈I ν ṽi .A i
where I = {i|dom(A i ) ∩ dom(A m ) = ∅ and l i = 1} and ṽi = dom(A i ) ∩ ṽ. By ν ṽ.P ∼ l ν ṽ.Q we have A m ∼ l | i∈I ν ṽi .A i . If |I| = 0, we have A m ∼ l 0 which contradicts the hypothesis that A m is prime. Similarly for |I| > 1, we have a factorization for A m into several processes, which also contradicts A m prime.

For |I| = 1 we have the following cases: Let i denote the only index in I.

If ṽi = ∅, we have a contradiction to the distinctness hypothesis of the

A j 's since A m ∼ l A i with m = i as l m = 0 = l i = 1. If ṽi = ∅ we have dom(A m ) ⊂ dom(A i ), but dom(A m ) = dom(A i ). Now consider ṽ = dom(Q) \ dom(A i ).
Then -as above -we have:

ν ṽ .Q ≡ A i |ν ṽ .Q ∼ l A i where Q is Q without the factor A i . Similarly ν ṽ .P ≡ | j∈I ν ṽ j .A j | j / ∈I ν ṽ j .A l j j ∼ l | j∈I ν ṽ j .A j where I = {j|dom(A j ) ∩ dom(A i ) = ∅ and k j = 1} and ṽ j = dom(A j ) ∩ ṽ . Since dom(A m ) ⊂ dom(A i ), dom(A m ) = dom(A i ) and dom(A i ) = dom(| j∈I ν ṽ j .A j ) we have |I | > 1, hence A i ∼ l | j∈I ν ṽ j .
A j gives a factorization of A i , which contradicts the hypothesis that it is prime.

-If N (P ) > 0:

-If |dom(P )| = 0: Suppose P ∼ l Q, but P and Q have different factorizations:

P ∼ l A k 1 1 |A k 2 2 | . . . |A kn n Q ∼ l A l 1 1 |A l 2 2 | . . . |A ln n
where the A i 's are distinct (i.e. for i = j we have A i ∼ l A j ) and k i , l i ≥ 0.

By induction hypothesis we have that for every process R with N (R) < N (P ) the factorization is unique.

Let m be such that k m = l m , and that N (A j ) > N (A m ) implies k j = l j (i.e. A m has the maximal norm among the factors in which P and Q differ).

Without loss of generality we assume k m > l m .

In the following we use the fact that P ∼ l Q and hence Q can simulate each transition of P and vice versa.

We now analyze different cases: * If P = A km m , i.e. P is the power of a prime: Note that Q cannot contain any prime factor A r , r = m with N (A r ) > N (A m ): Suppose l r > 0. By assumption, A m is the maximal (w.r.t. norm) prime factor in which P and Q differ, hence k r = l r > 0. This contradicts P = A km m . If k m = 1 (i.e. P is prime), then Q is prime as well, and since 1 = k m > l m we have Q ∼ l A j for some j = m, which gives A m ∼ l A j , which contradicts the distinctness of the prime factors.

If k m > 1: Assume l m = 0. Then -since dom(A m ) = ∅ -for some µ A m µ -→ R, P µ -→ P with exp(A m , P ) = k m -1 > 0 and N (P ) < N (P ) by Lemma 4. Since P ∼ l Q, there exists a Q with Q µ -→ Q . For any such Q we have exp(A m , Q ) = 0 since l m = 0, A m
has maximal norm, and l i = 0 for all A i with N (A i ) > N (A m ). Note that if µ = τ c two smaller factors in Q could fuse using scope extrusion (cf. Figure 2.8 on page 25), however no two prime factors share a secret channel (cf. the structure of P and Q). Hence the existence of such a transition τ c fusing two factors would imply the existence of a µ = τ c that we can chose instead. Since Q ∼ l P we also know that A m can execute µ, which we can thus choose to ensure the above reasoning holds. As P and Q have a unique prime factorization by induction hypothesis, we have a contradiction with exp(A m , P

) = k m -1 > 0 = exp(A m , Q ). Hence assume l m > 0: If A m µ -→ R with N (R) < N (A m ) for µ = τ c , we have Q µ -→ Q and since P ∼ l Q there exists P with P µ -→ P . We have exp(A m , P ) ≥ k m -1 > l m -1 = exp(A m , Q ) which contradicts 2.
The Applied π-Calculus and Unique Parallel Decomposition of Processes P ∼ l Q using the induction hypothesis. If no such transition µ exists, we have A m τc -→ R, hence Q τc -→ Q and since P ∼ l Q there exists P with P τc -→ P . We know that P cannot simulate this transition using synchronization between the different copies of A m as this would imply the existence of a visible norm-reducing transition µ (as the transition τ c is norm-reducing as well). Hence we have again exp(A m , P ) ≥ k m -1 > l m -1 = exp(A m , Q ) which contradicts P ∼ l Q using the induction hypothesis. * If there exists j = m such that k j > 0: Let µ, T be such that P µ -→ T and N (T ) < N (P ) and for all ν such that P ν -→ P with N (P ) < N (P ) we have exp(A m , P ) ≤ exp(A m , T ). We now show that such µ, T exist. Note because of Lemma 2 and

N (P ) < ∞ we have N (A i ) < ∞. This gives that if A i µ -→ A i then A i µ -→ A i with N (A i ) < N (A i ) by Lemma 4. Suppose no such µ, T exist. Hence for no A i with k i > 0, i = m we have A i µ -→ A i ,
otherwise this allows a transition that would fulfill the above conditions. Hence (by Lemma 3) we have dom(A i ) = ∅ for any i with k i > 0, i = m, which contradicts |dom(P )| = 0. Note that exp(A m , T ) ≥ k m , as any transition by a factor different from A m does not decrease the number of A m 's. If we have a µ = τ c , then -as

P ∼ l Q -there exists Q with Q µ -→ Q and Q ∼ l T . Hence N (Q ) < N (Q) and ∃A t with A t µ -→ R. If N (A t ) ≤ N (A m ) then exp(A m , Q ) ≤ l m < k m ≤ exp(A m , T ), which gives the contradiction to the induction hypothesis, If N (A t ) > N (A m ) then exp(A m , Q ) = l m + exp(A m , R), t = m and k t = l t > 0 as A m is maximal. Consider now P µ -→ P = A k 1 1 | . . . |A kt-1 t | . . . |A kn n |R with exp(A m , P ) = k m + exp(A m , R). Hence exp(A m , Q ) = l m + exp(A m , R) < k m + exp(A m , R) = exp(A m , P ), which contradicts Q ∼ l P .
Hence the only option for Q to match this transition would be to use a ever bigger A s , in which case we can however apply the same argument (k s = l s ). As the number of prime factors is finite, we have that Q ∼ l P which gives the contradiction. If no µ = τ c exists, choose a µ = τ c . We distinguish two different cases: If the transition is matched by only one factor, we can argue as above. If the transition is matched by the synchronization of two factors (A r α -→ A r and A s ᾱ -→ A s ), this implies that we have two visible actions on two different factors. As all transitions that do not reduce the number of A m 's are τ c -transitions, these actions can only be matched by

A m , thus A m α -→ A m . Hence Q α -→ Q with exp(A m , Q ) = l m -1 and for any P α -→ P we have exp(A m , P ) ≥ k m -1 > l m -1 = exp(A m , Q ), which contradicts P ∼ l Q .
-If |dom(P )| > 0: This is essentially the same proof as above. In the first case (P is a power of a prime), we only have to consider the case k m = 1 as dom(A m ) = ∅. Hence P is prime, and then Q is prime as well, and since 1 = k m > l m we have Q ∼ l A j for some j = m, which gives A m ∼ l A j , which contradicts the distinctness of the prime factors.

In the second case we have to be more careful when proving that µ and T with the desired properties exist. Once again, we suppose that they do not exist, hence for no A i with k i > 0, i = m we have A i µ -→ A i , otherwise this allows a transition that would fulfill the conditions. Hence for any i with k i > 0, i = m we have N (A i ) = 0, and by Lemma 3 we have dom(A i ) = ∅. Let ṽ = dom(P ) \ dom(A m ) and consider ν ṽ.P ≡ A km m |ν ṽ.P ∼ l A km m where P is P without the factor A km m . Similarly

ν ṽ.Q ≡ | i ν ṽi .A l i i where ṽi = dom(A i ) ∩ ṽ.
As |dom(A km m )| < |dom(P )| by induction hypothesis the factorization is unique. We cannot have ṽi = ∅ for any i = m, as this contradicts the uniqueness of the factorization as A i ∼ l A m . Hence dom(A i ) = ∅ and l i = 1. As A m is prime, we have that A m |R ∼ l ν ṽi .A i for some i = m and R. More precisely, we have ν ṽi .A i ∼ l A l m for some l ≥ 1, as any other factorization of R would contradict the primeness of A m . In fact, since A m is the biggest factor in which P and Q differ and by Lemmas 1 and 3, we have l = 1. We cannot have Q ∼ l A i as this would directly give a factorization of A i . Hence there has to be another factor A r which -by Lemma 3 -has either dom(A r ) = ∅ or can execute a transition (or both). If dom(A r ) = ∅, consider ṽ = dom(Q) \ dom(A i ). Then -as above -we have:

Q 1 = ν ṽ .Q ≡ A i |ν ṽ .Q ∼ l ν ṽ .P = P 1 where Q is Q without the factor A i . If A r η -→ A r , we have Q ∼ l A i |A r |S η -→ A i |A r |S = Q 1
where S is Q without A i and A r . By P ∼ l Q there exists P 1 with

P η -→ P 1 ∼ l A i |A r |S.
In both cases, we have a unique factorization by induction hypothesis. Additionally exp(A i , Q 1 ) = 1, and by the uniqueness of the factorization exp(A i , P 1 ) = exp(A i , Q 1 ) = 1. Let s be such that dom(A s ) ∩ dom(A i ) = ∅, k s > 0. Such s exists because of dom(A m ) dom(A i ) and dom(P ) = dom(Q). Then by hypothesis A s cannot do any transition, and exp(A s , P 1 ) = exp(A s , P ) = 1, which contradicts exp(A i , P 1 ) = 1 because of the conflicting domains. Hence µ and T with the desired properties exist, and the rest of the proof is the same as above.

As a direct consequence, we have the following cancellation result.

Lemma 7 (Cancellation Lemma) For any closed normed processes A, B and C, we have

A|C ∼ l B|C ⇒ A ∼ l B
Proof As A, B and C are closed and normed, there exists a unique parallel factorization for each of them, i.e.

A ∼ l A 1 | . . . |A k , B ∼ l B 1 | . . . |B l and C ∼ l C 1 | . . . |C m . Thus we have A|C ∼ l A 1 | . . . |A k |C 1 | . . . |C m and B|C ∼ l B 1 | . . . |B l |C 1 | . . . |C m .
These are prime factorizations, and by Theorem 6 they are unique. As A|C ∼ l B|C, they have to be identical. Hence k + m = l + m, thus k = l. We show that this implies that the factorizations of A and B have to be identical (up to ∼ l ), which implies A ∼ l B. Consider the following cases: If k = 0, A ∼ l 0. As l = k = 0, B ∼ l 0, and A and B have the same prime factorization.

If k > 0, we have A ∼ l A 1 | . . . |A k . Suppose that there exists a prime factor B|C), which contradicts the fact that A|C and B|C have the same prime factorization.

A i with exp(A i , A) = exp(A i , B), then exp(A i , A|C) = exp(A i , A) + exp(A i , C) = exp(A i , B) + exp(A i , C) = exp(A i ,

-Decomposition w.r.t. Weak Labeled Bisimilarity

In this part, we discuss unique decomposition with respect to (weak) labeled bisimilarity. Note that P ≈ l Q implies |P | v = |Q| v for any closed processes P and Q (cf. Lemma 2 on page 26).

To obtain our unique decomposition result for weak labeled bisimilarity, we need to define parallel prime with respect to weak labeled bisimilarity.

Definition 11 (Weakly Parallel Prime) A closed extended process P is weakly parallel prime, if -P ≈ l 0 and -for any two closed processes Q and R such that P ≈ l Q|R, we have

Q ≈ l 0 or R ≈ l 0.
This definition is analogous to strongly parallel prime. However, as the following example shows, in contrast to strong bisimilarity, not all normed processes have a unique decomposition w.r. If however we consider normed processes that contain neither restriction ("ν") nor conditionals, we have that any normed process is finite (and hence has a unique decomposition, as we show below).

Lemma 8 For any process P that does not contain restriction ("ν") or conditionals ("if then else"), we have that P is finite if and only if P is normed.

Proof It is easy to see that any finite process is normed. To show the converse, we use induction on the structure of P .

-P = 0: P is obviously finite and normed.

-P = { M /x}: P is finite and normed.

-

P = Q|R: If N (P ) < ∞ then N (Q) < ∞ and N (R) < ∞. By induction hypothesis |Q| t < ∞ and |R| t < ∞, hence |P | t < ∞. -P = !Q: If N (P ) < ∞ then |Q| t = 0, hence |P | t < ∞. -P = in(u, x).Q or P = out(u, M ).Q: If N (P ) < ∞ then N (Q) < ∞. By induction hypothesis |Q| t < ∞, hence |P | t < ∞.
Similarly any process that does not contain replication is finite.

In the following we show that all finite processes have a unique decomposition w.r.t. to (weak) labeled bisimilarity. To prove this, we need some preliminary lemmas about transitions and the domain of processes.

Lemma 9 For any closed process

A with A → * A , we have dom(A) = dom(A ).
Proof The domain of a process is the set of variables for which it defines a substitution. No transition can destroy an existing active substitution. Similarly, if A executes only internal reductions, A cannot create any new active substitutions, hence dom(A) = dom(A ).

Lemma 10 For any closed process A for which no sequence of transitions

A → * α -→ A exists, we have A ≈ l A for any A with A → * A . Proof Consider the relation R = {(X, Y )|A → * X and A → * Y }.
We will show that it fulfills the conditions of labeled bisimilarity:

1. Obviously we have A ≈ s A, which is closed under internal reductions (as they do not change the active substitutions). Hence for any (C, D) ∈ R we have C ≈ s D. The next lemma captures the fact that any process which cannot perform any visible transition and has an empty domain, is weakly bisimilar to 0 (the empty process).

Lemma 11 If for a closed process A with dom(A) = ∅ there does not exist a sequence of transitions

A → * α -→ A , then we have A ≈ l 0.
Proof Suppose there is no sequence of transitions A → * α -→ A . We show that this implies A ≈ l 0. Consider the relation R = {(A , 0)|A → * A }. We show that it fulfills the conditions of labeled bisimilarity: As we have (A, 0) ∈ R, this gives A ≈ l 0, which we wanted to show.

As a direct consequence, this gives us that any non-zero process with empty domain can do a visible transition.

Corollary 12

For every closed process A with dom(A) = ∅ and A ≈ l 0 there exists a sequence of transitions A → * α -→ A .

Now we can show in a first step that a decomposition into prime factors exists.

Theorem 13 (Existence of Factorization) Any closed finite active process P can be expressed as the parallel product of parallel primes, i.e. P ≈ l P 1 | . . . |P n where for all 1 ≤ i ≤ n P i is weakly parallel prime.

Proof By induction on the visible depth of P , and on the size of the domain dom(P ).

-

If |P | v = 0:
-If |dom(P )| = 0, then P ≈ l 0 (by Lemma 11), hence the factorization is the empty product.

-If |dom(P )| > 0, then P ≈ l 0, hence P is either parallel prime itself (in which case we are done), or can be written as P ≈ l Q|R with Q ≈ l 0 and R ≈ l 0 (by the definition of parallel prime). As we have -

dom(P ) = dom(Q)∪dom(R) with dom(Q)∩dom(R) = ∅ and |dom(Q)| > 0, |dom (
If |P | v > 0:
-If |dom(P )| = 0: P is either parallel prime itself, or can be written as P ≈ l Q|R. Then we have dom(P

) = dom(Q) = dom(R) = ∅, and |Q| v > 0, |R| v > 0 (by Corollary 12), hence |Q| v < |P | v , |R| v < |P | v
and we can apply the induction hypothesis.

-If |dom(P )| > 0: P is either parallel prime itself, or can be written as

P ≈ l Q|R. Suppose |Q| v > 0, |R| v > 0, hence |Q| v < |P | v , |R| v < |P | v and
we can apply the induction hypothesis. Suppose w.l.o.g. To prove uniqueness we use the following relation on processes.

|Q| v = 0 < |P | v , then |R| v = |P | v . Since Q ≈ l 0
Definition 12 (" ") For two finite processes P and Q we have

P Q iff -|P | v > |Q| v or -|P | v = |Q| v and P → * Q i.
e. P has either a longer visible trace than Q or P can be reduced to Q using internal reductions.

This is a partial order on finite processes modulo static equivalence. The relation is reflexive as we have P → * P , and transitive. It is also antisymmetric: Suppose P Q and Q P , then |P | v = |Q| v , P → * Q and Q → * P . Since P and Q are finite, we cannot have P → * Q → * P for P ≡ Q as this allows to construct an infinite trace. Now we can show the uniqueness of the decomposition.

Theorem 14 (Uniqueness of Factorization)

The parallel factorization of a closed finite process P is unique (up to ≈ l ).

Proof We will prove a slightly different statement which implies the uniqueness of the factorization: Any closed finite processes P f and Q f with P f ≈ l Q f have the same factorization (up to ≈ l ).

Suppose P f ≈ l Q f , but P f and Q f have different factorizations:

P f = P 1 |P 2 | . . . |P o 1 Q f = Q 1 |Q 2 | . . . |Q o 2
We can rewrite this factorization as follows:

P = A k 1 1 |A k 2 2 | . . . |A kn n Q = A l 1 1 |A l 2 2 | . . . |A ln n where P ≈ l P f and Q ≈ l Q f , the A i 's are distinct (i.e. for i = j we have A i ≈ l A j ) and k i , l i ≥ 0.
We will show that this leads to a contradiction by induction on a = |P | t + |Q| t , and inside each case by induction on the size of the domain b = |dom(P

)| = |dom(Q)|.
-If a = 0:

-If b = 0, then P ≈ l 0 (by Lemma 11), hence the factorization is the unique empty product.

-If b > 0, then P ≈ l 0. Note that since ∀i A i ≈ l 0 and a = |P | t + |Q| t = 0, we have dom(A i ) = ∅ by Lemma 11, which implies k i , l i ≤ 1 as we cannot have two substitutions defining the same variable.

Let m be such that k m = l m . Without loss of generality we assume 1 = k m > l m = 0. Obviously we have dom(P ) = dom(Q). Let ṽ = dom(P ) \ dom(A m ). Then we have (by Lemma 2 and rules ALIAS and NEW-PAR):

ν ṽ.P ≡ A m |ν ṽ.P ≈ l A m
where P is P without the factor A m . Similarly

ν ṽ.Q ≡ | i∈I ν ṽi .A i | i / ∈I ν ṽi .A l i i ≈ l | i∈I ν ṽi .A i where I = {i|dom(A i ) ∩ dom(A m ) = ∅ and l i = 1} and ṽi = dom(A i ) ∩ ṽ. By ν ṽ.P ≈ l ν ṽ.Q we have A m ≈ l | i∈I ν ṽi .A i . If |I| = 0, we have A m ≈ l 0
which contradicts the hypothesis that A m is prime. Similarly for |I| > 1, we have a factorization for A m into several processes, which also contradicts A m prime. For |I| = 1, i.e. A m ≈ l ν ṽi .A i for the only index i in I, we have the following cases: If ṽi = ∅, we have a contradiction to the distinctness hypothesis of the A j 's since A m ≈ l A i with m = i as l m = 0 = l i = 1. If ṽi = ∅ we have dom(A m ) dom(A i ). Now consider ṽ = dom(Q) \ dom(A i ). Then -as above -we have:

ν ṽ .Q ≡ A i |ν ṽ .Q ≈ l A i where Q is Q without the factor A i . Similarly ν ṽ .P ≡ | j∈I ν ṽ j .A j | j / ∈I ν ṽ j .A l j j ≈ l | j∈I ν ṽ j .A j where I = {j|dom(A j ) ∩ dom(A i ) = ∅ and k j = 1} and ṽ j = dom(A j ) ∩ ṽ . Since dom(A m ) dom(A i ) and dom(A i ) = dom(| j∈I ν ṽ j .A j ) (by dom(P ) = dom(Q)) we have |I | > 1, hence A i ≈ l | j∈I ν ṽ j .
A j gives a factorization of A i , which contradicts the hypothesis that it is prime.

-If a > 0:

-If b = 0: If P ≈ l 0 then the (empty) factorization is unique. Hence suppose 0

≈ l P ≈ l Q. Let m be such that A m is a maximal (w.r.t. ) A i with k i = l i (hence k m = l m ).
Without loss of generality we assume k m > l m .

In the following we will use the fact that P ≈ l Q and hence Q can simulate each transition of P and vice versa. Assume P → * µ -→ P such that |P | v = |P | v + 1, then the labeled bisimilarity gives us Q → * µ -→→ * Q with P ≈ l Q . For our proof it will be important that to simulate this transition in Q the prime factors cannot communicate. Suppose two prime factors A r β -→ R and A s β -→ S communicated (through an internal reduction), then this has consumed at least two visible actions, hence

|Q | v ≤ |Q| v -2 = |P | v -2 = |P | v -1 < |P | v .
Thus P and Q do not have the same visible depth, which contradicts that fact that they are bisimilar. We now analyze different cases: * If P ≈ l A km m , i.e. P is the power of a prime: Note that Q cannot contain any prime factor A r , r = m with A r A m : Suppose l r > 0. By assumption, A m is a maximal (w.r.t. ) prime factor in which P and Q differ, hence k r = l r > 0. This contradicts P ≈ l A km m . If k m = 1 (i.e. P is prime), then Q is prime as well, and since 1 = k m > l m we have Q ≈ l A j for some j = m, which gives A m ≈ l A j , which contradicts the distinctness of the prime factors. If k m > 1: Note that this implies dom(A m ) = ∅ as otherwise we would have several substitutions defining the same variables. Assume l m = 0, then for some µ ∈ Act A m → * µ -→ R (by A m ≈ l 0 and Corollary 12) with

|R| v = |A m | v -1, so P → * µ -→ P with exp(A m , P ) = k m -1 > 0. Since P ≈ l Q, there exists a Q with Q → * µ -→→ * Q . For any such Q we have exp(A m , Q ) = 0 since A m is maximal (w.r.t. ), l i = 0 for all A i with |A i | v > |A m | v
and since communication between different prime factors -which could through the exchange of secret channels lead to bigger (in the sense of visible depth) new prime factors -is not possible. As P and Q have a unique prime factorization by induction hypothesis, we have a contradiction with exp(A m , P

) = k m -1 > 0 = exp(A m , Q ). Hence assume l m > 0: Suppose l m < k m -1: As A m → * µ -→ R, we have P → * µ -→ P with exp(A m , P ) = k m -1 and since P ≈ l Q there exists Q with Q → * µ -→→ * Q . Hence we have exp(A m , P ) = k m -1 > l m ≥ exp(A m , Q ) which contradicts P ≈ l Q using the induction hypothesis. Hence assume l m = k m -1: We can write Q = S|A lm m ,
where S is composed of prime factors. We have S ≈ l A m as the opposite contradicts either the distinctiveness of the prime factors or the fact that A m is prime. -→→ * P (w.l.o.g., when µ = τ we have P → * P ). Since this transition reduced the total depth, we can apply the induction hypothesis and both Q and P have a unique prime factorization, hence

Since ∅ = dom(A m ) = dom(P ) = dom(Q) = dom(S) we have S ≈ s A m ,
P = R|A km-1 m where A m → * µ -→→ * R (or A m → * R respectively)
. By the uniqueness of the factorization we also have R ≈ l S , which contradicts the assumption that the transition cannot be simulated.

Suppose A m µ -→ R with |R| t < |A m | t such that S cannot match the transition. As we have P ≈ l Q, P = A km m µ -→ R|A km-1 m = P gives us that Q → * µ -→→ * Q (w.l.o.g., otherwise Q → * Q ).
Since this transition reduced the total depth, we can apply the induction hypothesis and both Q and P have the same unique prime factorization, hence

S |A km-1 m = Q ≈ l P = R|A km-1 m . Thus R ≈ l S .
Since A m is the biggest factor in which P and Q differ, all other factors in S cannot be reduced to A m , and we have S → * µ -→→ * S (or S → * S respectively), which contradicts the assumption.

Let µ ∈ Act, T be such that P → * µ -→ T and |P | v = |T | v + 1 and for all ν such that P → * ν -→ P with |P | v = |P | v + 1 we have exp(A m , P ) ≤ exp(A m , T
). We now show that such µ, T exist. Suppose no such µ, T exist. Hence for no A i with k i > 0, i = m we have A i → * µ -→ A i , otherwise this allows a transition that would fulfill the above conditions. Hence (by Lemma 11) we have dom(A i ) = ∅ for any i with k i > 0, i = m, which contradicts |dom(P )| = 0. Note that exp(A m , T ) ≥ k m , as any transition by a factor different from A m does not decrease the number of A m 's.

As P ≈ l Q there exists Q with Q → * µ -→→ * Q and Q ≈ l T . Hence |Q| v = |Q | v + 1 and ∃A t with A t → * µ
-→→ * R as there can be no communication between the A i 's (as shown above).

If |A t | v ≤ |A m | v then exp(A m , Q ) ≤ l m < k m ≤ exp(A m , T ), which
gives the contradiction to the induction hypothesis. Note that as A m is the maximal prime factor in which P and Q differ,

A j → * A m implies k j = k l , hence Q cannot contain additional A m as a result of internal reductions -this would imply exp(A j , Q ) = exp(A j , P ). If |A t | v > |A m | v then t = m, and k t = l t > 0 (as A m is maximal). Con- sider P → * µ -→→ * P = A k 1 1 | . . . |A kt-1 t | . . . |A kn n |R with exp(A m , P ) = k m + exp(A m , R). Hence exp(A m , Q ) ≤ l m + exp(A m , R) < k m + exp(A m , R) = exp(A m , P ), which contradicts Q ≈ l P .
Hence the only option for Q to match this transition would be to use a ever bigger A s , in which case we can however apply the same argument (k s = l s ). As the number of prime factors is finite, we have that Q ≈ l P which gives the contradiction. Note that -as above -Q cannot contain additional A m as a result of internal reductions.

-If b > 0: This is essentially the same proof as above. In the first case (P is a power of a prime), we only have to consider the case k m = 1 as dom(A m ) = ∅. Hence P is prime, and then Q is prime as well, and since 1 = k m > l m we have Q ≈ l A j for some j = m, which gives A m ≈ l A j , which contradicts the distinctness of the prime factors.

In the second case we have to be more careful when proving that µ and T with the desired properties exist. Once again, we will suppose that they do not exist, hence for no A i with k i > 0, i = m we have A i → * µ -→ A i , otherwise this allows a transition that would fulfill the conditions. Hence (by Lemma 11) we have dom(A i ) = ∅ for any i with k i > 0, i = m. Let ṽ = dom(P ) \ dom(A m ) and consider ν ṽ.P ≡ A km m |ν ṽ.P ≈ l A km m where P is P without the factor A km m . Similarly

ν ṽ.Q ≡ | i ν ṽi .A l i i
where ṽi = dom(A i ) ∩ ṽ.

As |dom(A km m )| < |dom(P )| by induction hypothesis the factorization is unique. We cannot have ṽi = ∅ for any i = m, as this contradicts the uniqueness of the factorization as

A i ≈ l A m . Hence dom(A i ) = ∅ and l i = 1 for i = m.
As A m is prime, we have that A m |R ≈ l ν ṽi .A i for some i = m and R. More precisely, we have ν ṽi .A i ≈ l A l m for some l ≥ 1, as any other factorization of R would contradict the primeness of A m . In fact, since A m is the biggest factor in which P and Q differ and by Lemmas 11 and 1, we have l = 1. We cannot have Q ≈ l A i as this would directly give a factorization of A i . Hence there has to be another factor A r which -by Lemma 11 -has either dom(A r ) = ∅ or can execute a visible transition (or both). If dom(A r ) = ∅, consider ṽ = dom(Q) \ dom(A i ). Then -as above -we have:

ν ṽ .Q ≡ A i |ν ṽ .Q = Q 1 ≈ l ν ṽ .P = P 1 where Q is Q without the factor A i . If A r → * η -→ A r , we have Q ≈ l A i |A r |S → * η -→ A i |A r |S = Q 1
where S is Q without A i and A r . By P ≈ l Q there exists P 1 with P → * η -→→ * P 1 ≈ l A i |A r |S. In both cases, we have a unique factorization by induction hypothesis. Additionally exp(A i , Q 1 ) = 1, and by the uniqueness of the factorization exp

(A i , P 1 ) = exp(A i , Q 1 ) = 1. Let s be such that dom(A s ) ∩ dom(A i ) = ∅, k s > 0. Such s exists because of dom(A m )
dom(A i ) and dom(P ) = dom(Q). Then by hypothesis A s cannot do any visible transition, and by Lemma 10 exp(A s , P 1 ) = exp(A s , P ) = 1, which contradicts exp(A i , P 1 ) = 1 because of the conflicting domains. Hence µ and T with the desired properties exist, and the rest of the proof is the same as above.

Again we have a cancellation result using the same proof as above.

Lemma 15 (Cancellation Lemma) For any closed finite processes

Conclusion

In this chapter we recalled the Applied π-Calculus, in particular its syntax, semantics and equivalence notions. We then presented two unique decomposition results for subsets of the Applied π-Calculus. We showed that any closed finite process can be decomposed uniquely with respect to weak labeled bisimilarity, and that any normed process can be decomposed uniquely with respect to strong labeled bisimilarity. Table 2.1 sums up our results.

As the concept of parallel prime decomposition has its inherent limitations with respect to replication ("!", see Example 10), a natural question is to find an extension to provide a normal form even in cases with infinite behavior. A first result in this direction has been obtained by Hirschkoff and Pous [START_REF] Hirschkoff | On bisimilarity and substitution in presence of replication[END_REF] for a subset of CCS with top-level replication. They define the seed of a process P as the process Q, Q bisimilar to P , of least size (in terms of prefixes) whose number of replicated components is maximal (among the processes of least size), and show that this representation is unique. They also provide a similar normal form result for the Restriction-Free-π-Calculus (i.e. no "ν"). It remains however open if a similar result can be obtained for the full calculus.

Another interesting question is to find an efficient algorithm that converts a process into its unique decomposition. It is unclear if such an algorithm exists and can be efficient, as simply deciding if a process is finite can be non-trivial. Such an algorithm could however allow to verify the bisimilarity of two given processes by transforming them into their normal form, and then simply checking if the normal forms are identical.

Finally we did not show formally that Strong Labeled Bisimilarity is closed under the application of contexts. Due to its close relation to Weak Labeled Bisimilarity we expect the result to hold (which is important for our decomposition to be meaningful), yet we estimate that the full formal proof will be at least similarly as complex as the proof for Weak Labeled Bisimilarity [START_REF] Liu | A proof of coincidence of labeled bisimilarity and observational equivalence in applied pi calculus[END_REF][START_REF] Liu | Re: Coincidence of labeled bisimilarity and observational equivalence in the applied pi calculus [e-mail[END_REF].

Chapter 3 eVoting P rivacy is a major concern in electronic voting, as it is crucial to ensure the

Introduction

Electronic voting systems have been designed and employed in practice for several years, mainly in the form of direct-recording electronic (DRE) voting machines. More recently, some countries started to offer the possibility to vote over the Internet, e.g. in Estonia [Est], parts of Switzerland [Gen13, Reg13] or for French expatriates

[Min13].
As voting is a central act of participation in modern democracies, the use of such systems in general elections requires high security standards and remains controversial [Par07, UK 07, Min08, Bun09]. Consequently many security requirements for electronic voting systems have been proposed:

-Correctness: The announced result corresponds to the sum of all submitted votes.

-Eligibility: Only the registered voters can vote, and nobody can submit more votes than allowed (typically only one).

-Fairness: The election process is fair, in particular no preliminary results that could influence other voters' decisions are available.

-Robustness: The protocol can tolerate some misbehaving voters.

-Verifiability: Voters are provided with evidence that allows them to verify the correctness of the election process.

-Privacy: All votes remain private.

The last requirement is crucial to ensure that the voters are free in their choice and cannot be coerced. In the literature, it is often split into several notions (e.g. [DKR09, LSB + 09, SC11, SB13, Jon09, DHvdG + 13]):

-Vote-Privacy: The votes are kept private with respect to an outside observer. This can also be expressed as an unlinkability between the voter and his vote.

-Receipt-Freeness: A voter cannot construct a receipt which allows him to prove to a third party that he voted for a certain candidate. This is to prevent vote-buying.

-Coercion-Resistance: Even when a voter interacts with a coercer during the entire voting process, the coercer cannot be sure whether he followed his instructions or actually voted for another candidate.

-Security against Forced Abstention Attacks: A coercer cannot force a voter to abstain from voting.

-Vote-Independence: No voter can relate his vote to any other voter's vote1 .

-Everlasting Privacy: Privacy is not only ensured at the time of the election, but also in the long term when computationally secure encryptions might turn insecure due to increased computational power.

As we argued in Chapter 1, the design of complex protocols to fulfill all these partly antipodal requirements [CMFP + 06] is notoriously difficult and error-prone. Consequently many efforts have been undertaken to formally define and verify these properties (e.g. [JCJ05, MN06b, BHM08, DKR09, Jon09, KRS10, SC11]).

-Contributions

Generalizing the existing work, we provide the following contributions in this chapter:

1. We propose a taxonomy of privacy notions which allows to assess the level of privacy provided by a voting protocol against various attacks. weighted votes, and show under which conditions the generalized notions coincide with the notions from the first taxonomy. We also provide a case study to illustrate our approach.

4. In the previous definitions of Receipt-Freeness and Coercion-Resistance, we only consider one voter under coercion. We provide a generalized definition for multiple coerced voters, and show that single-voter and multi-voter coercion coincide under certain assumptions using a unique decomposition result from Chapter 2.

-Outline of the Chapter

In the following section we review related work on formal verification of privacy in electronic voting. In Section 3.3, we present our taxonomy of privacy in voting, and discuss several case studies. To deal with weighted votes, we provide a generalized model in Section 3.4, discuss a case study, and establish a link to our taxonomy. Finally, in Section 3.5, we show that the case of multiple coerced voters can be reduced to a single coerced voter under some reasonable assumptions, and again establish a link to our taxonomy. In Section 3.6 we conclude this chapter.

Related Work

As the amount of work on electronic voting is huge, we concentrate here on related work concerning the specification and verification of privacy. We start by discussing application-independent privacy notions, followed by work on the specification and certification -including privacy -of voting protocols and systems.

Then we discuss work on voting protocols in the computational model, and finally in the symbolic model.

Canetti and Gennaro [START_REF] Canetti | Incoercible multiparty computation (extended abstract)[END_REF] proposed computational definitions of receiptfreeness that can be applied to many different applications. Similarly Unruh and Müller-Quade defined coercion-resistance [START_REF] Unruh | Universally composable incoercibility[END_REF] in the (computational) Universal Composability (UC) framework [START_REF] Canetti | Universally composable security: A new paradigm for cryptographic protocols[END_REF]. Application-independent anonymity notions were also proposed by Bohli and Pashalidis [START_REF] Bohli | Relations among privacy notions[END_REF]. Although these definitions are very general, the application to voting protocols often results in -for this context -unusual privacy notions (Pseudonymity etc.), compared to the classic properties such as vote-privacy that we discuss here.

Volkamer et al. [START_REF] Volkamer | Requirements and evaluation procedures for evoting[END_REF] worked towards developing requirements and evaluation procedures for the certification of eVoting systems in the common criteria framework. They give a formalization of the different requirements in a high-level way, similar to a technical standard, i.e. in "formalized" natural language. Yet this specification still lacks precise semantics. [START_REF] Kramer | A modular multi-modal specification of real-timed, end-to-end voter-verifiable voting systems[END_REF] propose a modular specification of voting systems which includes (among many other properties) privacy and receipt-freeness. It is expressed in a multi-modal logic featuring time. Such a logic framework is very expressive and hence suitable for the specification of systems, but difficult to handle for automatic verification tools. Concerning privacy, they define coercionresistance as the conjunction of privacy and receipt-freeness, differing from the original definition by Juels et al. [START_REF] Juels | Coercionresistant electronic elections[END_REF] which includes resistance against force abstention attacks, and allows a coercer to instruct the voter to deviate from the protocol. We employ the Applied π-Calculus as the basis for our definitions as it has powerful tool support e.g. using ProVerif.

eVoting

Kramer and Ryan

In the computational model, Juels et al. [START_REF] Juels | Coercionresistant electronic elections[END_REF] were the first to give a formal definition of coercion-resistance. They showed that their protocol (which became the basis for Civitas [START_REF] Michael | Civitas: Toward a secure voting system[END_REF]) is secure with respect to their definition. However -as their protocol is based on voting "credentials" -credentials also appear in the definition. Their model is thus unsuitable for protocols that do not use credentials (e.g. Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF] or the protocol by Lee et al. [LBD + 03]), which we can accommodate in our model. A first computational definition of privacy for voting was given by Cohen/Benaloh and Fischer [START_REF] Daniel | A robust and verifiable cryptographically secure election scheme (extended abstract)[END_REF], a first computational definition of receipt-freeness for voting by Benaloh and Tuinstra [BT94] (although their protocol suffered from an issue with the underlying encryption scheme [START_REF] Fousse | Benaloh's dense probabilistic encryption revisited[END_REF]). A first computational definition within the UCframework was given by Moran and Naor [START_REF] Moran | Receipt-free universally-verifiable voting with everlasting privacy[END_REF].

De Marneffe, Pereira, and Quisquater [dMPQ07a, dMPQ07b] proposed a computational security definition based on the simulation of an ideal functionality of a fair and secure voting system by the real-world system. Although not impossible [START_REF] Delaune | Simulation based security in the applied pi calculus[END_REF], such an approach is rarely employed in symbolic models.

Based on similar definitions [BCP + 11, CPP13], Smyth and Bernhard [START_REF] Smyth | Ballot secrecy and ballot independence coincide[END_REF] recently proposed computational definitions of ballot secrecy (similar to voteprivacy) and ballot independence, and showed that they coincide under some reasonable assumptions. In our symbolic model, we have a similar result (see Section 3.4.4).

A different computational game-based definition including coercion was proposed by Küsters, Truderung, and Vogt [START_REF] Küsters | A game-based definition of coercion-resistance and its applications[END_REF]. They applied it to Scantegrity II [START_REF] Küsters | Proving Coercion-Resistance of Scantegrity II[END_REF] as well as ThreeBallot and VAV [START_REF] Küsters | Verifiability, Privacy, and Coercion-Resistance: New Insights from a Case Study[END_REF]. In their definition they consider the overall advantage of an attacker trying to guess a voter's vote, which is always non-negligible as in certain situations the votes are revealed, e.g. in the case of an unanimous vote. We employ a different approach by comparing different situations that lead to the same outcome: In such a case, the attacker should not have a (non-negligible) advantage.

Along similar lines to Küsters et al., Bernhard et al. [BCPW12] proposed to measure vote-privacy using (computational) entropy. The idea is to compute how much privacy remains after an election, i.e. given a certain protocol, vote distribution and counting function. This can be computed after a concrete election (i.e. using the actually the submitted votes), or given a certain vote distribution to compute a metric giving an expectation of the level of privacy provided. They also establish a link between their information-theoretic approach and a previous computational definition [BCP + 11].

In the symbolic model, Jonker [START_REF] Jonker | Security Matters: Privacy in Voting and Fairness in Digital Exchange[END_REF] defines privacy by analyzing a voter's choice group, i.e. the set of candidates the voter could have voted for given the attackers knowledge about the protocol execution. For maximal privacy the choice group should be as large as possible. If it contains only one option, the attacker knows the exact vote and all privacy is lost. This is somewhat similar to the work by Küsters et al. in the computational model, but Jonker does not consider probabilities: even if a choice is very unlikely, it is still considered in the choice group. In our work, we employ a different approach: we explicitly identify situations that should be inside the same choice group given only the result, and then require these situations to be observationally equivalent.

Langer et al. [START_REF] Langer | Anonymity and verifiability in voting: understanding (un)linkability[END_REF] developed verifiability definitions and privacy notions based on (un-)linkability between a voter and his vote. They define (un-)linkability as a property on traces, whereas we consider bisimulations. Küsters and Truderung [KT09a] proposed a high-level model independent definition of coercion-resistance for voting protocols. Their definition has to be instantiated with a concrete formal model. The exact security level can be defined with respect to certain chosen goals, and excluding explicit special cases. In contrast to our model, their definition is based on traces and not bisimulations, and they only define coercion-resistance (in particular no simple vote-privacy). They also explicitly consider multi-voter coercion. In their abstract model, Single-Voter Coercion and Multi-Voter Coercion turned out to be different in general. Subsequently they proposed a modified definition of Coercion-Resistance that implies both Single-and Multi-Voter Coercion-Resistance, but they did not provide a precise analysis of the link between these notions. In our model we can show that Single-and Multi-Voter Coercion are equivalent under certain conditions on the protocol. Hence we do not need to change the initial definition, and the conditions allow us to precisely characterize the difference between both notions. Langer et al. also worked towards a high-level taxonomy of privacy [LSB + 09, LSBV10] based on different levels of secrecy with respect to different attacker capabilities. This has some similarities to our taxonomy approach, however their definitions are abstract and have to be instantiated with a concrete formal process and attacker model, whereas we directly give the operational definitions in the Applied π-Calculus.

Backes et al. [START_REF] Backes | Automated verification of remote electronic voting protocols in the applied pi-calculus[END_REF] translated the definition by Juels et al. [START_REF] Juels | Coercionresistant electronic elections[END_REF] to the Applied π-Calculus and provided an automated verification using ProVerif. Their approach has the same limitations as the original, computational definitions: they are difficult to apply to protocols using different techniques.

More general definitions were developed by Delaune, Kremer and Ryan [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] (the so-called DKR-model). They express different levels of privacy as observational equivalence in the Applied π-Calculus. An attacker should not be able to distinguish one case in which the voter complies with the coercer's instructions and another in which he only pretends to do so and votes as he wishes. Our definitions are based on their model, but we extend it in several ways: we include forced abstention, corrupted voters and generalize it to accommodate protocols with weighted votes.

Smyth and Cortier [START_REF] Smyth | Attacking and fixing helios: An analysis of ballot secrecy[END_REF] showed that being able to copy votes can compromise privacy if the number of participants is small or a noticeable fraction of voters can be corrupted. For example in the case of three voters, the third voter can try to copy the first voter's vote and submit it as his vote. If this succeeds, it will result in (at least) two votes for the candidate chosen by the first voter and his choice can thus be inferred from the result. They also formally analyzed ballot secrecy in Helios using an adaption of the model by Delaune, Kremer and Ryan. However we show that, in general, the DKR model is not sufficient to capture vote-independence. For example the protocol by Lee et al. [LBD + 03] was shown to be coercion-resistant in this model, despite its vulnerability to vote-copy attacks (see Section 3.3.5.4).

Recently Arapinis et al. [START_REF] Arapinis | Practical everlasting privacy[END_REF] proposed a formal model in the Applied π-Calculus to verify everlasting privacy.

A Formal Taxonomy of Privacy in Voting

In this section we present our formal taxonomy of privacy in electronic voting. We start by giving a formalization of voting protocols, then explain our definitions informally and give the detailed definitions in the Applied π-Calculus. We present the hierarchy of notions, and discuss several case studies: the protocols by Fujioka, Okamoto and Ohta (FOO) [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], by Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF], by Lee et al. [LBD + 03] and Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF].

-Formalizing Voting Protocols

In this section we describe our model of voting protocols in the Applied π-Calculus. It is inspired by the model used by Delaune, Kremer and Ryan [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF].

First of all, we define the notion of a voting protocol. Informally, a voting protocol specifies the processes executed by voters and authorities.

Definition 13 (Voting Protocol)

A voting protocol is a tuple (V, A 1 , . . . , A m , c) where V is the process that is executed by the voter, the A j 's are the processes executed by the election authorities, and c is a set of private channels.

Note that the protocol only defines one process V , which is instantiated for each voter. Yet here may be several authorities, for example a registrar, a bulletin board, a mixer, a tallier, . . . In our definitions we reason about privacy using concrete instances of a voting protocol. An instance is called a Voting Process.

Definition 14 (Voting Process) A voting process of a voting protocol (V, A 1 , . . . , A m , c) is a closed plain process

ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A l )
where l ≤ m, ñ includes (some of) the secret channel names, V σ id i σ v i are the processes executed by the voters where:

σ id i is a substitution assigning the identity to a process (this determines for example the secret keys), σ v i specifies the vote(s) and if the voter abstains, and A j s are the election authorities which are required to be honest.

As an extension to the model by Delaune et al. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF], the substitution determining the vote of the voter can also specify abstention or other (correct) behaviors. In this case V includes all the possible behaviors, and σ v i determines which of them is executed. In our model an abstaining voter does not participate at all in the election, we define this formally below.

Note that each voter runs the same process V , which is instantiated with a different σ id i (his identity) and σ v i (his vote(s)). Note also that we have l ≤ m as not all authorities might be trusted. If an authority is not trusted, it is not modeled and left to the context, i.e. the attacker. In such a case also a private channel to this untrusted authority can be modeled as a public channel, i.e. left out in ñ.

Moreover, note that our definition does not specify how the result is computed, nor what information it contains. For example, the result could be only the name of the winning candidate(s) -which might be computed in a complex way, e.g. in a Single Transferable Vote (STV) system as used in Ireland [Cit13] -, or also the number of votes for each candidate. We implicitly assume the latter case for most of our examples, but our notions (and in particular the generalizations in Sections 3.4 and 3.5) can also be applied to protocols implementing more complex counting algorithms.

eVoting

Example 12 As a running example, we consider the following simple voting protocol.

Informal description: To construct his ballot, each voter encrypts his vote with the administrator's public key and signs it using his secret key. The resulting ballot is posted on the bulletin board. After the voting deadline is over, the administrator checks if each ballot is signed by an eligible voter. He then decrypts the correct ballots and publishes the result.

Formal description in our model: The protocol uses probabilistic public-key encryption and signatures, which we model using the following equational theory:

dec(enc(m, pk(sk), r), sk) = m checksign(sign(m, sk), pk(sk)) = m
The first equation states that a message m encrypted using a public key can be decrypted correctly using the corresponding secret key. The second equation states that the verification with a public key succeeds if it was created using the corresponding secret key.

The protocol is then a tuple (V, A, ∅) where

A = A { pkv 1/pkv} | . . . |A { pkvn /pkv} A = in(ch, (sig, vote)).
if checksign(sig, pkv) = vote then sync 1.out(chR, dec(vote, ska)) else 0 V = νr.let evote = enc(v, pka, r) in out(ch, (sign(evote, skv), evote))

In this example we use another important syntactical extension of the Applied π-Calculus: sync 1 is a synchronization point with the following semantics: No process can continue until all other processes have reached the synchronization point. Such a behavior can directly be expressed in the standard Applied π-Calculus as follows (similarly to the idea of Delaune et al. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]): The synchronization command is replaced with an output of a message 1 on a restricted channel chSync1 (out(chSync1, 1)), followed by an input on a different restricted channel chSync2 (in(chSync2, m)). An additional synchronization process is added, receiving all messages on the private channel, and outputting messages on the second channel once all messages have been received:

P sync = in(chSync1, x 1 ) . . . in(chSync1, x n ).
(out(chSync2, 1)| . . . |out(chSync2, 1))

This ensures that the processes can only continue once all n processes have reached the synchronization point, as they have to wait for the answer by synchronization process. The context cannot interfere with the synchronization, as both channels chSync1 and chSync2 are restricted. ProSwapper [START_REF] Klus | Proswapper: Improved equivalence verifier for proverif[END_REF], a preprocessor for ProVerif, implements similar synchronization points, but also allows to swap the entire data of the synchronizing processes to help ProVerif proving observational equivalences.

Sometimes we need to model a synchronization where k out of n processes are sufficient to enable continuation. In that case we write sync k 1, and the implementation is similar:

P sync k = in(chSync1, x 1 ) . . . in(chSync1, x k ).
(out(chSync2, 1)| . . . |out(chSync2, 1))

In this example the substitution determining the identity of a voter assigns the secret key, e.g. σ id k = { sk k/skv}. The substitution specifying the vote as for example a vote for candidate a would be

σ v k = { a /v}.
In some of our definitions we also need to reason about instances where all parties, in particular all authorities, are honest.

Definition 15 (Honest Voting Process) An Honest Voting Process of a voting protocol (V, A 1 , . . . , A m , c) is a closed plain process

ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A m )
where ñ includes the secret channel names, V σ id i σ v i are the processes executed by the voters where:

σ id i is a substitution assigning the identity to a process (this determines for example the secret keys), σ v i specifies the vote(s) and if the voter abstains, and A j s are the election authorities.

Given a voting process

V P = ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A l )
we denote by V P H the corresponding honest voting process, i.e.

V P H = ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A m )
Note that for our running example a voting process and its corresponding honest voting process coincide, as the one and only authority is required to be honest anyway.

eVoting

We also often need to replace some voters inside a voting process. For this we use Voting Contexts.

Definition 16 ((Honest) Voting Context) Given a voting process

V P = ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A l )
and a subset of voters I we define the Voting Context V P I [_] as follows:

V P I [_] = ν ñ.( | i / ∈I V σ id i σ v i |_|A 1 | . . . |A l )
Similarly for an honest voting process

V P H = ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A m )
and a subset of voters I we define the Honest Voting Context V P H I [_] as follows:

V P H I [_] = ν ñ.( | i / ∈I V σ id i σ v i |_|A 1 | . . . |A m )
Consider the following example.

Example 13 An instance of our simple voting protocol (Example 12 on page 55) with two voters A and B looks as follows:

V P = νsk A .νsk B .νsk Ad .(V { sk A/skv, pk(sk Ad ) /pka} { a /v} | V { sk B/skv, pk(sk Ad ) /pka} { b /v} |A { sk Ad/ska, pk(sk A ) /pkv} |A { sk Ad/ska, pk(sk B ) /pkv})

The corresponding voting context V P {A} then looks as follows:

V P {A} = νsk A .νsk B .νsk Ad .(_|V { sk B/skv, pk(sk Ad ) /pka} { b /v} | A { sk Ad/ska, pk(sk A ) /pkv} |A { sk Ad/ska, pk(sk B ) /pkv})
Finally, we define abstention for a voting process. An abstaining voter does not send any message on any channel, in particular no ballot. In the real world, this would correspond to a voter that does not even go to polling station. This is different from just voting for a particular "null" candidate denoted ⊥, which still results in sending a ballot (a blank vote). However, we need to allow it to execute synchronization points, because synchronization is essential to ensure privacy, as otherwise an attacker in control of the network can simply keep track of a ballot and break privacy by linking the vote to a voter. Synchronization allows to break such links. Yet, if we allow abstention, we have to allow the non-abstaining voters to synchronize normally, otherwise they will block and no result can be announced. Hence we allow abstaining voters to execute synchronization operations, and obtain the following definition.

Definition 17 (Abstention) Let A \ sync denote the process A where all sync instructions have been removed. Then a substitution

σ v i makes a voter V σ id i abstain if (V σ id i σ v i ) \ sync ≈ l 0.
In our privacy definitions we also consider (partly) corrupted voters. To formally define corrupted parties or voter revealing secrets to the attacker, we use the following two definitions. The first one turns a process P into another process P ch that reveals all its inputs and secret data on the channel ch. This can be seen as trying to construct a receipt.

Definition 18 (Process P ch [DKR09]) Let P be a plain process and ch be a channel name. We define P ch as follows:

- (ch, n).P ch when n is a name of base type, -(νn.P ) ch = νn.P ch otherwise, -(in(u, x).P ) ch = in(u, x).out(ch, x).P ch when x is a variable of base type, -(in(u, x).P ) ch = in(u, x).P ch otherwise, -(out(u, M ).P ) ch = out(u, M ).P ch , -

0 ch = 0, -(P |Q) ch = P ch |Q ch , -(νn.P ) ch = νn.out
(!P ) ch = !P ch , -(if M = N then P else Q) ch = if M = N then P ch else Q ch .
In the remainder we assume that ch / ∈ f n(P ) ∪ bn(P ) before applying the transformation.

The second definition does not only reveal the secret data, but also takes orders from an outsider before sending a message or branching, i.e. the process is under complete remote control.

Definition 19 (Process P c 1 ,c 2 [DKR09]) Let P be a plain process and c 1 , c 2 be channel names. We define P c 1 ,c 2 as follows:

-0 c 1 ,c 2 = 0,

-(P |Q) c 1 ,c 2 = P c 1 ,c 2 |Q c 1 ,c 2 , -(νn.P ) c 1 ,c 2 = νn.out(c 1 , n).P c 1 ,c 2 when n is a name of base type, -(νn.P ) c 1 ,c 2 = νn.P c 1 ,c 2 otherwise,
-(in(u, x).P ) c 1 ,c 2 = in(u, x).out(c 1 , x).P c 1 ,c 2 when x is a variable of base type and x is a fresh variable,

3. eVoting -(in(u, x).P ) c 1 ,c 2 = in(u, x).P c 1 ,c 2 otherwise, -(out(u, M ).P ) c 1 ,c 2 = in(c 2 , x).out(u, x).P c 1 ,c 2 , -(!P ) c 1 ,c 2 = !P c 1 ,c 2 , -(if M = N then P else Q) c 1 ,c 2 = in(c 2 , x).if x = true then P c 1 ,c 2 else Q c 1 ,c 2
where x is a fresh variable and true is a constant.

To hide the output of a process, we use the following definition.

Definition 20 (Process A \out(ch,•) [DKR09]) Let A be an extended process. We define the process A \out(ch,•) as νch.(A|!in(ch, x)).

Given these definitions, we recall two lemmas by Delaune et al. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] used in our proofs.

Lemma 16 ([DKR09])

Let P be a closed plain process and ch a channel name such that ch / ∈ f n(P ) ∪ bn(P ). We have (P ch ) \out(ch,•) ≈ l P .

Lemma 17 ([DKR09])

Let C 1 = ν ũ1 .(_|B 1 ) and C 2 = ν ũ2 .(_|B 2 ) be two evaluation contexts such that ũ1 ∩ (f v(B 2 ) ∪ f n(B 2 )) = ∅ and ũ2 ∩ (f v(B 1 ) ∪ f n(B 1 )) = ∅. Then we have C 1 [C 2 [A]] ≡ C 2 [C 1 [A]
] for any extended process A.

-Defining Privacy: A Modular Approach

Privacy in eVoting is notoriously difficult to define. As discussed above, many different types of attacks and different attacker capabilities are considered. To systematize the existing approaches, we propose a modular definition, trying to factor out the different independent types of attacks and attacker capabilities.

In our setting, the attacker targets one voter (the targeted voter) and tries to extract information about the targeted voter's vote(s). If the attacker knows the votes of all other voters, he can infer the targeted voter's vote from the result. Thus we suppose that he is unsure about the vote of one other voter. This voter is called the counterbalancing voter, as he counterbalances different votes by the attacked voter to ensure that the result remains unchanged.

We express privacy as an observational equivalence. Intuitively, an attacker should not be able to distinguish between an execution in which the targeted voter behaves and votes as the attacker wishes, and another execution where he only pretends to do so and votes differently. To ensure that the attacker cannot tell the difference by just comparing the result, the counterbalancing voter compensates by simply swapping votes with the targeted voter.

Starting from the definitions of Coercion-Resistance, Receipt-Freeness, and Vote-Privacy in the literature we propose to factor out the three following dimensions: Communication between the attacker and the targeted voter, insider or outside attacker, and security against forced-abstention-attacks.

Communication between the attacker and the targeted voter:

We define three different levels, corresponding to different attacker capabilities:

(a) In the simplest case, the attacker only observes publicly available data and communication. We call this case Swap-Vote-Privacy2 , denoted SwV P .

(b) In the second case, the targeted voter tries to convince the attacker that he voted for a certain candidate by revealing his secret data. Yet the attacker should not be able to determine if he actually sent his real data, or a fake receipt. We call this case Swap-Receipt-Freeness, denoted SwRF .

(c) In the strongest case, the voter pretends to be completely under the control of the attacker, i.e. to reveal his secret data and to follow the intruder's instructions. Yet the attacker should be unable to determine if he actually complied with his instructions or if he only pretended to do so. We call this case Swap-Coercion-Resistance, denoted SwCR.

Intuitively Swap-Coercion-Resistance is stronger than Swap-Receipt-Freeness, which is stronger than Swap-Vote-Privacy (SwCR > SwRF > SwV P ).

Inside or outside attacker:

The attacker may control another legitimate voter (neither the targeted nor the counterbalancing voter). In that case he could be able to compromise privacy by trying to relate the corrupted voter's vote to the targeted voter's vote (e.g. by copying it as in the attack by Smyth and Cortier [START_REF] Smyth | Attacking and fixing helios: An analysis of ballot secrecy[END_REF]) or using the corrupted voter's secret data, such as his credentials or keys 3 . In our definitions, we distinguish two cases for the Attacker, corresponding again to different attacker capabilities:

(a) Attacker is an Outsider (denoted O): The attacker is an external observer.

(b) Attacker is an Insider (denoted I): The attacker has corrupted a legitimate voter.

Again, Insider is intuitively the stronger setting (I > O).

Security against forced-abstention-attacks:

A protocol can ensure that a voter can still vote as intended, although a coercer wants him to abstain. Note that in contrast to the literature [JCJ05, BHM08], we define this property independent of Coercion-Resistance, as we also want to apply it in the case of Vote-Privacy. This is because we see it as a different type of attack, that can be combined with the different attacker capabilities defined above. Our model expresses (in)security against forced-abstention attack by requiring the observational equivalence to hold:

3. eVoting (a) in any case, i.e. even if the voter is forced to abstain. We call this case security against Forced-Abstention-Attacks, denoted F A.

(b) if the targeted voter does not abstain from voting (i.e. always participates). We call this case Participation Only, denoted P O.

In this dimension security against Forced-Abstention-Attacks is a stronger property than Participation Only (F A > P O).

The strongest possible property is thus SwCR I,F A , the weakest SwV P O,P O . If we leave out the parameter, we take the weakest setting as a default, i.e. SwV P denotes SwV P O,P O .

-Definitions in the Applied π-Calculus

Our definition is parameterized using the following parameters (as explained above):

-P rivacy = {SwCR, SwRF, SwV P } ("Swap-Coercion-Resistance", "Swap-Receipt-Freeness" or "Swap-Vote-Privacy").

-Attacker = {I, O} ("Insider" or "Outsider").

-Abs = {F A, P O} ("Security against Forced-Abstention-Attacks"or "Participation Only").

Definition 21 (P rivacy Attacker,Abs ) A protocol fulfills P rivacy Attacker,Abs if for any voting process

V P = ν ñ.(V σ id 1 σ v 1 | . . . |V σ idn σ vn |A 1 | . . . |A l )
there exists a process V such that for all votes σ v A and σ v B where V σ v B does not make a voter abstain 4 , one of the following holds depending on the privacy setting:

-if Privacy is Swap-Vote-Privacy (SwV P ):

V P I [V σ id A σ v A |V σ id B σ v B |V C ] ≈ l V P I [V σ id A σ v B |V σ id B σ v A |V C ] -if Privacy is Swap-Receipt-Freeness (SwRF ): -V \out(chc,•) ≈ l V σ id A σ v B -V P I (V σ id A σ v A ) chc |V σ id B σ v B |V C ≈ l V P I [V |V σ id B σ v A |V C ] -if Privacy is Swap-Coercion-Resistance (SwCR): For any context C = νc 1 .νc 2 .(_|P ) with ñ ∩ f n(C) = ∅ and V P I [C [(V σ id A ) c 1 ,c 2 ] |V σ id B σ v B |V C ] ≈ l V P I (V σ id A σ v A ) chc |V σ id B σ v B |V C we have -C [V ] \out(chc,•) ≈ l V σ id A σ v B 3.3. A Formal Taxonomy of Privacy in Voting -V P I [C [(V σ id A ) c 1 ,c 2 ] |V σ id B σ v B |V C ] ≈ l V P I [C [V ] |V σ id B σ v A |V C ]
where -If Attacker is:

-Insider(I): As we require the conditions to hold for any voting process V P , they have to hold for any number of honest voters5 .

I := {A, B, C} and V C := (V σ id C ) c 1 ,c 2
The following examples illustrate how the parameter values instantiate the definition and give corresponding intuitions. We start with simple privacy.

Example 14 (SwV P O,P O ) A protocol fulfills SwV P O,P O if for any voting process V P such that for all votes σ v A and σ v B where σ v B and σ v A does not make a voter abstain we have:

V P {A,B} [V σ id A σ v A |V σ id B σ v B |0] ≈ l V P {A,B} [V σ id A σ v B |V σ id B σ v A |0] (3.1)
This coincides with the definition of Vote-Privacy given by Delaune et al. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: Two situations where two voters swap votes are bisimilar. We also note that Receipt-Freeness in the DKR-model corresponds to SwRF O,P O in our model, and Coercion-Resistance in the DKR-model corresponds to SwCR O,P O in our model.

In our next example, we apply the above definition on our running example, the simple voting protocol.

Example 15 (Application) Consider our running example of a simple voting protocol. We show that it ensures SwV P O,P O as defined above using ProVerif. We assume the secret keys to be private (hence ñ includes the secret keys of the voters and the administrator), and the administrator to be honest. In that case, ProVerif is able to prove the bisimilarity in equation (3.1) 6 , which gives that the simple 3. eVoting voting protocol ensures SwV P O,P O . The code used is available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

It is easy to see that this protocol does not guarantee Swap-Vote-Privacy for an inside attacker (SwV P I,P O ), as he can simply access the votes on the bulletin board and copy them7 . He can identify which vote was posted by which voter using the signatures.

The protocol is not receipt-free (SwRF Attacker,Abs ) either as the randomness used for encrypting the vote can be used as a receipt. Since the bulletin board reveals which voters participated through the signatures, it is not resistant against forced-abstention attacks.

In the following example we illustrate how security against Forced-Abstention-Attacks is captured by our definition.

Example 16 (SwV P O,F A ) A protocol fulfills SwV P O,F A if for any voting process V P such that for all votes σ v A and σ v B where σ v B does not make a voter abstain we have:

V P {A,B} [V σ id A σ v A |V σ id B σ v B |0] ≈ l V P {A,B} [V σ id A σ v B |V σ id B σ v A |0]
In this case, σ v A can make a voter abstain. As σ v B may not specify abstention, we have an observational equivalence between a situation where the targeted voter abstains, and a situation where he votes and the counterbalancing voter abstains. This captures the security against forced-abstention-attacks. Now we illustrate how we capture Receipt-Freeness, and how the inside attacker is modeled.

Example 17 (SwRF I,P O ) A protocol fulfills SwRF I,P O if for any voting process V P there exists a process V such that for all votes σ v A and σ v B where σ v B and σ v A do not make a voter abstain we have

V \out(chc,•) ≈ l V σ id A σ v B and V P {A,B,C} (V σ id A σ v A ) chc |V σ id B σ v B |(V σ id C ) c 1 ,c 2 ≈ l V P {A,B,C} V |V σ id B σ v A |(V σ id C ) c 1 ,c 2 .
The main idea of this Receipt-Freeness definition is the following: a protocol is receipt-free if an attacker cannot distinguish between a voter revealing honestly all his secret data as a receipt, and a voter only giving away fake information and voting differently. This counter-strategy is expressed here by the process V . The labeled bisimilarity then has to hold for a situation where voter id A votes v A and reveals all his secret data honestly, and a situation where he employs the counter-strategy V . The first equation ensures that he votes v B in the case of the counter-strategy.

To account for an inside attacker we include a corrupted voter id C . The adversary can hence try to execute vote-copy attacks, or employ insider knowledge.

Finally we discuss Coercion-Resistance.

Example 18 (SwCR O,F A ) A protocol fulfills SwCR O,F A if for any voting process V P there exists a process V such that for all votes σ v A and σ v B where V σ v B does not make a voter abstain, the following holds: For any context

C = νc 1 .νc 2 .(_|P ) with ñ ∩ f n(C) = ∅ and V P {A,B} [C [(V σ id A ) c 1 ,c 2 ] |V σ id B σ v B |0] ≈ l V P {A,B} (V σ id A σ v A ) chc |V σ id B σ v B |0 we have -C [V ] \out(chc,•) ≈ l V σ id A σ v B -V P {A,B} [C [(V σ id A ) c 1 ,c 2 ] |V σ id B σ v B |0] ≈ l V P {A,B} [C [V ] |V σ id B σ v A |0]
The intuition behind this definition is the following: the context C also belongs to the attacker and tries to force the targeted voter to vote for a certain candidate or to make him abstain (depending on σ id A ), whereas V tries to vote differently and to escape coercion. The condition on the context C ensures that the voter is actually forced to vote for the candidate σ v A to ensure that both sides give the same result, and hence are not trivially distinguishable.

-Hierarchy

As already announced in the informal description in Section 3.3.2, we have a hierarchy of notions in each of the three dimensions.

Lemma 18 For P rivacy ∈ {SwV P , SwRF , SwCR} , Attacker ∈ {I, O} and Abs ∈ {F A, P O} we have:

1. Any attack that works for an outsider can also be used for an insider: If a protocol respects P rivacy I,Abs , then it also respects P rivacy O,Abs .

2. If a protocol is secure against Forced-Abstention attacks, it is also secure in the "Participation Only" case: If a protocol respects P rivacy Attacker,F A , it also respects P rivacy Attacker,P O .

eVoting

Coercion-Resistance is stronger than Receipt-Freeness, which is stronger than Vote-Privacy:

-If a protocol respects SwCR Attacker,Abs , it also respects SwRF Attacker,Abs .

-If a protocol respects SwRF Attacker,Abs , it also respects SwV P Attacker,Abs .

Proof We consider the different propositions independently.

1. We detail the case SwV P I,Abs , the other cases are analogous. We use a proof by contradiction: suppose that a protocol does not ensure SwV P O,Abs , but SwV P I,Abs holds. Then we have an instance where

V P {A,B} [V σ id A σ v A |V σ id B σ v B ] ≈ l V P {A,B} [V σ id A σ v B |V σ id B σ v A ]
which we can rewrite as

V P {A,B,i} [V σ id A σ v A |V σ id B σ v B |V σ id i σ v i ] ≈ l V P {A,B,i} [V σ id A σ v B |V σ id B σ v A |V σ id i σ v i ]
for some honest voter V σ id i σ v i . This yields the contradiction for an attacker enforcing that the corrupted voter behaves like an honest voter, i.e. a context

C = νc 1 .νc 2 .(P |_) such that C[V σ c 1 ,c 2 id C ] ≈ l V σ id i σ v i , as
we have an instance violating the definition of SwV P I,Abs . Note that technically this also works if the instance violating privacy contains only two voters, in this case the intruder forces the corrupted voter to do nothing.

2. This holds by definition: in the case F A we consider all σ v A , whereas we exclude some in the case P O. Thus, if the bisimilarity holds for F A, it also holds for P O.

3. Coercion-Resistance is stronger than Receipt-Freeness, which is stronger than Vote-Privacy:

-The proof is similar to the proof showing that Coercion-Resistance implies Receipt-Freeness in the DKR model [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: Assume that we have a protocol ensuring SwCR Attacker,Abs . Let C be an evaluation context such that C = νc 1 .νc 2 .(_|P ) for some plain process P which fulfills

V P I C V σ c 1 ,c 2 id A |V σ id B σ v B |V C ≈ l V P I V σ id A σ chc v A |V σ id B σ v B |V C (3.2)
Note that such a C can be constructed directly from the vote process V . By the definition of SwCR Attacker,Abs we know that there is a closed plain process V such that

C V \out(chc,•) ≈ l V σ id A σ v B (3.3)
and

V P I C V σ c 1 ,c 2 id A |V σ id B σ v B |V C ≈ l V P I C V |V σ id B σ v A |V C (3.4)
To prove that the protocol ensures SwRF Attacker,Abs we have to find another process V such that

V \out(chc,•) ≈ l V σ id A σ v B (3.5)
and

V P I V σ id A σ chc v A |V σ id B σ v B |V C ≈ l V P I V |V σ id B σ v A |V C (3.6) Let V = C[V ]
. This directly fulfills the first requirement (3.5) by (3.3). By the condition (3.2) on C we have:

V P I C V σ c 1 ,c 2 id A |V σ id B σ v B |V C ≈ l V P I V σ id A σ chc v A |V σ id B σ v B |V C
The second hypothesis (3.4) gives

V P I C V σ c 1 ,c 2 id A |V σ id B σ v B |V C ≈ l V P I C V |V σ id B σ v A |V C
As labeled bisimilarity is transitive, we can conclude

V P I V σ id A σ chc v A |V σ id B σ v B |V C ≈ l V P I C V |V σ id B σ v A |V C which gives us the desired result for V = C[V ].
-The proof is similar to the proof of Receipt-Freeness implies Vote-Privacy in the DKR-model [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: Assume that we have a protocol ensuring SwRF Attacker,Abs . By hypothesis there is a closed plain process V so that

V \out(chc,•) ≈ l V σ id A σ v B (3.7)
and

V P I V σ id A σ chc v A |V σ id B σ v B |V C ≈ l V P I V |V σ id B σ v A |V C .
We apply the context νchc.(_|!in(chc, x)) (cf. Definition 20 on page 60)

3. eVoting on both sides, which gives •) .

V P I V σ id A σ chc v A |V σ id B σ v B |V C \out(chc,•) ≈ l V P I V |V σ id B σ v A |V C \out(chc,
By using Lemma 17 on page 60 on both sides of the equivalence we obtain

V P I V |V σ id B σ v A |V C \out(chc,•) ≡ V P I V \out(chc,•) |V σ id B σ v A |V C and V P I V σ id A σ chc v A |V σ id B σ v B |V C \out(chc,•) ≡ V P I V σ id A σ chc v A \out(chc,•) |V σ id B σ v B |V C .
We can now apply Lemma 16 on page 60 and use the fact that labeled bisimilarity is closed under structural equivalence to obtain

V P I [V σ id A σ v A |V σ id B σ v B |V C ] ≈ l V P I V \out(chc,•) |V σ id B σ v A |V C
where we can apply (3.7) to conclude

V P I [V σ id A σ v A |V σ id B σ v B |V C ] ≈ l V P I [V σ id A σ v B |V σ id B σ v A |V C ]
i.e. that the protocol ensures SwV P Attacker,Abs .

Taking these properties together, we arrive at the hierarchy shown in Figure 3.1 on the facing page.

-Case Studies

We applied our family of notions on several case studies, chosen to show that each of our dimensions corresponds to a different property of existing protocols.

The results are summed up in and Table 3.1 on page 114, the position of the case studies within our hierarchy is shown in Figure 3.1 on the facing page. § 3.3.5.1. Protocol by Fujioka, Okamoto and Ohta (FOO). The protocol by Fujioka, Okamoto and Ohta [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] is based on blind signatures and commitments. It was shown to ensure Vote-Privacy [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] in the DKR-model, but is not receipt-free as the randomness of the commitment can be used as a receipt. We show that it ensures SwV P I,P O (i.e. Swap-Vote-Privacy against an insider, but just in the Participation Only case). Protocol Description. The protocol is split into three phases. In the first phase the administrator signs the voter's commitment to his vote:

SwCR O,F A u u SwCR I,F A [BMQR07] o o s s SwCR O,P O [LBD + 03] SwCR I,P O * o o SwRF O,F A t t SwRF I,F A s s o o SwRF O,P O SwRF I,P O [Oka96] o o SwV P O,F A t t SwV P I,F A † o o s s SwV P O,P O • SwV P I,P O [FOO92] o o Figure 3.
-Voter V i chooses his vote v i and computes a commitment

x i = ξ(v i , r i ) for a random key r i .
-He blinds the commitment using a blinding function χ, a random value b i and obtains e i = χ(x i , b i ).

-He signs e i and sends the signature s i = σ V i (e i ) together with e i and his identity to the administrator.

-The administrator checks if V i has the right to vote and has not yet voted, and if the signature s i is correct. If all tests succeed, he signs d i = σ A (e i ) and sends it back to V i .

-V i checks the signature, and unblinds the signature to obtain

y i = δ(d i , b i ) = σ A (x i ).
In the second phase, the voter submits his ballot:

-Voter V i sends (x i , y i ) to the collector C through an anonymous channel.

-The collector checks the administrator's signature and enters (x i , y i ) as the l-th entry into a list.

When all ballots are cast or when the deadline is over, the counting phase begins:

-The collector publishes the list of correct ballots.

-V i verifies that his commitment appears on the list and sends (l, r i ) to C using an anonymous channel.

eVoting

-The collector C opens the l-th ballot using r i and publishes the vote. The main process (Listing 3.1) sets up the keys and executes the participation processes (three voters, three administrators and three collectors -one for each voter -) in parallel. Note that (* ... *) are comments, inspired by ProVerif's syntax, and that processA, processK, processC and processV are variables for the processes of the administrator, keying process, collector and voter as defined below. Note also that although much of this syntax is inspired by ProVerif, we still rely on the original Applied π-Calculus.

Model in the

The voter's process (Listing 3.2 on the facing page) starts by deciding if he abstains: If yes, he does nothing except for the synchronization points. This is necessary as otherwise he blocks the other voters. If he does not abstain, he votes following the protocol described informally before.

A voter controlled by the attacker is modeled by the process given in Listing 3.3 on page 72. This process is obtained when computing processV c 1 ,c 2 as defined in Definition 19 on page 59. The collector (Listing 3.5 on the following page) verifies the signature on incoming commitments using the administrator's public key. If the signature is correct, he creates a new bounded name l (the number in the list) and sends it together with the signed commitment back to the voter. The voter then reveals his randomness, which the collector uses to open the commitment.

Analysis. Delaune et al. showed that the protocol ensures Vote-Privacy in their model [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] (which corresponds to SwV P O,P O in our model, as they do not consider inside attackers). We show that it also ensures Vote-Independence, i.e. the stronger notion of Vote-Privacy for inside attackers: SwV P I,P O . i n ( c2 , y4 ) . out ( ch3 , y4 ) .

Theorem 19 FOO respects

SwV P I,P O . Proof We show that processV { skva /skv, pk(ska) /pka} { a /v} |processV { skvb /skv, pk(ska) /pka} { b /v} | processVc1c2 { skvc /skv, pk(ska) /pka} ≈ l processV { skva /skv, pk(ska) /pka} { b /v} |processV { skvb /skv, pk(ska) /pka} { a /v} | processVc1c2 { skvc /skv, pk(ska) /pka}
i n ( ch4 , m3 ) . out ( c1 , m3 ) . l e t ( l , commitedvoter ' , s i g n e d v o t e r ' ) = m3 i n i n ( c2 , y5 ) . i f y5 = t r u e then i n ( c2 , y6 ) . i f y6 = t r u e then sync 2 .

i n ( c2 , y7 ) . out ( ch5 , y7 ) As labeled bisimilarity is closed under the application of contexts, it is sufficient to show that

processV { skva /skv, pk(ska) /pka} { a /v} |processV { skvb /skv, pk(ska) /pka} { b /v} ≈ l processV { skva /skv, pk(ska) /pka} { b /v} |processV { skvb /skv, pk(ska) /pka} { a /v}
This is different from the model and proof used in [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF], and more similar to the proofs by Kremer and Ryan [START_REF] Kremer | Analysis of an electronic voting protocol in the applied pi calculus[END_REF] or Smyth [Smy11]: all keys are modeled as free names, and hence not secret. Note also that we consider only two honest voters and one voter under control of the attacker. However, as labeled bisimilarity is closed under the application of contexts, this immediately generalizes to an arbitrary number of honest or corrupted voters as we do not need any secret channel or key.

The intuition is the following: thanks to the blinding nobody can link the ballot, which is sent to the administrator, to the commitment, published later on over the anonymous channel.

We call the left hand side process P and the right hand side process Q. Note that we do not consider abstention of the honest voters here, hence the test v=abstain is always false. We write V A for processV { skva /skv, pk(ska) /pka} and V B for processV { skvb /skv, pk(ska) /pka}. We now discuss the possible transitions. The honest voters construct the blinded and committed votes and send them to the administrator. We have the following transitions:

P out(ch1,x 1 ) -------→ νb A .νr A .(P 1 | { (pk(skva),sign(blind(commit(a,r A ),b A ),skva),blind(commit(a,r A ),b A )) /x 1 }) out(ch1,x 2 ) -------→ νb B .νb A .νr A .νr B .(P 2 | { (pk(skva),sign(blind(commit(a,r A ),b A ),skva),blind(commit(a,r A ),b A )) /x 1 } | { (pk(skvb),sign(blind(commit(b,r B ),b B ),skvb),blind(commit(b,r B ),b B )) /x 2 }) Similarly Q out(ch1,x 1 ) -------→ νb A .νr A .(Q 1 | { (pk(skva),sign(blind(commit(b,r A ),b A ),skva),blind(commit(b,r A ),b A )) /x 1 }) out(ch1,x 2 ) -------→ νb B .νb A .νr A .νr B .(Q 2 | { (pk(skva),sign(blind(commit(b,r A ),b A ),skva),blind(commit(b,r A ),b A )) /x 1 } | { (pk(skvb),sign(blind(commit(a,r B ),b B ),skvb),blind(commit(a,r B ),b B )) /x 2 })
Until this point, it is easy to see that the frames are statically equivalent: both voters sent a signed commitment, but because of the blinding they are indistinguishable. Note that the messages can appear in the inverse order, however the frames remain statically equivalent. The next step depends on the context. If

eVoting

the attacker returns correctly signed votes to the two voters, the processes can synchronize and go on. Otherwise at least one of them blocks and they are unable to synchronize.

If they are able to synchronize, they will output their unblinded vote to the collector. From this point on, the voters swap their roles, i.e. V B { a /v} simulates the behavior of V A { a /v}. We obtain the following frames:

φ l = νb B .νb A .νr A .νr B .( { (pk(skva),sign(blind(commit(a,r A ),b A ),skva),blind(commit(a,r A ),b A )) /x 1 } | { (pk(skvb),sign(blind(commit(b,r B ),b B ),skvb),blind(commit(b,r B ),b B )) /x 2 } | { (commit(a,r A ),sign(commit(a,r A ),ska)) /x 3 } | { (commit(b,r B ),sign(commit(b,r B ),ska)) /x 4 }) φ r = νb B .νb A .νr A .νr B .( { (pk(skva),sign(blind(commit(b,r A ),b A ),skva),blind(commit(b,r A ),b A )) /x 1 } | { (pk(skvb),sign(blind(commit(a,r B ),b B ),skvb),blind(commit(a,r B ),b B )) /x 2 } | { (commit(b,r A ),sign(commit(b,r A ),ska)) /x 3 } | { (commit(a,r B ),sign(commit(a,r B ),ska)) /x 4 })
These frames are again statically equivalent, as the blinding breaks any link of the commitments to the first messages. Then it depends again on the input of the attacker. If either of the voters gets a wrong input, they cannot synchronize.

If both voters receive a correct input, they reveal their random values with the corresponding l. This yields the following frames:

φ l = νb B .νb A .νr A .νr B .νl A .νl B .( { (pk(skva),sign(blind(commit(a,r A ),b A ),skva),blind(commit(a,r A ),b A )) /x 1 } | { (pk(skvb),sign(blind(commit(b,r B ),b B ),skvb),blind(commit(b,r B ),b B )) /x 2 } | { (commit(a,r A ),sign(commit(a,r A ),ska)) /x 3 } | { (commit(b,r B ),sign(commit(b,r B ),ska)) /x 4 } | { (l A ,r A ) /x 5 } | { (l B ,r B ) /x 6 }) φ r = νb B .νb A .νr A .νr B .νl A .νl B .( { (pk(skva),sign(blind(commit(b,r A ),b A ),skva),blind(commit(b,r A ),b A )) /x 1 } | { (pk(skvb),sign(blind(commit(a,r B ),b B ),skvb),blind(commit(a,r B ),b B )) /x 2 } | { (commit(b,r A ),sign(commit(b,r A ),ska)) /x 3 } | { (commit(a,r B ),sign(commit(a,r B ),ska)) /x 4 } | { (l A ,r A ) /x 5 } | { (l B ,r B ) /x 6 })
These frames are statically equivalent, giving us the desired result.

This result can also be obtained automatically using ProSwapper8 and ProVerif.

The code is available on our website [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

Moreover note that using the recently developed tool AKISS, a similar proof of privacy [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] for this protocol was made. The proof is fully automatic, however AKISS proves trace equivalence instead of labeled bismilarity, and uses a simpler process calculus instead of the Applied π-Calculus.

Note that FOO is not secure against Forced-Abstention-Attacks, as the voters send their identity (here modeled by their public key) to the administrator over a public channel. If we consider a modified version with a trusted administrator and a private channel between the voter and the administrator, FOO also ensures security against forced abstention attacks: SwV P I,F A .

Theorem 20 FOO with trusted administrator and a private channel between the voter and the administrator respects

SwV P I,F A .
Proof As we proved above, FOO ensures Privacy for the "PO" case. Hence we only need to consider the case of abstention, i.e. show that pk(ska) /pka} { abstain /v} |processVc1c2 { skvc /skv, pk(ska) /pka} | processA { pk(skva) /pkv} |processA { pk(skvb) /pkv} |processA { pk(skvc) /pkv}) holds. The differences to the above proof are marked in bold: the channels ch1 and ch2 are now restricted, and we include the administrators as they are now trusted. Note that this proof is technically only valid for two honest voters and one voter under control of the attacker. Nevertheless a similar proof can be made for other numbers of voters.

νch1.νch2.(processV { skva /skv, pk(ska) /pka} { abstain /v} | processV { skvb /skv, pk(ska) /pka} { b /v} |processVc1c2 { skvc /skv, pk(ska) /pka} | processA { pk(skva) /pkv} |processA { pk(skvb) /pkv} |processA { pk(skvc) /pkv}) ≈ l νch1.νch2.(processV { skva /skv, pk(ska) /pka} { b /v} | processV { skvb /skv,
The intuition is that since the administrator is honest and the registration is done over a private channel, the intruder only sees the anonymous commitments and can thus not determine which voters participated.

We call the left hand side process P and the right hand side process Q, and write V A for processV { skva /skv, pk(ska) /pka}, V B for processV { skvb /skv, pk(ska) /pka} and V c 1 ,c 2 C for processVc1c2 { skvc /skv, pk(ska) /pka}. The beginning is similar: the non-abstaining honest voter construct the blinded and committed vote and sends them to the administrator through an internal reduction, due to the private 3. eVoting channel. The administrator will accept the ballot, sign it and send it back to the voter, again triggering an internal reduction. The voter checks the signature and waits for the synchronization. Until now, only internal reductions have taken place and the frames are empty. Then it depends on the context:

-If the corrupted voter is told to abstain, the bidder can synchronize, and publishes his ballot. We obtain the following frames:

φ l = νr B .({ (commit(b,r B ),sign(commit(b,r B ),ska)) /x 1 })
and

φ r = νr A .({ (commit(b,r A ),sign(commit(b,r A ),ska)) /x 1 })
Then it depends again on the input of the attacker. If the honest voter gets a wrong input, he blocks. If he receives receives a correct input he synchronizes and reveals his random values with the corresponding l. This yields the following frames:

φ l = νr B .νl B .({ (commit(b,r B ),sign(commit(b,r B ),ska)) /x 1 } | { (l B ,r B ) /x 2 })
and

φ r = νr A .νl A .({ (commit(b,r A ),sign(commit(b,r A ),ska)) /x 1 } | { (l A ,r A ) /x 11 })
These frames are statically equivalent as the random values are indistinguishable, which gives us the desired result.

-If the context tells the corrupted voter to vote, he forwards the given message to the administrator (over a private channel, hence an internal reduction). If the message was correct, the administrator signs and returns the ballot (again over a private channel). This message is forwarded to the context. In any other case, the process will simply block. We have the following transitions:

P in(c2,f alse) -------→ in(c2,y2) -----→→ * out(c1,x 1 ) ------→ P 1 | { m2 /x 1 } Similarly Q in(c2,f alse) -------→ in(c2,y2) -----→→ * out(c1,x 1 ) ------→ Q 1 | { m2 /x 1 }
These frames are identical and hence statically equivalent. If the context tells the voter to go on, the processes can synchronize, and the honest voter publishes his unblinded ballot. The corrupted bidder publishes the message he is given. This yields the following frames:

φ l = νr B .({ m2 /x 1 } | { (commit(b,r B ),sign(commit(b,r B ),ska)) /x 2 } | { y4 /x 3 } | { m3 /x 4 }) and φ r = νr A .({ m2 /x 1 } | { (commit(b,r A ),sign(commit(b,r A ),ska)) /x 2 } | { y4 /x 3 } | { m3 /x 4 })
Then it depends again on the input of the attacker. If the honest voters gets a wrong input or the attacker decides to block V c 1 ,c 2

C

, the voters cannot synchronize. If the honest voters receives a correct input and if he can synchronize with V c 1 ,c 2

C

, he reveals his random values with the corresponding l. This yields the following frames:

φ l = νr B .νl B .({ m2 /x 1 } | { (commit(b,r B ),sign(commit(b,r B ),ska)) /x 2 } | { y4 /x 3 } | { m3 /x 4 } | { (l B ,r B ) /x 5 } | { y7 /x 6 })
and

φ r = νr A .νl A .({ m2 /x 1 } | { (commit(b,r A ),sign(commit(b,r A ),ska)) /x 2 } | { y4 /x 3 } | { m3 /x 4 } | { (l A ,r A ) /x 5 } | { y7 /x 6 })
These frames are statically equivalent as they only differ in the restricted random values, which gives us the desired result. § 3.3.5.2. Protocol by Okamoto. The protocol by Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF] is similar to the protocol by Fujioka et al. discussed above, but it uses trap-door commitments to achieve Receipt-Freeness. It is however not Coercion-Resistant as the coercer can force the voter to use a specially prepared commitment [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF].

Protocol Description. The main differences to FOO are the use of trap-door commitments and the existence of timeliness member to open the commitments. The first phase -during which the voter obtains a signature on his commitmentfollows exactly the same protocol as FOO, except that this time ξ is a trapdoorcommitment. In the second phase the vote is submitted:

-Voter V i sends the signed trap-door commitment to the collector C through an anonymous channel.

-The collector checks the administrators signature and enters (x i , y i ) into a list.

-The voter sends (v i , r i , x i ) to the timeliness member through an untappable anonymous channel When all ballots are cast and/or when the deadline is over, the counting phase begins:

-The collector publishes the list of correct ballots.

-V i verifies that his commitment appears on the list.

-The timeliness member publishes a randomly shuffled list of votes v i and a

eVoting

zero-knowledge proof that he knows a permutation π for which

x π(i) = ξ(v i , r i ).
Model in the Applied π-Calculus. We use following equational theory:

checksign(sign(m, sk), pk(sk)) = m unblind(blind(m, r), r) = m unblind(sign(blind(m, r), sk), r) = sign(m, sk) open(tdcommit(m, r, td), r) = m tdcommit(m 2 , f (m 1 , r, td, m 2 ), td) = tdcommit(m 1 , r, td)
The forth equation models the creation of a trap-door commitment to m using a random value r and a trap-door td, whereas the last equation permits the construction of another random value to open a commitment differently. This requires knowledge of the trap-door td and the initial random value r.

We use the following processes for our proof: The main process (Listing 3.6) shows how the participation processes (three administrators, three collectors, three talliers -one for each voter -and three voters) are combined in parallel using a private channel.

( * p r i v
The voter process (Listing 3.7 on the facing page) follows the nearly the same protocol as in the case of FOO, but he has to reveal the data necessary to open the commitment over a private channel to the timeliness member T . Note that in the case of abstention the voter also executes the second synchronization point, although normally it is executed by the collector. This is necessary to avoid a situation where the entire voting process blocks because of an abstaining voter. out ( chT , ( a , r , commitedvote ) ) . out ( chc , ( a , r , commitedvote ) )

Listing 3.9 -The process trying to create a receipt A voter under control of the attacker is described by Listing 3.8 on the previous page. This process can be obtained by calculating processV c 1 ,c 2 as defined in Definition 19 on page 59.

A voter trying to create a receipt by revealing all his secret data is modeled by the process in Listing 3.9. This process can be obtained by calculating processV chc as defined in Definition 18 on page 59.

The administrator (Listing 3.11 on the next page) checks the signature on the blinded commitment and signs it.

The collector (Listing 3.12 on the facing page) verifies the signature on incoming commitments using the administrator's public key. If the signature is correct, he publishes the commitment on a public channel.

The timeliness member (Listing 3.13 on page 82) receives the vote, the corresponding commitment and the randomness over a private channel. He verifies the correctness of the data and then publishes the vote. Note that the synchronization point sync n 2 can also be enabled by an abstaining bidder (cf. Process 3.7 on the preceding page) to allow the publication of the submitted votes. As explained above, although an instance with n voters contains 2n instances of sync n 2, any n of them are sufficient to enable the continuation.

Analysis. We have the following result: Proof We need to show that there exists a closed plain process V such that

V \out(chc,•) ≈ l processV { skva /skv, pk(ska) /pka} { b /v} (3.8) and νchT.((processV { skva /skv, pk(ska) /pka} { a /v}) chc | processV { skvb /skv, pk(ska) /pka} { b /v} | processVc1c2 { skvc /skv, pk(ska) /pka} | processT|processT|processT) ≈ l νchT.(V |processV { skvb /skv, pk(ska) /pka} { a /v} | processVc1c2 { skvc /skv, pk(ska) /pka} | processT|processT|processT) (3.9)
As in the case of the protocol by Fujioka et al., we only consider three voters, but the proof can be generalized for more honest voters. In particular we show in Section 3.4.4 that the protocol is modular, which directly implies that privacy also holds for any number of honest voters: we can compose the above instance with another instance to obtain an instance with an arbitrary number of voters, and the bisimilarity still holds. For more details, see Section 3.4.4.

Again, we write V A for processV { skva /skv, pk(ska) /pka}, V B for processV

{ skvb /skv, pk(ska) /pka} and V c 1 ,c 2 C for processVc1c2 { skvc /skv, pk(ska) /pka}.
Consider the process V = processV { skva /skv, pk(ska) /pka} that fakes a receipt. We can see that the first equivalence (3.8) holds by removing all out(chc, _) from processV as given in Listing 3.10 on the previous page: Independent of a, the resulting process is apparently equal to the original voting process

processV { skva /skv} { b /v}.
The second equivalence (3.9) is more difficult to prove. The beginning is similar to the proof of privacy for FOO. We denote the left hand side process P and the right hand side process Q. The honest voters construct the blinded and committed votes and send them to the administrator. During this process, V A outputs his secret values and inputs, where V fakes these values. We have the following transitions:

P out(chc,x 1 ) -------→ νx 2 .out(chc,x 2 ) ---------→ νx 3 .out(chc,x 3 ) ---------→ νb A .νr A .νtd A .(P 1 | { b A/x 1 } | { r A/x 2 } | { td A/x 3 }) νx 4 .out(ch1,x 4 ) ----------→ νx 5 .out(chc,x 5 ) ---------→ νb A .νr A .νtd A .(P 2 | { b A/x 1 } | { r A/x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(a,r A ,td A ),b A ),skva),blind(tdcommit(a,r A ,td A ),b A )) /x 4 } | { x 4/x 5 }) νx 6 .out(ch1,x 6 ) ----------→ νb A .νr A .νtd A .νb B .νr B .νtd B .(P 3 | { b A/x 1 } | { r A/x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(a,r A ,td A ),b A ),skva),blind(tdcommit(a,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(b,r B ,td B ),b B ),skvb),blind(tdcommit(b,r B ,td B ),b B )) /x 6 }) Similarly Q νx 1 .out(chc,x 1 ) ---------→ νx 2 .out(chc,x 2 ) ---------→ νx 3 .out(chc,x 3 ) ---------→ νb A .νr A .νtd A .(Q 1 | { b A/x 1 } | { f (a,r A ,td A ,c) /x 2 } | { td A/x 3 }) νx 4 .out(ch1,x 4 ) ----------→ νx 5 .out(chc,x 5 ) ---------→ νb A .νr A .νtd A .(Q 2 | { b A/x 1 } | { f (b,r A ,td A ,a) /x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(b,r A ,td A ),b A ),skva),blind(tdcommit(b,r A ,td A ),b A )) /x 4 } | { x 4/x 5 }) νx 6 .out(ch1,x 6 ) ----------→ νb A .νr A .νtd A .νb B .νr B .νtd B .(Q 3 | { b A/x 1 } | { f (a,r A ,td A ,c) /x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(b,r A ,td A ),b A ),skva),blind(tdcommit(b,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(a,r B ,td B ),b B ),skvb),blind(tdcommit(a,r B ,td B ),b B )) /x 6 })
We can argue that at this point the obtained frames are statically equivalent. In particular the attacker obtains in both cases open(unblind(checksign(proj 2 (x 4 ), pk(skva)), x 1 ), x 2 ) = a when he tries to open the commitment due to the trap-door and the faked randomness.

The next steps depend on the context:

-If the attacker tells the corrupted voter to vote, he will forward the given 3. eVoting ballot to the administrator. We have the following transitions:

P 3 in(c2,f alse) -------→ in(c2,y2) -----→ νx 7 .out(ch1,x 7 ) ----------→ ν x.(P 4 | { b A/x 1 } | { r A/x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(a,r A ,td A ),b A ),skva),blind(tdcommit(a,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(b,r B ,td B ),b B ),skvb),blind(tdcommit(b,r B ,td B ),b B )) /x 6 } | { y2 /x 7 }) where x = {b A , r A , td A , b B , r B , td B }. Similarly Q 3 in(c2,f alse) -------→ in(c2,y2) -----→ νx 7 .out(ch1,x 7 ) ----------→ ν x.(Q 4 | { b A/x 1 } | { f (a,r A ,td A ,c) /x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(b,r A ,td A ),b A ),skva),blind(tdcommit(b,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(a,r B ,td B ),b B ),skvb),blind(tdcommit(a,r B ,td B ),b B )) /x 6 } | { y2 /x 7 })
If the context then returns correctly signed votes to the two honest voters and tells

V c 1 ,c 2 C
to go on (i.e. sends a message containing true), the processes can synchronize and go on. Otherwise at least one of them blocks and they are unable to synchronize. If they are able to synchronize, they output their votes to the collector (V c 1 ,c 2 C sends any message the attacker gives him) and send the secret values to the timeliness member over a private channel. We obtain the following frames:

φ l = ν x.({ b A/x 1 } | { r A/x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(a,r A ,td A ),b A ),skva),blind(tdcommit(a,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(b,r B ,td B ),b B ),skvb),blind(tdcommit(b,r B ,td B ),b B )) /x 6 } | { y2 /x 7 } | { (tdcommit(a,r A ,td A ),sign(tdcommit(a,r A ,td A ),ska)) /x 8 } | { (tdcommit(b,r B ,td B ),sign(tdcommit(b,r B ,td B ),ska)) /x 9 } | { (a,r A ,tdcommit(a,r A ,td A )) /x 11 }) and φ r = ν x.({ b A/x 1 } | { f (b,r A ,td A ,a) /x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(b,r A ,td A ),b A ),skva),blind(tdcommit(b,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(a,r B ,td B ),b B ),skvb),blind(tdcommit(a,r B ,td B ),b B )) /x 6 } | { y2 /x 7 } | { (tdcommit(b,r A ,td A ),sign(tdcommit(b,r A ,td A ),ska)) /x 8 } | { (tdcommit(a,r B ,td B ),sign(tdcommit(a,r B ,td B ),ska)) /x 9 } | { (a,f (b,r A ,td A ,a),tdcommit(b,r A ,td A )) /x 10 })
These frames are statically equivalent. If the attacker sent a correct input to the third timeliness process, T will put out the corresponding vote. Note that if the attacker copies V A 's vote using the possibly faked credentials, T will always output a. More generally, the attacker cannot use T to obtain frames that are not statically equivalent as this would imply that this difference could also be made on the frames before by opening a commitment -something the attacker could do by himself. Intuitively having access to the "Timeliness" oracle does not help the attacker, as the oracle performs only operations the attacker could have done by himself.

-Similarly, if the attacker tells the corrupted voter to abstain and if the context then returns correctly signed votes to the two honest voters, the processes can synchronize and go on. Otherwise at least one of them blocks and they are unable to synchronize.

If they are able to synchronize, they output their votes to the collector and send the secret values to the timeliness member over a private channel. The timeliness member will open the commitments, synchronize and publish the votes. We obtain the following frames:

φ l = ν x.({ b A/x 1 } | { r A/x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(a,r A ,td A ),b A ),skva),blind(tdcommit(a,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(b,r B ,td B ),b B ),skvb),blind(tdcommit(b,r B ,td B ),b B )) /x 6 } | { (tdcommit(a,r A ,td A ),sign(tdcommit(a,r A ,td A ),ska)) /x 7 } | { (tdcommit(b,r B ,td B ),sign(tdcommit(b,r B ,td B ),ska)) /x 8 } | { (a,r A ,tdcommit(a,r A ,td A )) /x 9 } | { a /x 10 } | { b /x 11 })
3. eVoting and

φ r = ν x.({ b A/x 1 } | { f (b,r A ,td A ,a) /x 2 } | { td A/x 3 } | { (pk(skva),sign(blind(tdcommit(b,r A ,td A ),b A ),skva),blind(tdcommit(b,r A ,td A ),b A )) /x 4 } | { x 4/x 5 } | { (pk(skva),sign(blind(tdcommit(a,r B ,td B ),b B ),skvb),blind(tdcommit(a,r B ,td B ),b B )) /x 6 } | { (tdcommit(b,r A ,td A ),sign(tdcommit(b,r A ,td A ),ska)) /x 7 } | { (tdcommit(a,r B ,td B ),sign(tdcommit(a,r B ,td B ),ska)) /x 8 } | { (a,f (b,r A ,td A ,a),tdcommit(b,r A ,td A )) /x 9 } | { a /x 10 } | { b /x 11 })
Again, these frames are statically equivalent.

Unfortunately ProVerif cannot prove this automatically as the equational theory is too complex. This is due to the trapdoor-commitment which yields a nonconfluent equational theory. However, we can show that the final frames φ l and φ r from above are statically equivalent using KISS [START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF]. The code is available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

As for FOO, we can show that the protocol also ensures Security against Forced-Abstention-Attacks if the administrator is to be trusted and there is a private channel between the administrator and the voters.

Theorem 22

The protocol by Okamoto with a trusted administrator and a private channel to the administrator respects SwRF I,F A .

Proof

We have to show that there exists a closed plain process V such that

V \out(chc,•) ≈ l processV { skva /skv, pk(ska) /pka} { b /v} and νchT.νch1.νch2.((processV { skva /skv, pk(ska) /pka} { a /v}) chc | processV { skvb /skv, pk(ska) /pka} { b /v} |processVc1c2 { skvc /skv, pk(ska) /pka} | processT|processT|processT| processA { pk(skva) /pkv} |processA { pk(skvb) /pkv} |processA { pk(skvc) /pkv}) ≈ l νchT.νch1.νch2.(V |processV { skvb /skv, pk(ska) /pka} { a /v} | processVc1c2 { skvc /skv, pk(ska) /pka} | processT|processT|processT| processA { pk(skva) /pkv} |processA { pk(skvb) /pkv} |processA { pk(skvc) /pkv})
As above, our proof is technically only be correct for three voters, but it can be generalized for more voters.

As above, we write V A for processV { skva /skv, pk(ska) /pka}, V B for processV { skvb /skv, pk(ska) /pka} and V c 1 ,c 2 C for processVc1c2 { skvc /skv, pk(ska) /pka}. Consider V = processV { skva /skv, pk(ska) /pka}. The first equivalence is easy to see by removing all out(chc, _) from processV (Listing 3.10 on page 81). Independent of a, the resulting process is apparently equal to the original voting process processV { skva /skv} { b /v}.

The second equivalence is more difficult to prove. As for FOO, it is sufficient to analyze the case of abstention, as the other case is a consequence of the above lemma. We denote the left hand side process P and the right hand side process Q. On the left hand side the honest voter under attack V A abstains and hence does nothing, whereas the other voter V B constructs the blinded and committed vote and send it to the administrator. On the right hand side, V pretends to abstain, whereas V B abstains in reality. Note that since the channels to the administrator are now private channels, the communication only yields internal reductions. The next steps depends on the context:

-If the context tells the corrupted voter to abstain, the honest voter can synchronize and forward his ballot to the timeliness member and to the collector. The timeliness member can synchronize too, and will publish the vote. We have the following transitions:

P → * in(c1,f alse) -------→ νx 1 .out(ch3,x 1 ) ----------→ νr B .νtd B .(P 1 | { (tdcommit(b,r B ,td B ),sign(tdcommit(b,r B ,td B ),ska)) /x 1 }) → * νx 2 .out(res,x 2 ) ---------→ νr B .νtd B .(P 2 | { (tdcommit(b,r B ,td B ),sign(tdcommit(b,r B ,td B ),ska)) /x 1 } | { b /x 2 }) Similarly Q → * in(c1,f alse) -------→ νx 1 .out(ch3,x 1 ) ----------→ νr A .νtd A .(Q 1 | { (tdcommit(b,r A ,td A ),sign(tdcommit(b,r A ,td A ),ska)) /x 1 }) → * νx 2 .out(res,x 2 ) ---------→ νr A .νtd A .(Q 2 | { (tdcommit(b,r A ,td A ),sign(tdcommit(b,r A ,td A ),ska)) /x 1 } | { b /x 2 })
It is easy to see that both frames are statically equivalent.

-If the attacker tells the corrupted voter to vote, he will forward the given ballot to the administrator. If this ballot is correctly signed, the administrator will accept it, sign it and return it. If the context then tells V c 1 ,c 2

C

to go on (i.e. sends a message containing true), the processes can synchronize and go on. Otherwise at least one of them blocks and they are unable to synchronize. If they are able to synchronize, they output their votes to the collector (V c 1 ,c 2 C sends any message the attacker gives him) and send the secret values to the 3. eVoting timeliness member over a private channel. We obtain the following frames:

φ l = νr B .νtd B .({ (sign(checksign(proj 2 (y1),pubkvc),ska)) /x 1 } | { (tdcommit(b,r B ,td B ),sign(tdcommit(b,r B ,td B ),ska)) /x 2 } | { y4 /x 3 }) and φ r = νr A .νtd A .({ (sign(checksign(proj 2 (y1),pubkvc),ska)) /x 1 } | { (tdcommit(b,r A ,td A ),sign(tdcommit(b,r A ,td A ),ska)) /x 2 } | { y4 /x 3 })
These frames are statically equivalent. If the attacker sent a correct input to the third timeliness process, T will put out the corresponding votes. However, since he has no access to the values used to create the commitment used by the honest voter, the only possibility for him is to create his own one. In that case the timeliness member announces the vote of the corrupted voter plus one vote b.

As above, the attacker cannot use T to obtain frames that are not statically equivalent as this would imply that this difference could also be made on the frames before by opening a commitment -something the attacker could do by himself. Intuitively having access to the "Timeliness" oracle does not help the attacker, as the oracle performs only operations the attacker could have done by himself. § 3.3.5.3. Bingo Voting. Bingo Voting was developed by Bohli, Müller-Quade and Röhrich [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF] to achieve coercion-resistance as well as individual and universal verifiability by using a trusted random number generator (RNG), i.e. a tamper-proof random generator providing real random numbers only to the machine and the voter (in particular not to the adversary). In our hierarchy Bingo Voting ensures SwCR I,P O if the voting machine is to be trusted.

Protocol Description. The protocol is split into three phases: The pre-voting phase, the voting phase and the post-voting phase. In the pre-voting phase the voting machine generates for every candidate p j (j ∈ {1, . . . , l}, l is the number of candidates) k (k is the number of voters) random values n i,j (i ∈ {1, . . . , k}, j ∈ {1, . . . , l}). It commits to the k • l pairs (n i,j , p j ) and publishes the shuffled commitments.

In the voting phase, the voter enters the voting booth and selects the candidate he wants to vote for on the voting machine. The RNG generates a random number r which is transmitted to the voting machine and displayed to the voter. The voting machine chooses for each candidate, except for the voter's choice, a dummy vote. For the chosen candidate, the random value from the RNG is used and the receipt is created. Finally the voter checks that the number displayed on the RNG corresponds to the entry of his candidate on the receipt.

In the post-voting phase, the voting machine announces the result, publishes all receipts, and opens the commitments of all unused dummy votes. The machine also generates non-interactive zero-knowledge proofs that each unopened commitment was actually used as a dummy vote in one of the receipts.

Model in the Applied π-Calculus. As we are only interested in privacy, we ignore the zero-knowledge proofs which are necessary to achieve verifiability. This yields a very simple equational theory:

open(commit(m, r), r) = m
We assume the voting machine to be honest, otherwise no privacy can be guaranteed as the vote is submitted in clear by the voter. To model the voting booth, we use private channels between the voting machine and the voter, between the voter and the RNG, and between the RNG and the voting machine. To achieve better readability we use the macros for and parfor (similar to [START_REF] Mukhamedov | Identity escrow protocol and anonymity analysis in the applied pi-calculus[END_REF]) where e.g. for (i = 1 to 2) out(ch, i) corresponds to out(ch, 1).out(ch, 2) and parfor (i = 1 to 2) out(ch, i) corresponds to (out(ch, 1) | out(ch, 2)). Additionally we use a function choose where

choose(p i , p j , x, y) =    x if i = j y otherwise
Our model depends on two parameters: k (the number of voters) and l (the number of candidates).

The main process (Listing 3.14 on the next page) sets up the private channels and executes the participating processes (the voting machine, three voters, and three RNGs) in parallel.

The RNG (Listing 3.15 on the following page) generates a random number and sends it to the voting machine and the voter over private channels.

The voter (Listing 3.16 on page 91) sends his vote to the voting machine, receives the random number from the RNG and the receipt.

The V c1,c2 process (Listing 3.17 on page 91) simulates a coerced voter. He follows the same protocol, but votes for the candidate the coercer tells him and forwards the receipt and the random number.

The voting machine (Listing 3.19 on page 93) generates the dummy votes and publishes the corresponding commitments. Then k sub-processes interact with the voters, i.e. create the receipts. After all voting has been done, they publish the result, the receipts and the unused dummies in random order. Note that 3. eVoting

( * p r i v a t e c h a n n e l s * ) νprivChM 1 . νprivChM 2 . ν privChM 3 . νprivChRM 1 . νprivChRM 2 . ν privChRM 3 . ν privChR 1 . ν privChR 2 . ν privChR 3 . ( * v o t i n g machine * ) ( processM | ( * RNGs * ) ( l e t privChM = privChRM 1 i n l e t privChV = privChR 1 i n processRNG ) | ( l e t privChM = privChRM 2 i n l e t privChV = privChR 2 i n processRNG ) | ( l e t privChM = privChRM 3 i n l e t privChV = privChR 3 i n processRNG ) | ( * v o t e r s * ) ( l e t privChM = privChM 1 i n l e t privChRNG = privChR 1 i n l e t v = p 1 i n p r o c e s s V ) | ( l e t privChM = privChM 2 i n l e t privChRNG = privChR 2 i n l e t v =
( j = 1 t o l ) i f v i =p j then out (chDum , ( ( n i,j , p j ) , commit ( ( n i,j , p j ) , r i,j ) , r i,j ) ) processM ' ' = sync i d i . sync k 1 .
( * output unused dummy v o t e s * ) p a r f o r ( j = 1 t o l ) out (chDum , ( ( n i,j , p j ) , commit ( ( n i,j , p j ) , r i,j ) , r i,j ) ) processM = ( * p r e p a r e dummy v o t e s * ) Proof To show that Bingo Voting ensures SwCR I,F A , we show that for any

f o r ( i = 1 t o k ) f o r ( j = 1 t o l ) νn i,j . ν r i,j . p a r f o r ( i = 1 t o k ) p a r f o r ( j = 1 t o l ) out ( ch , commit ( ( n i,j , p j ) , r i,j ) ) ( * v o t i n g * ) l e t privChV = privChM i i n l e t privChR = privChRM i i n ( processM ' | processM ' ' )
C = νc 1 .νc 2 .(_|P ) satisfying ñ ∩ f n(C) = ∅ and ν ch.(C [V c 1 ,c 2 A ] |V B { b /v} |V c 1 ,c 2 C |M k=3,l=2 |R A |R B |R C ) ≈ l ν ch.(V A { a /v} chc |V B { b /v} |V c 1 ,c 2 C |M k=3,l=2 |R A |R B |R C ) we have C V \out(chc,•) ≈ l V A { b /v} and ν ch.(C [V c 1 ,c 2 A ] |V B { b /v} |V c 3 ,c 4 C |M k=3,l=2 |R A |R B |R C ) ≈ l ν ch.(C [V ] |V B { a /v} |V c 3 ,c 4 C |M k=3,l=2 |R A |R B |R C )
where

ν ch = νprivChM 1 .νprivChM 2 .νprivChM 3 . νprivChRM 1 .νprivChRM 2 .νprivChRM 3 . νprivChR 1 .νprivChR 2 .νprivChR 3 V A = processV { privChM 1/privChM , privChR 1/privChRN G} V B = processV { privChM 2/privChM , privChR 2/privChRN G} V C = processV { privChM 3/privChM , privChR 3/privChRN G} V = processV { privChM 1/privChM , privChR 1/privChRN G} R A = processRNG { privChRM 1/privChM , privChR 1/privChV } R B = processRNG { privChRM 2/privChM , privChR 2/privChV } R C = processRNG { privChRM 3/privChM , privChR 3/privChV } M k=k ,l=l = processM { k /k, l /l}
This is technically only a valid proof for two honest voters and two candidates, however a similar proof can be done for an arbitrary number of voters and candidates. In Section 3.4.4 we also show that Bingo Voting is modular, which directly generalizes this proof to an arbitrary number of honest voters.

It is easy to see that

C [V ] \out(chc,•) ≈ l V A { b /v} holds.
If we ignore all inputs of V on c1 and all outputs on c2, we obtain V A as both cases (abstention or not) coincide.

We now have to show that the last equivalence holds. As before, we denote the left hand side P and the right hand side Q. For better readability we concentrate on the important steps. At the beginning the voting machine publishes all commitments; then the voters enter the voting booth and vote. We consider only two candidates, thus a = p 1 , a = p 2 or a = abstain (similarly for b, except b = abstain). Here we concentrate on the cases a = p 2 , b = p 1 and a = abstain, b = p 1 , the other cases are similar.

-We start with a = p 2 , b = p 1 . Since all communication inside the booth takes place over internal channels which yield internal reductions (we do not detail this part) and first condition on C ensures that the targeted voter is forced to vote a, we obtain the following two frames:

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { r 1/x 7 } | { n 1,2/x 8 } | { r 1/x 9 }) φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { n 1,1/x 7 } | { r 1/x 8 } | { n 1,1/x 9 })
Obviously both frames are statically equivalent. Note that at this point no information about V B and his vote is available. Now the attacker has to vote himself or abstain, otherwise the voting machines are unable to synchronize and block.

-If he abstains, he can synchronize with processM'', and we obtain the following final frames:

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { r 1/x 7 } | { n 1,2/x 8 } | { r 1/x 9 } | { p 1/x 10 } | { p 2/x 11 } | { r 1/x 12 } | { n 1,2/x 13 } | { n 2,1/x 14 } | { r 2/x 15 } | { ((n 1,1 ,p 1 )
,commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 16 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 17 } | { ((n 2,2 ,p 2 ),commit((n 2,2 ,p 2 ),r 2,2 ),r 2,2 ) /x 18 } | { ((n 3,2 ,p 2 ),commit((n 3,2 ,p 2 ),r 3,2 ),r 3,2 ) /x 19 }) by the coerced voter was correct (which it is), but he still does not know if the numbers on the receipt are unrevealed commitments or fresh random numbers.

-Consider now the case a = abstain, b = p 1 . Since all communication inside the booth takes place over internal channels which yield internal reductions (we again do not detail this part) and first condition on C ensures that the targeted voter is forced to abstain. Hence he does reveal any receipt (nor does V ), thus we obtain the following two frames:

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 }) φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 })
Both frames are syntactically equivalent, hence also statically equivalent. Thus that at this point no information about V B and his vote is available. Now the attacker has to vote himself or abstain, otherwise the voting machines are unable to synchronize and block.

-If he abstains, he can synchronize with processM'', and we obtain the following final frames:

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { p 1/x 7 } | { r 2/x 8 } | { n 2,2/x 9 } | { ((n 1,1 ,p 1 ),commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 10 } | { ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 11 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 12 } | { ((n 1,2 ,p 2 ),commit((n 1,2 ,p 2 ),r 1,2 ),r 1,2 ) /x 13 } | { ((n 3,2 ,p 2 ),commit((n 3,2 ,p 2 ),r 3,2 ),r 3,2 ) /x 14 }) 3. eVoting φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { p 1/x 7 } | { r 1/x 8 } | { n 1,2/x 9 } | { ((n 1,1 ,p 1 ),commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 10 } | { ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 11 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 12 )} | { ((n 2,2 ,p 2 ),commit((n 2,2 ,p 2 ),r 2,2 ),r 2,2 ) /x 13 )} | { ((n 3,2 ,p 2 ),commit((n 3,2 ,p 2 ),r 3,2 ),r 3,2 ) /x 14 )})
It is easy to see that these frames are statically equivalent.

-If the corrupted voter votes, he cannot relate his vote in any way to V A 's vote, as the receipts are meaningless to him and he has to submit his vote in clear. Suppose that he votes for p 1 (the other case is similar). We obtain the following final frames.

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { r 3/x 7 } | { n 3,2/x 8 } | { r 3/x 9 } | { p 1/x 10 } | { p 1/x 11 } | { r 2/x 12 } | { n 2,2/x 13 } | { r 3/x 14 } | { n 3,2/x 15 } | { ((n 1,1
,p 1 ),commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 16 } | { ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 17 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 18 } | { ((n 1,2 ,p 2 ),commit((n 1,2 ,p 2 ),r 1,2 ),r 1,2 ) /x 19 })

φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { r 3/x 7 } | { n 3,2/x 8 } | { r 3/x 9 } | { p 1/x 10 } | { p 1/x 11 } | { r 1/x 12 } | { n 1,2/x 13 } | { r 3/x 14 } | { n 3,2/x 15 } | { ((n 1,1 ,p 1 ),commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 16 } | { ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 17 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 18 )} | { ((n 2,2 ,p 2 ),commit((n 2,2 ,p 2 ),r 2,2 ),r 2,2 ) /x 19 )})
Again, the election outcome and the data published by the voting machine do not help the attacker in distinguishing both cases. He can see that one other voter voted for candidate one, but he cannot decide which one.

Note that in this case we implicitly assume that the attacker does not know if a voter enters the voting booth, which is not necessarily a realistic assumption.

To address this, we can modify e.g. the voters process, or the voting machine to announce the list of participants9 (see Listing 3.20). In this case we still have SwCR I,P O , i.e. Coercion-Resistance against an inside attacker, but no security against forced-abstention attacks any more.

Theorem 24 Bingo Voting with voter lists respects SwCR

ν ch.(C [V c 1 ,c 2 A ] |V B { b /v} |V c 1 ,c 2 C |M l k=3,l=2 |R A |R B |R C ) ≈ l ν ch.(V A { a /v} chc |V B { b /v} |V c 1 ,c 2 C |M l k=3,l=2 |R A |R B |R C ) we have C V \out(chc,•) ≈ l V A { b /v} and ν ch.(C [V c 1 ,c 2 A ] |V B { b /v} |V c 3 ,c 4 C |M l k=3,l=2 |R A |R B |R C ) ≈ l ν ch.(C [V ] |V B { a /v} |V c 3 ,c 4 C |M l k=3,l=2 |R A |R B |R C )
where

ν ch = νprivChM 1 .νprivChM 2 .νprivChM 3 . νprivChRM 1 .νprivChRM 2 .νprivChRM 3 . νprivChR 1 .νprivChR 2 .νprivChR 3 V A = processV { privChM 1/privChM , privChR 1/privChRN G} V B = processV { privChM 2/privChM , privChR 2/privChRN G} V C = processV { privChM 3/privChM , privChR 3/privChRN G} V = processV { privChM 1/privChM , privChR 1/privChRN G} R A = processRNG { privChRM 1/privChM , privChR 1/privChV } R B = processRNG { privChRM 2/privChM , privChR 2/privChV } R C = processRNG { privChRM 3/privChM , privChR 3/privChV } M l k=k ,l=l = processMl { k /k, l /l}
Again, we mark differences to the above proof in bold.

( j = 1 t o l ) i f v i =p j then out (chDum , ( ( n i,j , p j ) , commit ( ( n i,j , p j ) , r i,j ) , r i,j ) ) processMl ' ' = sync i d i . sync k 1 .
( * output unused dummy v o t e s * ) p a r f o r ( j = 1 t o l ) out (chDum , ( ( n i,j , p j ) , commit ( ( n i,j , p j ) , r i,j ) , r i,j ) ) p r o c e s s M l = ( * p r e p a r e dummy v o t e s * )

f o r ( i = 1 t o k ) f o r ( j = 1 t o l ) νn i,j . ν r i,j . p a r f o r ( i = 1 t o k ) p a r f o r ( j = 1 t o l ) out ( ch , commit ( ( n i,j , p j ) , r i,j ) ) ( * v o t i n g * ) l e t privChV = privChM i i n l e t privChR = privChRM i i n ( processMl ' | processMl ' ' )
Listing 3.20 -The voting machine announcing a voter list This is technically only a valid proof for two honest voters and two candidates, however a similar proof can be done for an arbitrary number of voters and candidates.

It is easy to see that C [V ] \out(chc,•) ≈ l V A { b /v} holds. If we ignore all inputs of V on c1 and all outputs on c2, we obtain V A as both cases (abstention or not) coincide.

We now have to show that the last equivalence holds. As before, we denote the left hand side P and the right hand side Q. For better readability we concentrate on the important steps. At the beginning the voting machine publishes all commitments; then the voters enter the voting booth and vote. We consider only two candidates, thus b = p 1 or b = p 2 (similarly for a). Here we will look at the case b = p 2 and a = p 1 , the other cases are similar. Since all communication inside the booth takes place over internal channels which yield internal reductions (we do not detail this part) and first condition on C ensures that the targeted voter is forced to vote a, we obtain the following two frames:

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { r 1/x 7 } | { n 1,2/x 8 } | { r 1/x 9 }) φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { n 1,1/x 7 } | { r 1/x 8 } | { n 1,1/x 9 })
Obviously both frames are statically equivalent. Note that at this point no information about V B and his vote is available. Now the attacker has to vote himself or abstain, otherwise the voting machines are unable to synchronize and block.

-If he abstains, he can synchronize with processMl'', and we obtain the following final frames:

φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { n 1,1/x 7 } | { r 1/x 8 } | { n 1,1/x 9 } | { r 3/x 10 } | { n 3,2/x 11 } | { r 3/x 12 } | { p 1/x 13 } | { p 1/x 14 } | { p 2/x 15 } | { id 1/x 16 } | { id 2/x 17 } | { id 3/x 18 } | { n 1,1/x 19 } | { r 1/x 20 } | { r 2/x 21 } | { n 2,2/x 22 } | { r 3/x 23 } | { n 3,2/x 24 } | { ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 25 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 26 )} | { ((n 1,2 ,p 2 ),commit((n 1,2 ,p 2 ),r 1,2 ),r 1,2 ) /x 27 )})
Again, the election outcome and the published data do not help the attacker in distinguishing both cases. He can verify if the receipt by the coerced voter was correct (which it is), but he still does not know if the numbers on the receipt are unrevealed commitments or fresh random numbers. § 3.3.5.4. Protocol by Lee, Boyd, Dawson, Kim, Yang and Yoo. The protocol by Lee, Boyd, Dawson, Kim, Yang and Yoo [LBD + 03] was shown to be Coercion-Resistant in the DKR-model [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. Yet the protocol is neither secure against an inside attacker nor against forced-abstention attacks, as we show. It is based on trusted devices that re-encrypt ballots and prove their correct behavior to the voter using designated verifier proofs (DVPs).

Protocol Description. We simplified the protocol to focus on the important parts with respect to privacy. For example, we do not consider distributed authorities, but model them as one honest authority.

-The administrator sets up the election, distributes keys and registers legitimate voters. Each voter is equipped with his personal trusted device. At the end, he publishes a list of legitimate voters and corresponding trusted devices.

-The voter encrypts his vote with the tallier's public key (using the El Gamal scheme), signs it and sends it to his trusted device over a private channel. The trusted device verifies the signature, re-encrypts and signs the vote, and returns it, together with a DVP that the re-encryption is correct, to the voter. The voter verifies the signature and the proof, double signs the ballot and publishes it on the bulletin board.

-The administrator verifies for all ballots if the voter has the right to vote and if the vote is correctly signed. He publishes the list of correct ballots, which is then shuffled by the mixer.

eVoting

-The tallier decrypts the mixed votes and publishes the result.

In the following we use a simplified protocol similar to the one was proposed by Delaune et al. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]: the administrator, the mixer and the tallier are replaced by one honest collector which executes the last two steps. We then use the following processes:

Model in

The main process (Listing 3.21 on the facing page) sets up the private channels and executes the participating processes (three voters, three mixers, three talliers -one for each voter -and the keying process).

The keying process (Listing 3.22 on page 106) creates the private keys, distributes them over private channels and publishes the corresponding public keys. Each voter is equipped with his private key, the tallier's public key and the public key of his trusted device. Listing 3.23 on page 107 is variant of the keying process for two voters.

The voter process (Listing 3.24 on page 107) receives the necessary keys. Then he encrypts his votes, signs it and sends it over a private channel to his trusted device. When he receives the answer, he checks the DVP, double signs the ballot and sends it to the mixer (which corresponds to the publication on the bulletin board).

The trusted device (Listing 3.26 on page 108) receives his private and the voter's public key. When he receives an encrypted ballot from the voter, he checks the signature, re-encrypts the message, signs it and establishes a DVP to prove the correctness of his re-encryption. The result is send back to the voter.

The process in Listing 3.27 on page 109 models a voter controlled by the attacker. This process is obtained when calculating processV c 1 ,c 2 as defined in Definition 19 on page 59. Note that his trusted device is not assumed to be The collector (Listing 3.29 on page 110) receives the key pair corresponding to a legitimate voter (the public keys of the voter and his trusted device) and his private key. When receives ballot, he checks the signatures and decrypts the ballots. He publishes the result on a public channel (which emulates the bulletin board).

Analysis. We note that the protocol also ensures Coercion-Resistance in our model: it ensures SwCR O,P O . This result was already shown in [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF], however using a different model. We prove that the result also holds in our model, and then show that the protocol is not secure against inside attackers as vote-copying attacks are possible. The main difference to the model used in [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] is that in our model the voters sign the re-encrypted ballots, as in the original protocol description. This is important with respect to vote-copying and forced abstention attacks, as the signatures allow the attacker to link the ballots to the voters. i n ( pkcCh , pubkc ) . out ( c1 , pubkc ) . sync 1 . ν r . out ( c1 , r ) . l e t e = penc ( v , pubkc , r ) i n i n ( c2 , m1 ) . out ( chD , m1 ) . i n ( chD , m2 ) . out ( c1 , m2 ) . l e t ( re , sd , dvpV ) = m2 i n i n ( c2 , m3 ) . i f m3 = t r u e then i n ( c2 , m4 ) .

i f m4 = t r u e then i n ( c2 , m5 ) . out ( ch1 , m5)

Listing 3.27 -The voting process under control of the attacker processV ' = ( * p r i v a t e key * ) i n ( skvCh , skv ) . out ( c1 , skv ) . ( * p u b l i c k e y s o f t h e t r u s t e d d e v i c e and t h e t a l l i e r * ) i n ( pkdCh , pubkd ) . out ( c1 , pubkd ) . i n ( pkcCh , pubkc ) . out ( c1 , pubkc ) . sync 1 . ν r . out ( c1 , r ) . l e t e = penc ( v , pubkc , r ) i n i n ( c2 , m1 ) . out ( chD , ( pk ( skv ) , e , s i g n ( e , skv ) ) ) . l e t ( pka , ea , s a ) = m1 i n i n ( chD , m2 ) . l e t ( re , sd , dvpV ) = m2 i n i f checkdvp ( dvpV , e , re , pk ( skv ) ) = ok then i f c h e c k s i g n ( sd , pubkd ) = r e then ν r ' . l e t f k = dvp ( ea , re , r ' , skv ) i n out ( c1 , ( re , sd , f k ) ) .

i n ( c2 , m3 ) .

i f m3 = t r u e then i n ( c2 , m4 ) .

i f m4 = t r u e then i n ( c2 , m5 ) . out ( ch1 , m5) Listing 3.29 -The collector process channels as well as the channel to the trusted device are private. We show that there exists a process V such that for all votes σ v A and σ v B where neither σ v A nor σ v B makes a voter abstain, the following holds:

For any context C = νc 1 .νc 2 .(_|P ) with ñ ∩ f n(C) = ∅ and S [C [(V σ id A ) c 1 ,c 2 ] |V σ id B σ v B ] ≈ l S (V σ id A σ v A ) chc |V σ id B σ v B (3.10) we have C V \out(chc,•) ≈ l V σ id A σ v B (3.11) and S [C [(V σ id A ) c 1 ,c 2 ] |V σ id B σ v B ] ≈ l S C V |V σ id B σ v A (3.12)
where

S = ν ch.(_|D A |D B |processK2|processC|processC) ν ch = νsktCh.νpktCh.νvotCh.νskvcCh.νchD. νskvaCh.νskvbCh.νskdaCh.νskdbCh. νpkvaCh.νpkvbCh.νpkdaCh.νpkdbCh V = processV V = processV { skvaCh /skvCh, pkdaCh /pkdCh} σ v B σ id A = { skvaCh /skvCh, pkdaCh /pkdCh} σ id B = { skvbCh /skvCh, pkdbCh /pkdCh} D A = processD { skdaCh /skdCh, pkvaCh /pkvCh} D B = processD { skdbCh /skdCh, pkvbCh /pkvCh}
This proof is technically only valid for two honest voters, however a similar proof can be done for an arbitrary number of voters. This proof is particularly challenging as we have to reason about all contexts C that fulfill the above conditions. We start by analyzing how this context has to behave, commencing our reasoning from the result. The first condition ensures that the announced result at the end contains a vote v A and a vote v B . As the voter id B always votes v B , the context has to submit a vote for v A . Hence the last message m5 must be a valid vote for v A . This also implies that messages m4 and m3 contain true, otherwise no vote is submitted.

As the trusted device's keys are secret, the only way for the context to construct a correct ballot is to submit it to the device. Otherwise he is unable to construct a valid signature that can be accepted by the talliers. This implies that he submits a ballot containing v A as message m1.

As (V σ id A σ v A ) chc reveals all his data on channel chc, C [(V σ id A ) c 1 ,c 2 ]
has to do the same. In particular he has to publish an unsigned version of the ballot he later on submits (cf. Process 3.25 on page 108), hence he needs to output the ballot he gets back from the trusted device. The other data he needs to publish on the channel are the secret key of the voter, the public key of the device and a "random value" (like the one that is used to encrypt the vote). The keys have to be correct as they can be compared to the keys publish by the key distribution process, the "random value" can be anything as long as the frame is statically equivalent to one with a random value.

Let us now consider the equations we need to prove.

For the first equation (3.11) consider the processes V . If we ignore all outputs on c1 and inputs on c2, the process is equivalent to V σ id A σ v B until the final three commands which depend on the inputs by the context. But there we can argue as above that the context C[_] will provide the correct inputs, i.e. twice true and finally the correctly signed ballot obtained from the trusted device.

For the second equation (3.12) we have consider the possible transitions. As before, we denote the left hand side P and the right hand side Q. Both sides start by publishing the keys, and then distributing them over restricted channels (yielding internal reductions). We do not detail this part for better readability. On both sides C [(V σ id A ) c 1 ,c 2 ] and C [V ] respectively publish the keys they receive. Then all processes synchronize, and the voters chose their random values (which the voter under attack reveals) and send their ballots to the trusted devices over the private channels. The trusted device answers with the signed and rerandomized ballot and the DVP. The voters check the DVP and then send the signed ballot to the collector. This also holds for the coerced voter as explained above. We obtain the following frame on the left hand side:

φ l = ν ch.ν r.({ skva /x 1 } | { pkda /x 2 } | { pkc /x 3 } | { r /x 4 } | { (penc(v A ,pk(skc),f (r,r1
)),sign(penc(v A ,pk(skc),f (r,r1)),skda), dvp(penc(v A ,pk(skc),r),penc(v A ,pk(skc),f (r,r1)),r1,pk(skva))) /x 5 } | { (penc(v A ,pk(skc),f (r,r1)),sign(sign(penc(v A ,pk(skc),f (r,r1)),skda),skva) /x 6 } | { (penc(v B ,pk(skc),f (r B ,r1)),sign(sign(penc(v B ,pk(skc),f (r B ,r1)),skdb),skvb) /x 7 })

where r contains all the fresh random values created by the processes. Note that technically r is just a variable: the context can output a different value indistinguishable from the original r output by (V σ id A σ v A ) chc , however this does not affect our reasoning since the frame has to remain statically equivalent to this one by (3.10). On the right hand side we have:

φ r = ν ch.ν r.({ skva /x 1 } | { pkda /x 2 } | { pkc /x 3 } | { r /x 4 } | { (penc(v B ,pk(skc),f (r ,r1
)),sign(penc(v B ,pk(skc),f (r ,r1)),skda), dvp(penc(v A ,pk(skc),r),penc(v B ,pk(skc),f (r ,r1)),r ,skva)) /x 5 } | { (penc(v B ,pk(skc),f (r ,r1)),sign(sign(penc(v B ,pk(skc),f (r ,r1)),skda),skva) /x 6 } | { (penc(v A ,pk(skc),f (r B ,r1)),sign(sign(penc(v A ,pk(skc),f (r B ,r1)),skdb),skvb) /x 7 })

Here again r is just a variable, we denote by r the random value chosen by V .

The above frames are statically equivalent as the context has no access to skc or r1, and in particular we have checkdvp(third(x 5 ), penc(v A , pk(skc), r), f irst(x 5 ), pk(skva) = ok in both frames.

If the attacker forwards the ballots, the collectors check the signatures, synchronize and publish the result: A vote v A and a vote v B in both cases. If he does not forward the ballots or inputs other (and hence incorrectly signed) values, the collector(s) will block and cannot synchronize.

Yet the protocol does not ensure simple Vote-Privacy against an inside attacker, showing that the cases Insider and Outsider are distinct. As acknowledged by the authors in their original paper [LBD + 03], it is possible to copy votes. More precisely, an attacker can access the ballots on the bulletin board before the mixing takes place. He can easily verify which ballot belongs to which voter as they are signed by the voters themselves. He can remove the signature and use the ciphertext as an input to his trusted device. The trusted device will re-encrypt and sign it. This allows the attacker to construct a correct ballot which contains the same vote as the targeted honest voter. By submitting this ballot he obtains a different election outcome in both cases of the observational equivalence.

Theorem 26 The protocol by Lee et al. does not respect SwV P I,P O (Swap-Vote-Privacy against an inside attacker in the Participation Only case).

Proof In our model this can be seen as follows. We suppose that all authorities are honest and that all key distribution channels are private. We show that

ν ch.(V A { a /v} |V B { b /v} |V c 1 ,c 2 C |D A |D B |D C |A) ≈ l ν ch.(V A { b /v} |V B { a /v} |V c 1 ,c 2 C |D A |D B |D C |A)
where ν ch = νskcCh.νpkcCh.νvotCh. νskvaCh.νskvbCh.νskvcCh.νskdaCh.νskdbCh.νskdcCh. νpkvaCh.νpkvbCh.νpkvcCh.νpkdaCh.νpkdbCh.νpkdcCh A = (processK|processC|processC|processC)

V A = processV { skvaCh /skvCh, pkdaCh /pkdCh} V B = processV { skvbCh /skvCh, pkdbCh /pkdCh} V C = processVc1c2 { skvcCh /skvCh, pkdcCh /pkdCh} D A = processD { skdaCh /skdCh, pkvaCh /pkvCh} D B = processD { skdbCh /skdCh, pkvbCh /pkvCh} D C = processD { skdcCh /skdCh, pkvcCh /pkvCh}
As before, we denote the left hand side P and the right hand side Q. For better readability we concentrate on the important steps. After key distribution, the honest voters will execute the protocol with their trusted device and eventually output the following messages on ch1:

P → * . . . → * out(ch1,x 1 ) -------→ out(ch1,x 2 )
-------→ νr 1 .νr 2 .νr 3 .νr 4 .(P 1 | { (penc(a,pk(skt),f (r 1 ,r 2 )),sign(sign(penc(a,pk(skt),f (r 1 ,r 2 )),skda),skva)) /x 1 } | { (penc(b,pk(skt),f (r 3 ,r 4 )),sign(sign(penc(b,pk(skt),f (r 3 ,r 4 )),skdb),skvb)) /x 2 })

Q → * . . . → * out(ch1,x 1 ) -------→ out(ch1,x 2 ) -------→ νr 1 .νr 2 .νr 3 .νr 4 .(Q 1 | { (penc(b,pk(skt),f (r 1 ,r 2 )
),sign(sign(penc(b,pk(skt),f (r 1 ,r 2 )),skda),skva)) /x 1 } | { (penc(a,pk(skt),f (r 3 ,r 4 )),sign(sign(penc(a,pk(skt),f (r 3 ,r 4 )),skdb),skvb)) /x 2 })

The attacker can now target e.g. voter V A and copy his vote. Note that he can identify which voter cast which ballot as they are signed and the keys publicly available. Through V C he submits penc(a, pk(skt), f (r 1 , r 2 )) in the left hand case or penc(b, pk(skt), f (r 1 , r 2 )) in the right hand case to D C and obtains sign(penc(a, pk(skt), f (f (r 1 , r 2 ), r 5 )), skdc) and penc(a, pk(skt), f (f (r 1 , r 2 ), r 5 ) or sign(penc(b, pk(skt), f (f (r 1 , r 2 ), r 5 )), skdc) and penc(b, pk(skt), f (f (r 1 , r 2 ), r 5 ) respectively, where r 5 is a fresh name (nonce). He can then sign the message and

(penc(a, pk(skt), f (f (r 1 , r 2 ), r 5 )), sign(sign(penc(a, pk(skt), f (f (r 1 , r 2 ), r 5 )), skdc), skvc))
or in the right hand case (penc(b, pk(skt), f (f (r 1 , r 2 ), r 5 )), sign(sign(penc(b, pk(skt), f (f (r 1 , r 2 ), r 5 )), skdc), skvc))

The collector will then check the signatures -which are apparently correct -and publish the decrypted votes. On the left hand side, we will obtain two votes a and one vote b, on the right hand side one vote for a and two votes for b. Thus the frames are not statically equivalent, hence both sides are not bisimilar.

Additionally, this protocol is not secure against forced-abstention attacks as the ballots on the bulletin board are signed by the voters. The attacker can thus easily verify if a voter voted or not. § 3.3.5.5. Summary. In this section we presented a taxonomy of privacy in eVoting protocols. Our taxonomy is based on three independent dimensions: Communication between the voter and the attacker, inside or outside attacker, and security against forced abstention attacks. We formalized a model for voting protocols and the different notions in the Applied π-Calculus.

To illustrate that the different dimensions of our taxonomy correspond to different properties of existing protocols, we presented several case studies. The results of these case studies are summed up in Table 3.1 on the facing page and Figure 3.1 on page 69.

Defining Privacy for Weighted Votes

The definitions presented in the previous section are based on the idea of swapping votes. Yet these definitions are unsuitable for some situations, for example in companies where votes are weighted according to the proportion of shares held by each shareholder. To address this issue, we now present a generalization of previous notions that takes weighted votes into account. Instead of requiring two executions where voters swap votes to be bisimilar, we require two executions to be bisimilar if they publish the same result, independent of the mapping between voters and votes. We analyze the relationship of our notion to the previous swap-based ones and give precise conditions for formally proving the equivalence between them. We use a variant of the protocol by Eliasson and Zúquete [START_REF] Eliasson | An electronic voting system supporting vote weights[END_REF] as a case study for our definition, and provide a partially automated proof using ProVerif.

Our privacy definition is based on the observation that -as the result of the vote is always published -some knowledge about the voter's choices can always be inferred from the outcome. The classical example is the case of a unanimous vote where the contents of all votes are revealed just by the result. Yet -as already discussed in the above -there can also be other cases where some of the votes can be inferred from the result, in particular in the case of weighted votes. If for example Alice holds 66% of the shares and Bob 34%, both votes are always revealed when announcing the result: If one option gets 66% and the other 34%, it is clear which one was chosen by Alice or Bob. However, if we have a different distribution of the shares (e.g. 50%, 25% and 25% as above), some privacy is still possible as there are several situations with the same result. Thus our main idea: If two instances of a protocol give the same result, an attacker should not be able to distinguish them. Note that this includes the previous definitions where votes 3. eVoting are swapped, if this gives the same result.

-Formal Definition

To express this formally, we need to define the result of an election. As defined above, we suppose that the result is always published on a special channel res.

The following definition allows us to hide all channels except for a specified channel c, which we can use for example to reason about the result on channel res.

Definition 22 (P | c ) Let P | c = ν ch.P where ch are all channels except for c, i.e. we hide all channels except for c. Now we can formally define our privacy notion: If two instances of a protocol give the same result, they should be bisimilar.

Definition 23 (Vote-Privacy (VP)) A voting protocol ensures Vote-Privacy (VP) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ id l σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l ) we have V P A H | res ≈ l V P B H | res ⇒ V P A ≈ l V P B
where V P A H and V P B H are the honest voting processes corresponding to V P A and V P B respectively.

Note that the test if the two instances give the same result is defined on the honest voting processes, but the bisimilarity ensuring privacy is then required to hold on the "normal" voting processes where some authorities can be dishonest. This distinction is necessary as otherwise the hiding of all channels but the result (V P A H | res and V P B H | res ) in the test could produce instances that cannot actually terminate as some authorities are not present, and the attacker cannot simulate them as he does not have access to the channels.

A simple interpretation of this definition is that everything apart from the result on channel res has to remain private. This obviously relies heavily on the notion of "result" and the modeling of the protocol. Typically the result will only contain the sum of all votes, which corresponds to a simple and intuitive understanding of privacy. Some protocols may leak some additional information, for example the number of ballots on the bulletin board. For instance in the protocol by Juels et al. [START_REF] Juels | Coercionresistant electronic elections[END_REF] voters can post fake ballots. In this case, the above definition of the result may lead to a too restrictive privacy notion, since two situations with the same votes but a different number of fakes are required to be bisimilar. To address this issue, we can include the number of ballots in the result if we want to accept the additional leakage. This gives very fine-grained control about the level of privacy we want to model.

Defining Privacy for Weighted Votes

Note that if the link between a voter and his vote is also published as part of the result on channel res, our definition of privacy may be true although this probably does not correspond to the intuitive understanding of privacy. This is however coherent within the model since everything apart from the result is private; simply the result itself leaks too much information.

Moreover, note that this approach to define privacy is not only limited to voting, but can also be applied e.g. on auction protocols (see Section 4.3.4), or other types of multi-party computation where several parties jointly compute a public result based on private inputs.

-Example: A Variant of FOO

To show that our definition is applicable in practice, we now discuss an example: Eliasson and Zúquete [START_REF] Eliasson | An electronic voting system supporting vote weights[END_REF] proposed an implementation of a voting system supporting vote weights based on REVS [START_REF] Joaquim | Revs -a robust electronic voting system[END_REF], which itself is based on the protocol by Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] discussed in Section 3.3.5.1. § 3.4.2.1. Adding Vote Weights. In [START_REF] Eliasson | An electronic voting system supporting vote weights[END_REF] Eliasson and Zúquete discuss several possibilities on how to implement weights in this protocol:

-including the weight in the vote (which requires trusting the voter for correctness or zero-knowledge proofs to verify the weight) -using different keys when the vote is signed by the administrator, where each key corresponds to a different weight -using multiple ballots per voter, i.e. if for example voter A holds 70% and voter B 30% of the shares, voter A sends seven and voter B three ballots.

We implemented the latter variant in the Applied π-Calculus as a case study.

Note that there is also a variant of Helios supporting vote weights [ADMPQ09], using a fourth approach: the voters vote normally, and the authorities multiply the vote with its weight before tallying, exploiting the homomorphic property of the encryption. The administrator (Listing 3.30 on the following page) receives his private key and the public key of a legitimate voter. When receives the blinded commitment, he checks the signature, signs, and sends the result back. f o r ( i = 1 t o w) out ( ch5 , ( l i , r i ) )

Listing 3.32 -The voting process

The collector (Listing 3.31 on the preceding page) receives the administrator's public key, which he then uses to verify the signature on incoming commitments. If the signature is correct, he creates a new bounded name l (the number in the list) and sends it together with the signed commitment back to the voter. The voter then reveals his randomness, which the collector uses to open the commitment. The voter's process (Listing 3.32 on the facing page) votes following the protocol by FOO, yet for several ballots according to his weight w: He first creates the blinded commitments, signs them and sends them to the administrator.

He unblinds the answer and sends it to the collector, and finally reveals the randomness.

Using a manual proof we can show that

V P A H | res ≈ l V P B H | res ⇒ n i=1 v A i * w i = n i=1 v B i * w i . ( 3

.13)

Proof To show that (3.13) holds, we use a proof by contradiction. Suppose

n i=1 v A i * w i = n i=1 v B i * w i (3.14)
We will show that this implies V P A H | res ≈ l V P B H | res by showing that there exists an execution which allows the attacker to see for all i w i times a message v X i on channel res. Hence he can compare messages and distinguish V P A H | res and V P B H | res .

Consider two processes

V P A H = | 1≤i≤n (processV v A i /v { w i/w} { pk(ska) /pka} { skv i/skv}) | 1≤i≤n ( | 1≤k≤w i processC { pk(ska) /pka}) | 1≤i≤n ( | 1≤k≤w i processA { pk(skv i ) /pkv}) V P B H = | 1≤i≤n (processV v B i /v { w i/w} { pk(ska) /pka} { skv i/skv}) | 1≤i≤n ( | 1≤k≤w i processC { pk(ska) /pka}) | 1≤i≤n ( | 1≤k≤w i processA { pk(skv i ) /pkv})
In both cases, processC cannot synchronize and is blocked. The voter processes can output w i times (pk(skv i ), sign(blindedvote i , skv i ), blindedvote i ) (their blinded and signed vote) on channel ch1. The administrator replies with the correctly signed votes, which allows the voters to successfully verify and unblind the signed ballots. Then they will synchronize and output the (commitedvote i , signedvote i ) on channel ch3. The processC processes can then receive the messages, verify the signatures and output (l, m3, m4), i.e.

(l, commitedvote i , signedvote i ) on channel ch4. The voters will then verify if the messages correspond to their votes, synchronize and reveal the random values of the commitments. The collectors can open the commitments and will publish all votes on channel res. Hence there is an execution that reveals all votes and their weights in clear to the intruder, hence using (3.14),

V P A H | res ≈ l V P B H | res .
Using a python script available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF] that generates all cases to check given the number of voters and the discrete weight distribution, we can use ProVerif to then establish (3.15) for a given weight distribution. Although this technique allows to conclude that the protocol ensures (VP) given a certain distribution of the weights, ProVerif is unable to prove a general result for all possible distributions automatically, as we have infinitely many possible distributions and hence infinitely many cases to check.

n i=1 v A i * w i = n i=1 v B i * w i ⇒ V P A ≈ l V P B (3.15)

-Link to Existing Definitions

To establish the relationship of our definition and the previous taxonomy in Section 3.3, we need to formally characterize their difference. Intuitively the swap-based definition assumes that swapping two votes will not change the result. This can be formalized as follows: If two instances of the protocol with the same voters give the same result, then the votes are a permutation of each other, and vice versa. This precludes weighted votes, thus the name "Equality of Votes".

Definition 24 (Equality of Votes (EQ)) A voting protocol respects Equality of Votes (EQ) if for any two voting processes

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l ) where no σ v A i or σ v B i
makes a voter abstain, we have

V P A H | res ≈ l V P B H | res ⇔ ∃π : ∀i : σ v B i = σ v A π(i)
, where π is a permutation.

Note that here we exclude abstention, i.e. the result can for example include a list of all abstaining voters. We also define a stronger notion that includes abstention. In that case, the result has to remain unchanged even if different voters abstain.

Definition 25 (Equality of Abstention (EQA)) A voting protocol respects Equality of Abstention (EQA) if for any two voting processes

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l ), we have V P A H | res ≈ l V P B H | res ⇔ ∃π : ∀i : σ v B i = σ v A π(i)
, where π is a permutation.

Obviously this is stronger than (EQ), i.e. any protocol respecting (EQA) also respects (EQ).

We can apply these definitions on the case studies we presented before, consider for example FOO.

Theorem 27 FOO ensures Equality of Votes (EQ).

Proof Suppose we have two voting processes V P A and V P B and there exists a permutation π : ∀i :

σ v B i = σ v A π(i)
. We have to show that

V P A H | res ≈ l V P B H | res .
As the protocol ensures SwV P I,P O (and hence also SwV P O,P O ) and we can write any permutation as a sequence of simple permutations, we have V P A ≈ l V P B, which gives V P A H | res ≈ l V P B H | res as labeled bisimilarity is closed under the application of contexts (here the inclusion of the missing authorities and the restriction to the channel res).

Suppose we have two voting processes V P A and V P B with V P A H | res ≈ l V P B H | res . Assume that there exists no permutation π such that ∀i :

σ v B i = σ v A π(i)
, hence there exists a vote v such that the number

v A i with v A i = v is different of the number of v B i with v B i = v, i.e. 1≤i≤n,v A i =v 1 = 1≤i≤n,v B i =v 1
We show that this allows an attacker to distinguish V P A H | res and V P B H | res which contradicts V P A H | res ≈ l V P B H | res . Consider the following voting processes:

V P A H = | 1≤i≤n (processV v A i /v { pk(ska) /pka} { skv i/skv} | processC { pk(ska) /pka} |processA { pk(skv i ) /pkv}) V P B H = | 1≤i≤n (processV v B i /v { pk(ska) /pka} { skv i/skv} | processC { pk(ska) /pka} |processA { pk(skv i ) /pkv})
The voter processes can output (pk(skv), sign(blindedvote, skv), blindedvote) (their blinded and signed vote) on channel ch1. The administrator then replies with the signed votes, which allows the voters to successfully verify and unblind the signed ballots. Then they synchronize and output the (commitedvote, signedvote) on channel ch3. The collectors processC can then receive the messages, verify the signatures and output list of accepted ballots on channel ch4. The voters then reveal their random values r. The collectors can finally open and publish the

eVoting

votes voteV on channel res. Hence there is an execution that reveals all votes in clear to the intruder, thus he can count the number of occurrences of each choice, which gives

V P A H | res ≈ l V P B H | res .
We can do a similar proof for the protocol by Okamoto.

Theorem 28

The protocol by Okamoto ensures Equality of Votes (EQ).

Proof Suppose we have two voting processes V P A and V P B and there exists a permutation π : ∀i :

σ v B i = σ v A π(i)
. We have to show that

V P A H | res ≈ l V P B H | res .
As the protocol ensures SwV P I,P O (and hence also SwV P O,P O ) and we can write any permutation as a sequence of simple permutations, we have V P A ≈ l V P B, which gives V P A H | res ≈ l V P B H | res as labeled bisimilarity is closed under the application of contexts (here the inclusion of the missing authorities and the restriction to the channel res). Suppose we have two voting processes V P A and V P B with V P A H | res ≈ l V P B H | res . Assume that there exists no permutation π such that ∀i :

σ v B i = σ v A π(i)
, hence there exists a vote v such that the number

v A i with v A i = v is different of the number of v B i with v B i = v, i.e. 1≤i≤n,v A i =v 1 = 1≤i≤n,v B i =v 1
We show that this allows an attacker to distinguish V P A H | res and V P B H | res which contradicts V P A H | res ≈ l V P B H | res . Consider the following voting processes:

V P A H = νchT. | 1≤i≤n (processV v A i /v { pk(ska) /pka} { skv i/skv} | processT) |processC { pk(ska) /pka})|processA { pk(skv i ) /pkv} V P B H = νchT. | 1≤i≤n (processV v B i /v { pk(ska) /pka} { skv i/skv} processT) |processC { pk(ska) /pka})|processA { pk(skv i ) /pkv}
In both cases, processT cannot synchronize and is blocked. The voter processes can output (pk(skv), sign(blindedvote, skv), blindedvote) (their blinded and signed vote) on channel ch1. The administrator then replies with the signed votes, which allows the voters to successfully verify and unblind the signed ballots. Then they synchronize and output the (commitedvote, signedvote) on channel ch3, and output (v, r, commitedvote) on the private channel chT with the timeliness member. The processT processes can then receive the messages, synchronize, verify the signatures and output the votes vt on channel res. Hence there is an execution that reveals all votes in clear to the intruder, thus he can count the number of occurrences of each choice, which gives

V P A H | res ≈ l V P B H | res .
Similarly Bingo Voting ensures Equality of Abstention as votes are not weighted and abstaining voters remain anonymous.

Theorem 29 Bingo Voting ensures Equality of Abstention (EQA).

Proof Suppose we have two voting processes V P A and V P B and there exists a permutation π : ∀i :

σ v B i = σ v A π(i)
. We have to show that

V P A H | res ≈ l V P B H | res .
As the protocol ensures SwV P I,F A and we can write any permutation as a sequence of simple permutations, we have V P A ≈ l V P B, which gives

V P A H | res ≈ l V P B H | res .
Suppose we have two voting processes V P A and V P B with V P A H | res ≈ l V P B H | res . Assume that there exists no permutation π such that ∀i :

σ v B i = σ v A π(i)
, hence there exists w.l.o.g. a vote v10 such that the number

v A i with v A i = v is different of the number of v B i with v B i = v, i.e. 1≤i≤n,v A i =v 1 = 1≤i≤n,v B i =v 1 (3.16)
We show that this allows an attacker to distinguish V P A H | res and V P B H | res which contradicts V P A H | res ≈ l V P B H | res . Consider the following voting processes:

V P A H = νprivChM 1 . . . νprivChM n .νprivChRM 1 . . . νprivChRM n . νprivChR 1 . . . νprivChR n . processM { n /k} | 1≤i≤n processV v A i /v σ id i { privChM i/privChM} { privChR i/privChRNG} | 1≤i≤n (processRNG { privChRM i/privChM} { privChR i/privChV})
and

V P B H = νprivChM 1 . . . νprivChM n .νprivChRM 1 . . . νprivChRM n . νprivChR 1 . . . νprivChR n . processM { n /k} | 1≤i≤n processV v B i /v σ id i { privChM i/privChM} { privChR i/privChRNG} | 1≤i≤n (processRNG { privChRM i/privChM} { privChR i/privChV})
In both cases the voting machine process processM generates the commitments commit((n i,j , p j ), r i,j ) and publishes them on channel ch. The random generators processRNG generate a fresh nonce and output it on the private channels to the voter and the voting machine. The voter processes outputs his vote v on channel privChM i . The voting machine receives both and outputs the receipts receipt j to the voters on channel PrivChM i . After all votes have been received and the receipts have been send, the voting machine can synchronize and output the result, i.e. the votes v in clear on channel res. Hence there is an execution that reveals all votes in clear to the intruder, thus he can count the number of occurrences of each choice which gives

V P A H | res ≈ l V P B H | res .
Using (EQ) and (EQA) we can now establish the formal link between (VP) and the previous privacy definitions in our taxonomy.

Theorem 30 We have:

-If a protocol respects (EQ), then (VP) and (SwV P O,P O ) are equivalent.

-If a protocol respects (EQA), then (VP) and (SwV P O,F A ) are equivalent.

Proof We only prove the first statement, the second is analogous. We simply need to add the case where σ v B makes the voter abstain, which is however covered by (EQA), hence the resulting proof is the same.

-Suppose the protocol respects (VP). We have to show that it respects SwV P O,P O , i.e. that for any voting process V P and for all votes σ v A and σ v B where σ v B and σ v A does not make a voter abstain we have

V P A := V P {A,B} [V σ id A σ v A |V σ id B σ v B |0] ≈ l V P {A,B} [V σ id A σ v B |V σ id B σ v A |0] =: V P B 3. eVoting

-Including Corrupted Voters

Until now, these definitions did not include corrupted voters. This can be addressed using the following definitions.

Definition 26 (Vote-Privacy with a single corrupted voter (VP SC )) A voting protocol ensures Vote-Privacy with a single corrupted voter (VP SC ) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l )
, and a subset J ⊆ {1, . . . , n}, such that ∀j ∈ J :

σ v A j = σ v B j
and |J| ≤ 1 we have

V P A H | res ≈ l V P B H | res ⇒ V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j
where V P A J and V P B J are contexts equal to V P A and V P B with a hole for the voters in J respectively (cf. Definition 16 on page 58).

Again, we can establish a link to the existing definition.

Theorem 31 We have:

-If a protocol respects (EQ), then (VP SC ) and SwV P I,P O are equivalent.

-If a protocol respects (EQA), then (VP SC ) and SwV P I,F A are equivalent.

Proof We only consider the first case, the second case is analogous.

-Suppose the protocol respects (VP SC ). We have to show that it respects (SwV P I,P O ), i.e. for any voting process V P and for all votes σ v A and σ v B where σ v B and σ v A do not make a voter abstain we have

V P A := V P {A,B,C} [V σ id A σ v A |V σ id B σ v B |(V σ id C ) c 1 ,c 2 ] ≈ l V P {A,B,C} [V σ id A σ v B |V σ id B σ v A |(V σ id C ) c 1 ,c 2 ] =: V P B Consider V P A H := V P H {A,B,C} [V σ id A σ v A |V σ id B σ v B |V σ id C σ v C ] ≈ l V P H {A,B,C} [V σ id A σ v B |V σ id B σ v A |V σ id C σ v C ] := V P B H
Obviously the votes on the right hand side are a permutation of the votes of the left hand side. As the protocol ensures Equality of Votes we have

V P A H | res ≈ l V P B H | res
As the protocol respects (VP SC ) we conclude with J = {C}, |J| ≤ 1, that

V P A ≈ l V P B
Note that technically the names of the channels of the corrupted voter are different, however labeled bisimilarity is closed under α-renaming.

-Suppose the protocol respects (SwV P I,P O ) and we want to show that it respects (VP SC ), i.e. for two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l )
, and a subset J ⊆ {1, . . . , n} such that ∀j ∈ J :

σ v A j = σ v B j
and |J| ≤ 1 we have

V P A H | res ≈ l V P B H | res ⇒ V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j Suppose V P A H | res ≈ l V P B H | res .
As the protocol respects (EQ), we know that there exists a permutation π such that ∀i :

σ v A i = σ v B π(i)
. Additionally we know that ∀j ∈ J :

σ v A j = σ v B j
. Using the fact that (SwV P I,P O ) allows us to permute any two votes of honest voters in the presence of one corrupted voter which does not change its vote, and that any permutation (even the identity) can be expressed as a sequence of simple permutations, we obtain

V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j
(again after renaming). Note that if we have no honest voter, the equivalence is trivially true (syntactical equality). Similarly if we have only one honest voter, he has to vote the same on both sides and the equivalence is again trivially true. Note also that if we do not have a corrupted voter, we can still conclude as (VP SC ) implies (VP).

Naturally we can also consider multiple corrupted voters.

Definition 27 (Vote-Privacy with multiple corrupted voters (VP M C ))

A voting protocol ensures Vote-Privacy with multiple corrupted voters (VP M C ) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l )
, and a subset J ⊆ {1, . . . , n}, J = {1, . . . , n} if n > 1, such that ∀j ∈ J :

σ v A j = σ v B j we have V P A H | res ≈ l V P B H | res ⇒ V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j

eVoting

where V P A J and V P B J are contexts equal to V P A and V P B with a hole for the voters in J respectively (cf. Definition 16 on page 58).

Note that each corrupted bidder j has his own channel pair c 1j , c 2j to interact with the attacker. This avoids confusion, in particular in the Coercion-Resistance definitions below.

With these definitions we obtain a hierarchy of privacy notions.

Theorem 32 (Hierarchy of Privacy Definitions) We have:

-If a protocol respects (VP M C ), then it also respects (VP SC ).

-If a protocol respects (VP SC ), then it also respects (VP).

Proof This is a consequence of the definitions: (VP) is a special case of (VP SC ) with J = ∅, and (VP SC ) is a special case of (VP M C ) with |J| ≤ 1.

As shown in the previous section, inside and outside attackers are in general not the same as an inside attacker can for example employ vote-copying attacks.

However we can show that under some reasonable assumptions on the protocol (VP), (VP SC ) and (VP M C ) coincide.

To prove this, we define the notion of a "generalized voting process" which is like a voting process, but some of the voters might be coerced or corrupted.

Definition 28 (Generalized Voting Process) A Generalized Voting Process is a voting process V P with variables for the voter's processes that can either be a "normal" honest voter, a voter communicating with the intruder, or a corrupted voter, i.e.

V P = ν ñ.(V 1 | . . . |V n |A 1 | . . . |A l ) where V i ≈ l V σ id i σ v i or V \out(chc i ,•) i ≈ l V σ id i σ v i or V i ≈ l (V σ id i σ v i ) c 1i ,c 2i .
The next definition captures the key property required for our proof.

Definition 29 (Modularity (Mod)) A voting protocol is modular (Mod) if for any honest, coerced or corrupted voters

V 1 , . . . , V n (i.e. with V i ≈ l V σ id i σ v i or V \out(chc i ,•) i ≈ l V σ id i σ v i or V i ≈ l (V σ id i σ v i ) c 1i ,c 2i )

and the corresponding generalized voting processes

V P A = ν ñA .(V 1 | . . . | V k | A 1 A | . . . | A l A ), V P B = ν ñB .(V k+1 | . . . | V n | A 1 B | . . . | A l B ) and V P = ν ñ.(V 1 | . . . | V n | A 1 | . . . | A l ) we have V P ≈ l V P A|V P B.
Note that this can be applied in both directions, i.e. we can compose and decompose instances with different voters in a transparent way. In particular we can add voters by composing with an instance containing these voters, or decompose an instance into two instances and reason about both instances independently. Consider the following example illustrating how Modularity captures that certain parts of a voting protocol are independent: imagine a protocol where in order to escape coercion the voters can claim that a certain ballot on the bulletin board is their ballot, but this ballot was actually prepared by some honest authority to allow the voters to create a fake receipt. If we suppose that this ballot exists only once no matter how many voters are attacked, it would be enough for a single voter to fake his receipt. However we cannot compose two instances with one attacked voter each, as they would use the same fake ballot which would be noticeable for the attacker. Hence the above definition also captures the fact that faking the receipt to escape coercion can be done by each voter independently.

Similarly, a modular protocol is secure against inside attackers or corrupted voters since the different parts of the protocol are independent, as we now show.

Theorem 33 If a protocol is modular and finite (i.e. any instance or voting process is finite), (VP) and (VP M C ) are equivalent.

Proof By Theorem 32 a protocol ensuring (VP M C ) also ensures (VP). We now show that if a protocol is modular, finite and respects (VP), then it also respects (VP M C ).

We need to show that for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l ), and a subset J ⊆ {1, . . . , n}, J = {1, . . . , n} if n > 1, such that ∀j ∈ J : σ v A j = σ v B j we have V P A H | res ≈ l V P B H | res ⇒ V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j
As the protocol ensures (VP), we have that for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l ) we have V P A H | res ≈ l V P B H | res ⇒ V P A ≈ l V P B
Assume we have two instances V P A and V P B as above, and a subset J ⊆ {1, . . . , n} such that ∀j ∈ J :

σ v A j = σ v B j with V P A H | res ≈ l V P B H | res . Then V P A ≈ l V P B. Consider now V P A J | j∈J (V σ id j ) c 1j ,c 2j |V P A By V P A ≈ l V P B we have V P A J | j∈J (V σ id j ) c 1j ,c 2j |V P A ≈ l V P A J | j∈J (V σ id j ) c 1j ,c 2j |V P B

eVoting

As the protocol is modular, we can decompose V P B, and recompose with the corrupted voters to obtain

V P A J | j∈J (V σ id j ) c 1j ,c 2j |V P B ≈ l ν ñ. V σ id 1 σ v A 1 | . . . | j∈J (V σ id j σ v B j )| . . . |V σ idn σ v A n |A 1 | . . . |A l | V P B J | j∈J (V σ id j ) c 1j ,c 2j
Since ∀j ∈ J :

σ v A j = σ v B j we have ν ñ. V σ id 1 σ v A 1 | . . . | j∈J (V σ id j σ v B j )| . . . |V σ idn σ v A n |A 1 | . . . |A l | V P B J | j∈J (V σ id j ) c 1j ,c 2j ≈ l ν ñ. V σ id 1 σ v A 1 | . . . | j∈J (V σ id j σ v A j )| . . . |V σ idn σ v A n |A 1 | . . . |A l | V P B J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P A|V P B J | j∈J (V σ id j ) c 1j ,c 2j Thus V P A J | j∈J (V σ id j ) c 1j ,c 2j |V P A ≈ l V P A|V P B J | j∈J (V σ id j ) c 1j ,c 2j
As the protocol is finite, we can apply Lemma 15 on page 44 to conclude

V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j
As in practical situations voting protocols need to announce the result after a finite amount of time, assuming that they are finite appears to be realistic. The modularity assumption used in the above theorem is also fulfilled by many protocols, as we illustrate now using three case studies. We start with our first case study from Section 3.3.5: the protocol by Fujioka, Okamoto and Ohta.

Theorem 34 The protocol by Fujioka, Okamoto and Ohta ensures Modularity (Mod).

Proof We analyze the structure of the voting processes. We consider the model used in the proof of SwV P I,P O (Theorem 19 on page 71), i.e without any secret channels or keys, and no trusted authorities. All keys are free names. In the case of n voters, we have the form

V 1 | . . . |V n
Hence we can rewrite this instance into n instances containing one voter each:

V 1 | . . . |V n
which is syntactically equivalent.

Remark Note that the voters use synchronization points, and that even after the decomposition the voters in the different instances synchronize. This is necessary, as otherwise the decomposition becomes trivially distinguishable from the initial big instance: for example in one decomposed instance results can be published although not all votes in the other instances have been submitted, which is impossible in the big instance. Intuitively this means that modularity only works for instances sharing the same deadlines.

Remark Note also that in many proofs (e.g. of Theorem 33 on page 129, but also in the following) we replace some instances in the decomposition with bisimilar ones. However we only showed the bisimilarity in a situation where only the processes in this instance had to synchronize, yet now, in this new, bigger context, they also synchronize with other processes in other instances. Although we do not give a full formal proof here, we argue that this is sound, i.e. that the initial composed instance is bisimilar to the one after the replacement. For instances without synchronization we know that such a replacement is correct, as labeled bisimilarity is closed under the application of contexts. When replacing an instance with synchronization within a bigger instance, the only difference to a simple context application is the synchronization. However we can see that the processes in this instance can still only synchronize if all processes in the instances have reached the synchronization point, as now all processes in all instances have to reach the synchronization point. We argue similarly in the case of a k out of n synchronization (e.g. in the case of Bingo Voting below), as at the same time the values k and n are adjusted. In the case of Bingo Voting half of all processes are required for synchronization, this remains true for the replaced instance within the bigger instance as we have a different value for n.

Give the above result, by Theorems 30 on page 124 and 33 on page 129 we have that FOO ensures (VP M C ) as it respects (EQ) (Theorem 27 on page 121), (Mod) (Theorem 34 on the preceding page) and is finite. As a second example we analyze the protocol by Okamoto.

eVoting

Theorem 35 The protocol by Okamoto ensures Modularity (Mod).

Proof We analyze the structure of the voting processes. In the case of n voters, we have the form

νchT.(V 1 | . . . |V n | i=1,...,n processT),
where processT is the process executed by the timeliness member and chT is the private channel between voters and the timeliness member. For k ∈ {1, . . . , n -1}, a possible decomposition would be

νchT.(V 1 | . . . |V k | i=1,...,k processT)|νchT.(V k+1 | . . . |V n | i=k+1,...,n processT),
which would be syntactically equivalent except for the private channel chT, which is now decomposed into two channels. This affects only one transition, namely the communication between the voter11 and the timeliness member when the voter reveals his random value. Consider a communication between a V i and one processT on the left side: This can obviously be matched by the same transition on the right, and vice versa (as the processT are all the same, it is not important which one of them is chosen).

This result generalizes the proof of Theorem 21 on page 80: in the proof we only considered two honest and one corrupted voter. As (Mod) allows us to compose instances, we can add instances with an arbitrary number of honest voters. This formally extends the result to cases with an arbitrary number of voters. Our last example is Bingo Voting.

Theorem 36 Bingo Voting ensures Modularity (Mod).

Proof In the case of n voters, we have the following voting process

νprivChM 1 . . . νprivChM n .νprivChRM 1 . . . νprivChRM n . νprivChR 1 . . . νprivChR n .(V 1 | . . . |V n |M 1,...,n;l |R 1 | . . . |R n ) (3.17)
where R i are the trusted random number generators, M 1,...,n;l is the voting machine process for n voters from 1 to n and l candidates, and privChM i , privChRM i and privChR i are the private channels between the voter and the voting machine, the RNG and the voting machine, and the RNG and the voter respectively. For k ∈ {1, . . . , n -1}, this can be rewritten using Lemma 17 on page 60 as

νprivChM 1 . . . νprivChM k .νprivChRM 1 . . . νprivChRM k . νprivChR 1 . . . νprivChR k .(V 1 | . . . |V k |M 1,...,k;l |R 1 | . . . |R k )| νprivChM k+1 . . . νprivChM n .νprivChRM k+1 . . . νprivChRM n . νprivChR k+1 . . . νprivChR n .(V k+1 | . . . |V n |M k+1,...,n;l |R k+1 | . . . |R n ) (3.18)
as M 1,...,n;l ≈ l M 1,...,k;l |M k+1,...,n;l . This can be seen from the code in the Applied π-Calculus (Listing 3.19 on page 93). Hence (3.17) and (3.18) are bisimilar.

As for the protocol by Okamoto, this generalizes the proof of Theorem 23 on page 94 to an arbitrary number of honest voters.

Multi-Voter Coercion

In this section we define Receipt-Freeness and Coercion-Resistance for weighted votes. We first consider the case where only one voter is coerced, then we define multi-voter coercion, and we also discuss the presence of corrupted voters.

-Single-Voter Receipt-Freeness (SRF)

We combine the approach used in Section 3.3.2 to define Receipt-Freeness with the generalized definition of Privacy for weighted votes (Definition 23 on page 116): If two instances of a voting protocol give the same result, they should be bisimilar even if one voter reveals his secret data in one case or fakes it in the other.

Definition 30 (Single-Voter Receipt Freeness (SRF)) A voting protocol ensures Single-Voter Receipt Freeness (SRF) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any number i ∈ {1, . . . , n} there exists a process V i such that we have

V \out(chc i ,•) i ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇒ V P A {i} (V σ id i σ v A i ) chc i ≈ l V P B {i} V i .
This definition is equivalent to the existing one based on swapping if the protocol ensures (Mod) and (EQ) or (EQA) respectively.

Theorem 37 We have:

-If a protocol respects (EQ) and (Mod), (SwRF O,P O ) and (SRF) are equivalent.

-If a protocol respects (EQA) and (Mod), (SwRF O,F A ) and (SRF) are equivalent.

the swap the vote of the targeted voter i with any other voter's vote. However the other voters in the instance can also swap votes. (SwRF Again, we can include corrupted voter(s) as follows.

Definition 31 (SRF with multiple corrupted voters (SRF M C )) A voting protocol ensures Single-Voter Receipt Freeness with multiple corrupted voters (SRF M C ) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any number i ∈ {1, . . . , n} there exists a process V i such that for any subset J ⊆ {1, . . . , i - Theorem 38 For any X ∈ {12 , SC, M C} we have: If a protocol respects (SRF X ), it also respects (VP X ).

1, i + 1, . . . n}, J = {1, . . . , i -1, i + 1, . . . n} if n > 1, with ∀j ∈ J : σ v A j = σ v B j we have V \out(chc i ,•) i ≈ l V σ id i σ v B i 3. eVoting and V P A H | res ≈ l V P B H | res ⇓ V P A J∪{i} (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J∪{i} V i | j∈J (V σ id j ) c 1j ,
Proof We only show that a protocol ensuring (SRF M C ) also ensures (VP M C ), the other cases follow directly.

We need to show that for any subset J ⊆ {1, . . . , i -1, i + 1, . . . n}, J = {1, . . . , i -1, i + 1, . . . n} if n > 1, such that ∀j ∈ J :

σ v A j = σ v B j we have V P A H | res ≈ l V P B H | res ⇒ V P A J | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J | j∈J (V σ id j ) c 1j ,c 2j
By hypothesis there is a closed plain process so that

V \out(chc i ,•) i ≈ l V σ id i σ v B i (3.19) and V P A H | res ≈ l V P B H | res ⇓ V P A J∪{i} (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J∪{i} V i | j∈J (V σ id j ) c 1j ,c 2j
We suppose V P A H | res ≈ l V P B H | res . Then we can apply the context νchc i .( _ |

Multi-Voter Coercion

!in(chc i , x)) on both sides, which gives

V P A J∪{i} (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j \out(chc i ,•) ≈ l V P B J∪{i} V i | j∈J (V σ id j ) c 1j ,c 2j \out(chc i ,•)
Using Lemma 17 on page 60 we obtain

V P A J∪{i} (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j \out(chc i ,•) ≡ V P A J∪{i} V σ id i σ chc i v A i \out(chc i ,•) | j∈J (V σ id j ) c 1j ,c 2j
and

V P B J∪{i} V i | j∈J (V σ id j ) c 1j ,c 2j \out(chc i ,•) ≡ V P B J∪{i} V \out(chc i ,•) i | j∈J (V σ id j ) c 1j ,c 2j
We can now apply Lemma 16 on page 60, (3.19) and use the fact that labeled bisimilarity is closed under structural equivalence and conclude

V P A J | j∈J (V σ id j ) c 1j ,c 2j = V P A J∪{i} V σ id i σ v A i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B J∪{i} V σ id i σ v B i | j∈J (V σ id j ) c 1j ,c 2j = V P B J | j∈J (V σ id j ) c 1j ,c 2j
We also have the following implications and equivalences.

Theorem 39 We have:

-If a protocol respects (SRF M C ), then it also respects (SRF SC ).

-If a protocol respects (SRF SC ), then it also respects (SRF).

-If a protocol respects (EQ) and (Mod), then (SRF SC ) and SwRF I,P O are equivalent.

-If a protocol respects (EQA) and (Mod), then (SRF SC ) and SwRF I,F A are equivalent.

-If a protocol is modular, finite (i.e. any instance is finite) and respects (SRF), then it also respects (SRF M C ).

eVoting

Proof The first two implications are true by definition: (SRF) is a special case of (SRF SC ) with J = ∅, and (SRF SC ) is a special case of (SRF M C ) with |J| ≤ 1.

We only show that (SRF SC ) and SwRF I,P O are equivalent if (EQ) and (Mod) hold, the other case is similar.

-Suppose a protocol ensuring (SRF SC ). We will now show that the protocol ensures (SwRF I,P O ), i.e. for any voting process V P and for all votes σ v A and σ v B that do not make a voter abstain, there exists a process V i such that

V \out(chc,•) ≈ l V σ id A σ v B and V P {A,B,C} (V σ id A σ v A ) chc |V σ id B σ v B |(V σ id C ) c 1 ,c 2 ≈ l V P {A,B,C} V |V σ id B σ v A |(V σ id C ) c 1 ,c 2 Consider V P A := V P {A,B,C} [V σ id A σ v A |V σ id B σ v B |V σ id C σ v C ] ≈ l V P {A,B,C} [V σ id A σ v B |V σ id B σ v A |V σ id C σ v C ] := V P B
Obviously the votes on both sides are a permutation of each other, thus we we have V P A H | res ≈ l V P B H | res (by (EQ)). We can apply (SRF SC ) to obtain for any i the existence of a process V i such that

V \out(chc i ,•) i ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇓ V P A {i}∪J (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B {i}∪J V i | j∈J (V σ id j ) c 1j ,c 2j ,
We choose i = A and J = {C} and obtain the desired property. Note that again we have to rename the channel.

-Suppose a protocol ensuring (SwRF I,P O ) and we want to show (SRF), i.e. for any voting processes

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any number i ∈ {1, . . . , n} there exists a process V i such that for any subset J ⊆ {1, . . . , i -

1, i + 1, . . . n}, J = {1, . . . , i -1, i + 1, . . . n} if n > 1, such that ∀j ∈ J : σ v A j = σ v B j and |J| ≤ 1 we have V \out(chc i ,•) i ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇓ V P A {i}∪J (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B {i}∪J V i | j∈J (V σ id j ) c 1j ,c 2j , Assume V P A H | res ≈ l V P B H | res .
As the protocol respects (EQ), we know that there exists a permutation π such that ∀i :

σ v A i = σ v B π(i)
. Additionally we know that ∀i ∈ I :

σ v A i = σ v B i
. (SwRF I,P O ) allows us the swap the vote of the targeted voter i with any other voter's vote in presence of a corrupted voter. As (SwRF I,P O ) implies (SwV P I,P O ) (cf. Lemma 18 on page 65), we can also swap the votes of all other voters if necessary (as the protocol is modular), which gives the desired result.

The last claim is a consequence of Theorems 40 and 41 below: Theorem 40 on the following page states that any modular and finite protocol ensuring (SRF) also ensures (MRF) (as defined below), and Theorem 41 on page 142 states that any modular and finite protocol ensuring (MRF) also ensures (MRF M C ), and hence ensures (SRF SC ).

-Multi-Voter Receipt-Freeness (MRF)

We now generalize the idea of Receipt-Freeness to the case where multiple voters are attacked. Instead of only considering one attacked voter i, we consider a set I of attacked voters. To be receipt-free, it should be possible for all attacked voters to fake the receipt. Note that we assume that there is always at least one honest voter, except for the case with only one voter.

Definition 33 (Multi-Voter Receipt Freeness (MRF)) A voting protocol ensures Multi-Voter Receipt Freeness (MRF) if for any voting processes

V P A = ν ñ. (V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ), V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l )
and any subset I ⊆ {1, . . . , n}, I = {1, . . . , n} if n > 1, then there exists processes V i such that we have

∀i ∈ I : V \out(chc i ,•) i ≈ l V σ id i σ v B i 3. eVoting and V P A H | res ≈ l V P B H | res ⇒ V P A I | i∈I (V σ id i σ v A i ) chc i ≈ l V P B I | i∈I V i .
It is clear that (MRF) implies (SRF), and under certain conditions the converse is also true.

Theorem 40 If a protocol is finite and modular (Mod), Single-Voter Receipt Freeness (SRF) and Multi-Voter Receipt Freeness (MRF) are equivalent.

Proof It is easy to see that any protocol ensuring Multi-Voter Receipt Freeness also ensures Single-Voter Receipt Freeness, we simply set I = {i}.

Assume the protocol ensures Single-Voter Receipt Freeness. We want to prove that the protocol ensures Multi-Voter Receipt Freeness, i.e. that for any

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ), V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , n}, I = {1, . . . , n} if n > 1, there exists processes V i such that we have

∀i ∈ I : V \out(chc i ,•) i ≈ l V σ id i σ v B i (3.20) and V P A H | res ≈ l V P B H | res ⇒ V P I | i∈I V σ id i σ chc i v A i ≈ l V P B I | i∈I V i (3.21)
We suppose V P A H | res ≈ l V P B H | res and we show that there exist processes V i such that we have (3.20) and

V P A I | i∈I V σ id i σ chc i v A i | j∈{1,...,|I|-1} V P A ≈ l V P B I | i∈I V i | j∈{1,...,|I|-1} V P B (3.22)
which gives the desired result using the cancellation result from Lemma 15 and (VP). The idea is that adding other voting processes allows us to decompose, mix and compose the processes so that we can apply (SRF) on the individual instances.

We start by decomposing the left side of the bisimilarity and recompose the processes to have |I| instances with single-voter coercion:

V P A I | i∈I V σ id i σ chc i v A i | j∈{1,...,|I|-1} V P A ≈ l | i∈I V P A i {i} V σ id i σ chc i v A i | i ∈I V P A i {i} V σ id i σ v A i | j∈{1,...,|I|-1} | i∈{1,...,n} V P A i {i} V σ id i σ v A i ≈ l | i∈I V P A {i} V σ id i σ chc i v A i (3.23)
In the first step we break the instances down to a single voter each, i.e. V P A i is a voting processes only one voter i. In the next step, we assemble the voters and instances in such a way that we obtain complete instances (i.e. containing voters 1 to n) with one attacked voter per instance.

We apply the same transformations on the right side and obtain:

V P B I | i∈I V i | j∈{1,...,|I|-1} V P B ≈ l | i∈I V P B i {i} [V i ] | i ∈I V P B i {i} V σ id i σ v B i | j∈{1,...,|I|-1} | i∈{1,...,n} V P B i {i} V σ id i σ v B i ≈ l | i∈I V P B {i} [V i ] (3.24)
As we have V P A H | res = V P B H | res , we can apply Single-Voter Receipt Freeness on the left side, i.e. we have for any i ∈ {1, . . . , n} there exists a process

V i such that V \out(chc,•) i ≈ l V σ id i σ v B i (3.25) and V P A I V σ id i σ chc i v A i ≈ l V P B I V i (3.26)
Using this we can rewrite (3.23) in (3.24), and hence prove (3.22).

As above, we can include corrupted voter(s) as follows.

Definition 34 (MRF with multiple corrupted voters (MRF M C )) A voting protocol ensures Multi-Voter Receipt Freeness with multiple corrupted voters (MRF M C ) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , n} there exists processes V i such that for any subset J ⊆ {1, . . . , n}, Again, we have several implications and equivalences.

J ∩ I = ∅, J ∪ I = {1, . . . , n} if n > 1, such that ∀j ∈ J : σ v A j = σ v B j we have V \out(chc i ,•) i ≈ l V σ id i σ v B i 3. eVoting and V P A H | res ≈ l V P B H | res ⇓ V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c
Theorem 41 We have for any X ∈ { , SC, M C}:

-If a protocol respects (MRF M C ), then it also respects (MRF SC ).

-If a protocol respects (MRF SC ), then it also respects (MRF).

-If a protocol respects (MRF X ), then it also respects (SRF X ).

-If a protocol is modular, finite (i.e. any instance is finite) and respects (MRF), then it also respects (MRF M C ).

Proof The first three implications are true by definition: (MRF) is a special case of (MRF SC ) with J = ∅, and (MRF SC ) is a special case of (MRF M C ) with |J| ≤ 1.

Similarly (SRF M C ) is a special case of (MRF M C ), and (SRF SC ) of (MRF SC ), and (SRF) of (MRF), all with I = {i}.

For the last claim, assume we have two instances V P A and V P B, and a subset I ⊆ {1, . . . , n}, and a subset J ⊆ {1, . . . , n}, J

∩ I = ∅, J ∪ I = {1, . . . , n} if n > 1, such that ∀j ∈ J : σ v A j = σ v B j , and V P A H | res ≈ l V P B H | res . Then by (MRF) there exits processes V i such that V \out(chc i ,•) i ≈ l V σ id i σ v B i and V P A I | i∈I (V σ id i σ v A i ) chc i ≈ l V P B I | i∈I V i .

Consider now

V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j |V P A I | i∈I (V σ id i σ v A i ) chc i
By the above we have

V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j |V P A I | i∈I (V σ id i σ v A i ) chc i ≈ l V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j |V P B I | i∈I V i
As the protocol is modular, we can decompose V P B I | i∈I V i , and recompose with the corrupted voters to obtain

V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j |V P B I | i∈I V i ≈ l ν ñ. V σ id 1 σ v A 1 | . . . | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j σ v B j )| . . . |V σ idn σ v A n |A 1 | . . . |A l | V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j Since ∀i ∈ I : σ v A i = σ v B i we have ν ñ. V σ id 1 σ v A 1 | . . . | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j σ v B j )| . . . |V σ idn σ v A n |A 1 | . . . |A l | V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j ≈ l ν ñ. V σ id 1 σ v A 1 | . . . | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j σ v A j )| . . . |V σ idn σ v A n |A 1 | . . . |A l | V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P A I | i∈I (V σ id i σ v A i ) chc i |V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j Thus V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j |V P A I | i∈I (V σ id i σ v A i ) chc i ≈ l V P A I | i∈I (V σ id i σ v A i ) chc i |V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j
As the protocol is finite, we can apply Lemma 15 on page 44 to conclude

V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j

eVoting

The last theorem allows us to show that the protocol by Okamoto is secure against multi-voter coercion, i.e. ensures (MRF M C ).

Lemma 42 The protocol by Okamoto ensures Multi-Voter Receipt Freeness with multiple corrupted voters (MRF M C ).

Proof As shown in Theorems 28 on page 122 and 35 on page 132, the protocol ensures (EQ) and is modular. Using Theorem 39 on page 137 we have that it ensures (SRF SC ) and (SRF). It is easy to see that all instances are finite, hence we have that it ensures (MRF) using Theorem 40 on page 140, and finally that it ensures (MRF M C ) using Theorem 41 on page 142.

Note that we expect this to hold also for a variant of the protocol with weighted votes. Similarly to the variant of FOO we could implement this using multiple ballots, and expect that the resulting protocol ensures (SRF), (MRF), (MRF M C ) and (Mod), but neither (EQ) nor SwRF I,P O as the votes are weighted.

-Single-Voter Coercion (SCR)

After discussing Receipt-Freeness, we now define Coercion-Resistance. As before, we start with Single-Voter Coercion-Resistance.

In this case, we combine (VP) with (SwCR): if two instances of a voting protocol give the same result, they should be bisimilar even if one voter interacts with the attacker in one case or only pretends to do so in the other case. The coercion is modeled by the context C that interacts with the voter and tries to force him to vote for a certain candidate.

Definition 36 (Single-Voter Coercion-Resistance (SCR)) A voting protocol ensures Single-Voter Coercion-Resistance (SCR) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any number i ∈ {1, . . . , n} there exists a process V i such that for any context C i with

C i = νc 1 .νc 2 .(_|P i ) and ñ ∩ f n(C) = ∅, V P A {i} C i (V σ id i σ v A i ) c 1 ,c 2 ≈ l V P A {i} (V σ id i σ v A i ) chc i we have C i V i \out(chc i ,•) ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇒ V P A {i} C i (V σ id i σ v A i ) c 1 ,c 2 ≈ l V P B {i} C i V i
As above, we can link this definition to the swap-based definition using (Mod), (EQ) and (EQA).

Theorem 43

We have -If a protocol respects (EQ) and (Mod), (SCR) and (SwCR O,P O ) are equivalent.

-If a protocol respects (EQA) and (Mod), (SCR) and (SwCR O,F A ) are equivalent.

Proof Analogous to the proof of Theorem 37 on page 133.

Similarly, we can also consider corrupted voters.

Definition 37 (SCR with multiple corrupted voters (SCR M C )) A voting protocol ensures Single-Voter Coercion-Resistance with multiple corrupted voters (SCR M C ) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any number i ∈ {1, . . . , n} there exists a process V i such that for any context C i with C i = νc 1 .νc 2 .(_|P i ) and ñ ∩ f n(C) = ∅ and for any subset Again, we have the same equivalencies.

J ⊆ {1, . . . , i -1, i + 1, . . . n}, J = {1, . . . , i -1, i + 1, . . . n} if n > 1, such that ∀j ∈ J : σ v A j = σ v B j and V P A {i}∪J C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P A {i}∪J (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j we have C i V i \out(chc i ,•) ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇓ V P A {i}∪J C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B {i}∪J C i [V i ] | j∈J (V σ id j ) c 1j ,

eVoting

Theorem 44 We have:

-If a protocol respects (SCR M C ), then it also respects (SCR SC ).

-If a protocol respects (SCR SC ), then it also respects (SCR).

-If a protocol respects (EQ) and (Mod), then (SCR SC ) and (SwCR I,P O ) are equivalent.

-If a protocol respects (EQA) and (Mod), then (SCR SC ) and (SwCR I,F A ) are equivalent.

-If a protocol is modular, finite (i.e. any instance is finite) and respects (SCR), then it also respects (SCR M C ).

Proof The first two implications are true by definition: (SCR) is a special case of (SCR SC ) with J = ∅, and (SCR SC ) is a special case of (SCR M C ) with |J| ≤ 1.

The other proofs are analogous to the proof of Theorem 39 on page 137.

-Multi-Voter Coercion (MCR)

We now discuss Multi-Voter Coercion-Resistance. To model the case where multiple voters are attacked, we consider the set I of attacked voters.

Definition 39 (Multi-Voter Coercion-Resistance (MCR)) A voting protocol ensures Multi-Voter Coercion-Resistance (MCR) if for any voting processes

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , n}, I = {1, . . . , n} if n > 1, there exists processes V i such that for any contexts

C i = νc 1 .νc 2 .(_|P i ), i ∈ I and ñ ∩ f n(C) = ∅ and V P A I | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 ≈ l V P A I | i∈I (V σ id i σ v A i ) chc i we have ∀i ∈ I : C i V i \out(chc i ,•) ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇓ V P A I | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 ≈ l V P B I | i∈I C i [V i ] ,
To consider corrupted voters, we propose the following definitions.

Definition 40 (MCR with multiple corrupted voters (MCR M C )) A voting protocol ensures Multi-Voter Coercion-Resistance with multiple corrupted voters (MCR M C ) if for any two instances

V P A = ν ñ.(V σ id 1 σ v A 1 | . . . | V σ idn σ v A n | A 1 | . . . | A l ) and V P B = ν ñ.(V σ id 1 σ v B 1 | . . . | V σ idn σ v B n | A 1 | . . . | A l )
and any subset I ⊆ {1, . . . , n} there exists processes V i such that for any contexts C i , i ∈ I with C i = νc 1 .νc 2 .(_|P i ) and ñ ∩ f n(C) = ∅ and for any subset J ⊆ {1, . . . , n}, J ∩ I = ∅, J ∪ I = {1, . . . , n} if n > 1, such that ∀j ∈ J :

σ v A j = σ v B j
, and Again, we have several implications and equivalences.

V P A I∪J | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j we have ∀i ∈ I : C i V i \out(chc i ,•) ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇓ V P A I∪J | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I C i [V i ] | j∈J (V σ id j ) c 1j ,c 2j

Theorem 45 We have for any X ∈ { , SC, M C}:

-If a protocol respects (MCR X ), then it also respects (SCR X ).

-If a protocol respects (MCR M C ), then it also respects (MCR SC ).

-If a protocol respects (MCR SC ), then it also respects (MCR).

-If a protocol respects (SCR X ), it also respects (SRF X ).

-If a protocol respects (MCR X ), it also respects (MRF X ).

Proof The first three implications are direct consequences of the definitions. Then we only consider the case (MCR M C ) implies (MRF M C ), the other follow directly.

The proof is similar to the proof of SwCR Attacker,Abs implies SwRF Attacker,Abs in Lemma 18 on page 65. Assume the protocol ensures (MCR M C ). Let C i be 3. eVoting evaluation contexts such that C i = νc 1 .νc 2 .(_|P i ) for some plain processes P i which fulfill

V P A I∪J | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j (3.27)
Note that these C i can be constructed directly from the vote process V . By hypothesis we know that there are closed plain process V i such that ∀i ∈ I :

C i V i \out(chc i ,•) ≈ l V σ id i σ v B i and V P A H | res ≈ l V P B H | res ⇓ V P A I∪J | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I C i [V i ] | j∈J (V σ id j ) c 1j ,c 2j (3.28)
We have to find other processes V i such that

∀i ∈ I : V \out(chc i ,•) i ≈ l V σ id i σ v B i (3.29) and V P A H | res ≈ l V P B H | res ⇓ V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I V i | j∈J (V σ id j ) c 1j ,c 2j (3.30) Let V i = C i [V i ].
This directly fulfills the first requirement (Equation (3.29)). For the second equation (3.30), we suppose V P A H | res ≈ l V P B H | res . We can then use the condition on C i (Equation (3.27)) and obtain

V P A I∪J | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j

Conclusion

The second hypothesis (Equation (3.28)) gives

V P A I∪J | i∈I C i (V σ id i σ v A i ) c 1 ,c 2 | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I C i V i | j∈J (V σ id j ) c 1j ,c 2j
As labeled bisimilarity is transitive, we can conclude

V P A I∪J | i∈I (V σ id i σ v A i ) chc i | j∈J (V σ id j ) c 1j ,c 2j ≈ l V P B I∪J | i∈I C i V i | j∈J (V σ id j ) c 1j ,c 2j
which gives us the desired result for

V i = C i [V i ].
Finally we also have equivalence between (SCR) and (MCR) as well as (MCR) and (MCR M C ) under the same assumptions as in the case of Receipt-Freeness using a similar proof.

Theorem 46 We have:

-If a protocol is modular, finite and respects (SCR), it also ensures (MCR).

-If a protocol is modular, finite and respects (MCR), then it also respects (MCR M C ).

Proof Analogous to the proofs of Theorem 40 on page 140 and Theorem 41 on page 142.

The last theorem allows us to show that Bingo Voting is secure against multi-voter coercion, i.e. ensures (MCR M C ).

Lemma 47 Bingo Voting ensures Multi-Voter Coercion-Resistance with multiple corrupted voters (MCR M C ).

Proof As shown in Theorem 23 on page 94, the protocol ensures SwCR I,F A . In Theorems 29 on page 123 and 36 on page 132 we showed that it ensures (EQA) and (Mod). Using Theorem 44 on page 146 we have that it ensures (SCR SC ) and (SCR). It is easy to see that all instances are finite, thus we have that it ensures (MCR) and (MCR M C ) using Theorem 46.

Conclusion

In this chapter we proposed a taxonomy of privacy notions for eVoting protocols. We started by extending the notions originally proposed by Delaune et al. [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF] 3. eVoting

VP VP SC VP M C SRF SRF SC SRF M C MRF MRF SC MRF M C SCR SCR SC SCR M C MCR MCR SC MCR M C Mod, Fin Mod, Fin Mod, Fin
Mod, Fin Mod, Fin

eVoting

to cover corrupted voters and forced abstention attacks. We applied the resulting notions on several case studies: the protocols by Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], the protocol by Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF], the protocol by Lee et al. [LBD + 03] and Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF]. The results are summed up in and Table 3.1 on page 114, the position of the case studies within our hierarchy is shown in Figure 3.1 on page 69.

As it turns out, these notions based on swapping votes are unsuitable for cases where votes are weighted. To address this issue we generalized the privacy notions to cover weighted votes, multiple corrupted and multiple coerced voters. Figure 3.2 on page 150 sums up the resulting notions and their relationships. We discussed a variant of the protocol by Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF] as a first case study. We also showed that under certain assumptions -a finite protocol and modularity -, multi-voter coercion and single-voter coercion are equivalent. This allows to prove security against multi-voter coercion by simply checking for finiteness and modularity, which are often simpler to prove than the entire property. Similarly, we were able to show that a finite protocol ensuring modularity is also secure against inside attackers: the cases with and without corrupted voters coincide. To show that this assumption is realistic, we showed that the protocol by Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], the protocol by Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF] and Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF] fulfill this property, and hence ensure Vote-Privacy with multiple corrupted voters, Multi-Voter Receipt Freeness with multiple corrupted voters and Multi-Voter Coercion-Resistance with multiple corrupted voters, respectively.

We also analyzed the link between these notions and the previous taxonomy. We were able to identify precise conditions: Equality of Votes and Equality of Abstention model the fact that votes are not weighted and that additionally abstaining voters remain anonymous, respectively. This allows to prove that some swap-based and some generalized privacy notions coincide for protocols ensuring one of the two properties. For Receipt-Freeness and Coercion-Resistance we also need Modularity as the generalized notions are slightly more powerful. The links between both taxonomies are summed up in Figure 3.3 on the previous page. The notions appearing in both Figures 3.2 on page 150 and 3.3 on the previous page are marked in bold, allowing to connect the two figures.

As future work, we would like to verify more properties automatically as manual proofs are often cumbersome and tend to be error-prone. One of the main problems here are the equational theories which become too complex for ProVerif to handle. There is some first work on replacing such theories with simpler, but equivalent ones [START_REF] Smyth | Translating between equational theories for automated reasoning[END_REF], which could help in dealing with more complex theories automatically. Moreover, KISS [START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF] and AKISS [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] can deal with more complex equational theories, which could help us in verifying more properties automatically.

We would also like give the full formal proof that we can replace a process P synchronizing with other processes within a context C[_], with a bisimilar (modulo the synchronization) processes P ≈ l P , i.e. that we have C

[P ] ≈ l C[P ].
Additionally the approach in this chapter is possibilistic: We call a protocol secure if there is a way for the targeted voter to escape coercion. As we are in a symbolic model, we do not consider probabilities. Hence the adversary may in reality still have a certain probability of detecting that the coerced voter tried to resist coercion. This is beyond the scope of this work, yet a computational translation of our definitions should be able take this into account. There already is some work in the computational model in this direction [START_REF] Küsters | A game-based definition of coercion-resistance and its applications[END_REF], yet they do not consider all different dimensions of our taxonomy.

Introduction

Auctions are a simple method to sell goods and services. Typically a seller offers a good or a service, and the bidders make offers. Depending on the type of auction, the offers might be sent using sealed envelopes which are opened at the same time to determine the winner (the "sealed-bid" auction, e.g. [Cac99, NPS99, AS02, CLK03, LAN02, BCD + 09]), or an auctioneer could announce prices decreasingly until one bidder is willing to pay the announced price (the "dutch auction", e.g. [START_REF] Rockoff | Design of an internet-based system for remote dutch auctions[END_REF]). There might be several rounds, or offers might be announced publicly directly (the "English" or "shout-out" auction, e.g. [OM01]). The winner usually is the bidder submitting the highest bid, but in some cases he might only have to pay the second highest offer as a price (the "second-price"or "Vickrey"-Auction, e.g. [START_REF] Michael Harkavy | Electronic auctions with private bids[END_REF][START_REF] Helger Lipmaa | Secure vickrey auctions without threshold trust[END_REF]). In general a bidder wants to win the auction at the lowest possible price, and the seller wants to sell his good at the highest possible price. For more information on different auction methods see e.g. [START_REF] Krishna | Auction Theory[END_REF].

Due to the competitive nature of the auction process, security is a major concern to prohibit cheating and manipulations of the prices. As frauds are common in eAuctions [NTJ13], different security properties have been discussed in the literature. We study1 the following security properties of auction protocols:

-Fairness: Firstly a fair (sealed-bid) auction protocol should not leak any information about the other participants and their offers until the bidding phase is over (so as to prohibit unfair tactics based on leaked information). We call this Weak or Strong Noninterference, depending on if the number of bidders is leaked or not. Thirdly a protocol should not allow anybody to win although they did not submit the highest price, i.e. ensure that the Highest Price Wins. Otherwise a losing bidder could try to cheat to win.

-Authentication: For the seller it is crucial to ensure Non-Repudiation, i.e. that -after the winner has been announced -the winning bidder cannot claim that he did not submit the winning bid. Additionally we might want to ensure Non-Cancellation, i.e. that a bidder cannot cancel a submitted offer before the winner is announced, to have binding bids.

-Privacy: Privacy is important in sealed-bid auctions to prevent information leakage after the auction is over, for example if an auction is organized in several rounds, or if the bids leak sensitive information e.g. to competitors or clients [BCD + 09]. Again, we distinguish several different notions: Secrecy of Bids, Bidding-Price Unlinkability, Weak Anonymity and Strong Anonymity (of Bidders), Receipt-Freeness and Coercion-Resistance. Secrecy of Bids guarantees that the losing bids remain secret. In the case of Bidding-Price Unlinkability the list of bids can be public, but must not be linkable to the losing bidders. Strong Anonymity of Bidders means that the participants, including the winner, remain anonymous, and all losing bids remain secret. In the case of Weak Anonymity the list of bids can be public, but the bids are not linkable to the bidders, including the winner, who remains anonymous. Receipt-Freeness ensures that bidders are unable to prove to an attacker (which might be another bidder trying to force them to submit a low bid so that he wins at a lower price) that they bid a certain offer, and Coercion-Resistance means that even when interacting with a coercer, the bidders can still bid a price of their choice.

-Verifiability: A verifiable protocol should allow the bidders to verify that the winner was correctly determined, and that no bids were manipulated or submitted by uneligible bidders. This allows to back up trust in the auctioneer or other authorities, since they often also have a financial interest in the auction. For example in the case of eBay the auction fees include a proportion of the selling price [START_REF]Standard selling fees[END_REF].

Note that depending on the type of auction, some properties might be different or unachievable. For sealed-bid first-price auctions, the most common type of protocols in the literature, all of the above are suitable. However for example Secrecy of Bids is difficult to ensure in an English Auction where bids are announced publicly, but anonymity might still be achievable.

-Contributions

In this chapter we provide the following contributions:

-In the first part we give a formal framework in the Applied π-Calculus to model and analyze e-Auction protocols. Within this framework we define the discussed fairness, privacy and authentication properties and analyze their relationship.

-We provide three case studies: The protocol by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], a protocol by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and the protocol by Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. We show how the three can be modeled in the Applied π-Calculus and verified using ProVerif [START_REF] Blanchet | An Efficient Cryptographic Protocol Verifier Based on Prolog Rules[END_REF].

We discover several flaws on the first two protocols and explain how some of their shortcomings can be addressed. We also show that the protocol by Sako ensures all our properties except for receipt-freeness and coercion-resistance.

-In the second part, we give a high-level definition of Verifiability in eAuctions based on an abstract protocol level. We show how this definition can be generalized to accommodate different types of auctions.

-We apply this definition on the protocols by Sako and Curtis et al.. Again, we rely on ProVerif to execute the Verification. For the protocol by Sako, we also provide a computational proof in CryptoVerif [START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF].

-Finally we provide two examples of "true bidder-verifiable" sealed-bid auction protocols. Although these protocols have their limitations with respect to scalability, they illustrate two simple ways of achieving secure and verifiable auctions by exploiting physical properties of physical objects instead of cryptography. We also discuss how we can apply the previous formal models to verify these "physical" protocols.

-Outline of the Chapter

In Section 4. ). In the final part we propose two "true bidder-verifiable" protocols in Sections 4.5.1 and 4.5.2 and discuss their formal analysis. We then conclude in Section 4.6.

Related Work

In this section we discuss related work on auction protocols, the different security properties, previous work on formal verification of auction protocols, the link to other applications such as eVoting (in particular for privacy and verifiability) or contract-signing, and work on modeling physical properties for security and protocols. Still, all definitions given in these papers are informal.

Auction

Formal Verification of Auction Protocols. Although there has been much work on developing auction protocols ensuring various properties, there is considerably less work on their formal definition and analysis. Subramanian [START_REF] Subramanian | Design and verification of a secure electronic auction protocol[END_REF] proposed an auction protocol and analyzed it using a BAN-style logic to show some security properties. In particular he showed the atomicity of the transaction, weak secrecy of private keys and a form of anonymity modeled as weak secrecy of the public key of the bidder. Using OFMC, Księżopolski and Lafourcade [START_REF] Księżopolski | Attack and revision of electronic auction protocol using ofmc[END_REF] identified an attack on authentication in an auction protocol. More recently Dong et al. [START_REF] Dong | Analysis of a receiptfree auction protocol in the applied pi calculus[END_REF] analyzed a receipt-free auction protocol in the Applied π-Calculus. They only considered privacy, in particular secrecy of the bidding price and receipt-freeness, but only for losing bidders.

Link to other Applications. In the context of electronic voting there has been much more work on formal verification, in particular in the area of privacy as discussed in Section 3.2. Some notions are similar, yet there are also some differences to auctions. For example the information leaked by the result in both cases is usually not the same: typically in voting the published result is the sum of all votes (although there are more complex ways of computing the tally), whereas in auctions the public outcome is in most cases the winning bidder and price.

Often the losing bids remain private, and in some cases even the winner stays anonymous, e.g. the well known "bidder on the phone". Although normally at least the winning price is public, there is the protocol by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] where only the winner and the seller learn the winner and the winning price, but to the best of our knowledge, this is the only protocol aiming for such a high level of privacy.

Concerning Verifiability there is a considerable amount of work in voting. The property of individual verifiability -a voter can verify that her vote counts correctly for the result -has been a well-established notion since the field's inception [FOO92, BT94, SK95, HS00]. Similarly the concept of universal verifiability -the property that all voters or even an outside an observer may verify (using only public information) the correctness of the tally -has also been discussed for a long time [CF85, BT94, SK95, Ben96]. Kremer et al. [START_REF] Kremer | Election verifiability in electronic voting protocols[END_REF] formalized individual and universal verifiability in the Applied π-Calculus, and added the notion of eligibility verifiability: the property whereby any observer may verify, using only public information, that the set of cast votes from which the result is determined, originates only from eligible voters, and each eligible voter cast at most one vote. Smyth et al. [START_REF] Smyth | Towards automatic analysis of election verifiability properties[END_REF] used ProVerif to automatically check Verifiability of voting protocols. They express the conditions in the definitions as reachability properties, which can be checked by ProVerif. In some of our case studies on the Verifiability of eAuction protocols we also use the Applied π-Calculus and employ a similar technique in ProVerif, but our model and definitions are more general and can also be instantiated using a computational model. Moreover, Küsters et al. [START_REF] Küsters | Accountability: definition and relationship to verifiability[END_REF] introduced the notion of accountability: when verifiability of a certain goal fails, it is possible to identify the party responsible for the failure. They also give symbolic and computational definitions of verifiability, which they identify as a weaker variant of accountability. As a case study, they apply their definitions on Bingo Voting. Although they also consider an auction protocol as a second case study, the verifiability goals used do not cover all verifications required by our definition. Finally, Guts et al [START_REF] Guts | Reliable evidence: Auditability by typing[END_REF] defined auditability, i.e. the fact that a protocol logs sufficient evidence to convince an impartial judge that certain properties are satisfied. In our definition of verifiability the protocol only needs to convince the participants that the protocol execution was correct, but not necessary an outside judge. Moreover, Guts et al. verify auditability using static typing on the concrete protocol implementation, whereas our definition of verifiability leaves open the choice of the concrete method of verifying the definition.

While the intuition behind the notions from voting carries (to some degree) over to auctions, we note that auctions can be much more competitive as the bidders are pressed for time, for example in the case of an English auction. This can be exploited by an attacker: for example an illegal bid (e.g., by an unregistered bidder) may increase the winning price by forcing the honest bidders to increase their offer, while finally not changing the winner. Hence, a lack of verifiability (which would allow the honest bidders to identify the incorrect bid) can compromise fairness. In addition, winner and price determination can be quite complex depending on the type of auction, e.g. for second-price or multi-good auctions2 . Thus, although providing important inspiration, verification of voting systems does not translate directly to verification of auction systems.

There has been a lot of work on Non-Repudiation in the context of contract signing and fair exchange protocols (e.g. [KR03, KV09, LV10]). We rely on the work by Klay et al. [START_REF] Klay | Automatic methods for analyzing non-repudiation protocols with an active intruder[END_REF] who propose many different flavors of non-repudiation based on agent knowledge or authentication. We only consider "Non-Repudiation of Origin", i.e. that the bidder cannot deny that he made an offer, implemented as a form of authentication.

Modeling Physical Properties. In the last part of this chapter, we also discuss the formal analysis of protocol relying on physical objects. Several such protocols were developed for various purposes, e.g. [CK94, FNW96, NP97, Cha04]. Blaze [Bla03,[START_REF] Blaze | Safecracking for the computer scientist[END_REF] analyzed physical locks from a cryptographic point of view, and argued that physical security should be taken into account in security modeling [START_REF] Blaze | Towards a broader view of security protocols[END_REF]. Other work in this area focused on modeling physical security in various ways. The Portunes framework by Dimkov et al. [START_REF] Dimkov | Portunes: Representing attack scenarios spanning through the physical, digital and social domain[END_REF] allows modeling of attacks that cross physical, digital and social domains. They focus on access control and data breaches. Moran and Naor [MN05, MN06a] proposed several protocols using physical objects, including a "human-centric" polling protocol based on physical envelopes, and also discussed their formal analysis in the UC-framework. Recently Meadows et al. [START_REF] Meadows | Formalizing physical security procedures[END_REF] describe a way to formalize security procedures (accounting for physical objects) in logic, however again their work is more concerned about the movement of physical objects, rather than the properties of the objects itself. Basin et al. [START_REF] Basin | Formal Reasoning about Physical Properties of Security Protocols[END_REF] proposed a formal model to verify protocols based on physical attributes such as time and location. Their model includes the constraints of these physical domains in their reasoning, however does not express properties of physical objects that can be manipulated by the participants.

Fairness, Authentication and Privacy in Auctions

In this section, we describe our model of auction protocols in the Applied π-Calculus and propose definitions for multiple properties related to fairness, authentication and privacy. We also discuss our three case studies: The protocols by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF], Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF] and Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF].

-Modeling Auction Protocols

Similar to voting protocols, we model auction protocols in the Applied π-Calculus as follows.

Definition 42 (Auction Protocol) An auction protocol is defined by a tuple (B, S, A 1 , . . . , A m , m) where B is the process executed by the bidders, S is the process executed by the seller, and the A j 's are the processes executed by the authorities (for example an auctioneer, a registrar etc.), and m is a set of private channels. We also assume the existence of a particular public channel res that is only used to publish the winning bid or bidder.

Note that we have only one process for the bidders. This means that different bidders will execute the same process, but with different variable values (e.g. the keys, the bids etc.). To reason about privacy, we talk about instances of an auction protocol, which we call auction processes.

Definition 43 (Auction Process) An instance of an auction protocol (B, S, A 1 , . . ., A m , m) is called an auction process, which is a closed process

ν ñ.(Bσ id 1 σ b 1 | . . . |Bσ id k σ b k |S|A 1 | . . . |A l ),
where l ≤ m, ñ includes the secret channel names m, Bσ id i σ b i are the processes executed by the k bidders, σ id i is a substitution assigning the identity to the i-th bidder, σ b i specifies the i-th bid and A j 's are the auction authorities which are required to be honest.

The restricted channel names model private channels or secret keys. Note that we only model the honest authorities as unspecified parties are subsumed by the attacker.

By abuse of notation we write b l > b o to express that the bidding price determined by the substitution σ b l is greater than the one assigned by σ bo , and max i {b i } denotes the maximal price assigned by any substitution σ b i . We also denote by arg max i {b i } the set of values i for which b i corresponds to the maximal price.

Example 20 Consider the following simple auction protocol.

Informal description: Each bidder encrypts his bid using the auctioneer's public key and signs it using his secret key. The resulting bid is posted on the bulletin board. After the deadline is over, the auctioneer checks if each ballot is signed by an eligible bidder. He then decrypts the bids and determines the winner.

Formal description in our model: The protocol uses probabilistic public-key encryption and signatures, which we model using the following equational theory already used in Example 12 on page 55:

dec(enc(m, pk(sk), r), sk) = m checksign(sign(m, sk), pk(sk)) = m
The protocol is then a tuple (B, S, A, ∅) where A = in(ch, (sig 1 , bid 1 )). . . . in(ch, (sig n , bid n )). if checksign(sig, pka) = (price, id) then . . . In this example the substitution determining the identity of a bidder assigns the secret key, e.g. σ id k = { sk k/skb}. The substitution specifying the bid would be e.g.

if checksign(sig 1 , pkb 1 ) = bid 1 && . . . && checksign(sig n , pkb n ) = bid n then let b 1 = dec(bid 1 , ska) in . . . let b n = dec(bid n , ska) in if max(b 1 , . . . , b n ) = b 1 then out(res, (sign((b 1 , 1), ska), (b 1 , 1))) else if . . .
σ b k = { price k/b}.
Similarly to voting, we also define Honest Auction Processes, and (Honest) Auction Contexts.

Definition 44 (Honest Auction Process) An Honest Auction Process of an auction protocol (B, S, A

1 , . . ., A m , m) is a closed plain process ν ñ.(Bσ id 1 σ b 1 | . . . |Bσ id k σ b k |S|A 1 | . . . |A m )
where ñ includes the secret channel names m, Bσ id i σ b i are the processes executed by the k bidders, σ id i is a substitution assigning the identity to the i-th bidder, σ b i specifies the i-th bid and A j 's are the auction authorities.

Given an auction process

AP = ν ñ.(Bσ id 1 σ b 1 | . . . |Bσ id k σ b k |S|A 1 | . . . |A l )
we denote by AP H the corresponding honest auction process, i.e.

AP H = ν ñ.(Bσ id 1 σ b 1 | . . . |Bσ id k σ b k |S|A 1 | . . . |A m )

Definition 45 ((Honest) Auction Context) Given an auction process

AP = ν ñ.(Bσ id 1 σ b 1 | . . . |Bσ id k σ b k |S|A 1 | . . . |A l )
and a subset of bidders I we define the Auction Context AP I [_] as follows:

AP I [_] = ν ñ.( | i / ∈I Bσ id i σ b i |_|S|A 1 | . . . |A l )
Similarly for an honest auction process

AP H = ν ñ.(Bσ id 1 σ b 1 | . . . |Bσ id k σ b k |S|A 1 | . . . |A m )
and a subset of bidders I we define the Honest Auction Context AP H I [_] as follows:

AP H I [_] = ν ñ.( | i / ∈I Bσ id i σ b i |_|S|A 1 | . . . |A m )
Example 21 An instance of our simple auction protocol (Example 20 on page 163) with two bidders A and B looks as follows:

AP = νsk A .νsk B .νsk Ad .(S { pk(sk Ad ) /pka} |B { sk A/skv, pk(sk Ad ) /pka} { price A/b} | B { sk B/skv, pk(sk Ad ) /pka} { price B/b} |A { sk Ad/ska, pk(sk A ) /pkb 1 , pk(sk B ) /pkb 2 })
The corresponding auction context AP {B} then looks as follows:

AP {B} = νsk A .νsk B .νsk Ad .(S { pk(sk Ad ) /pka} |B { sk A/skv, pk(sk Ad ) /pka} { price A/b}
|_|A { sk Ad/ska, pk(sk A ) /pkb 1 , pk(sk B ) /pkb 2 })

Note that as this protocol assumes an honest auctioneer, the honest auction process AP H and the "normal" auction process AP , as well as the honest auction context AP H I [_] and the "normal" auction context AP I [_] coincide.

In order to reason about reachability and authentication properties we use events.

Events are annotations marking important steps in the protocol execution, but otherwise do not influence the behavior of processes. They allow us to verify properties such as "event bad is unreachable" or "on every trace event a is preceded by event b".

We use the same technique as in [ABF07, SRKK10]: Events are outputs out(e, (M 1 , . . . , M n )) on a special "event" channel e ∈ E, where E is the set of event channels, disjoint of the set of "ordinary" channels. To ensure that the adversary cannot obtain additional knowledge from the events or create events himself, we only consider traces respecting the following conditions when reasoning about processes containing events:

-Event names occur only in outputs; they are neither communicated nor used for inputs in processes and in transitions.

-Names and variables extruded in events do not appear in inputs unless they have also been sent on other output channels.

In accordance with the syntax used by ProVerif, we also write event e(M 1 , . . . , M n ) instead of out(e, (M 1 , . . . , M n )), where e is the name of the event (channel), and the terms M 1 , . . . , M n are parameters.

For auction protocols we use the following events:

bid(p,id): When a bidder id bids the price p the event bid(p,id) is emitted.

-recBid(p,id): When a bid at price p by bidder id is recorded by the auctioneer/bulletin board/etc. the event recBid(p,id) is called. This is used to model Non-Cancellation, i.e. from this point on a bid is considered binding.

won(p,id): When a bidder id wins the auction at price p, the event won(p,id) is emitted.

-Fairness Properties

A fair auction protocol should not leak any information about any participant until the bidding phase is over and the winning bid is announced, and hence some information is inevitably leaked. We propose the following two definitions:

Definition 46 (Strong Noninterference (SN)) An auction protocol ensures

Strong Noninterference (SN) if for any two auction processes AP A and AP B that halt at the end of the bidding phase (i.e. where we remove all code after the last recBid event) we have

AP A ≈ l AP B.
This notion is very strong: Any two instances, independently of the participants and their offers, are required to be bisimilar until the end of the bidding phase. This would also require two instances with a different number of participants to be bisimilar, which will probably not hold on many protocols. A more realistic notion is the following:

Definition 47 (Weak Noninterference (WN)) An auction protocol ensures Weak Noninterference (WN) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l
) that halt at the end of the bidding phase (i.e. where we remove all code after the last recBid event) we have

AP A ≈ l AP B.
This only requires any two instances with the same participants Bσ id i to be bisimilar, however bids may still change. It is easy to see that (SN) implies (WN).

Theorem 48 An auction protocol ensuring Strong Noninterference (SN) also ensures Weak Noninterference (WN).

Proof We have to show that for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l
) that halt at the end of the bidding phase (i.e. where we remove all code after the last recBid event) we have AP A ≈ l AP B. By (SN) we have that for any two auction processes AP A and AP B that halt at the end of the bidding phase (i.e. where we remove all code after the last recBid event) we have AP A ≈ l AP B, hence we can conclude directly.

However the above two notions only capture that no information is leaked, however we also want to ensure that the bidders cannot cheat. The following property models that there should be no way for a malicious participant to cheat and win the auction at a chosen price, independently of the other (higher) bids.

Definition 48 (Highest Price Wins (HPW)) An electronic auction protocol ensures Highest Price Wins (HPW) if for any auction process AP we have for

AP {A,B} [ Bσ id A σ b A | (Bσ id B σ b B ) c 1 ,c 2 ]
where b A is the highest bid, there is no trace containing the event won for bidder id B with a lower bid.

The idea is the following: We have an honest bidder Bσ id A who submits the highest bid. The attacker has completely corrupted another bidder Bσ id B and should be unable to win the auction on his behalf using a lower bid. Note that these definitions can be applied independently of trust assumptions, and that different assumptions can lead to different results: For example, a protocol might ensure (HPW) if the auctioneer is trusted, but not otherwise.

-Authentication Properties

The first authentication property we want to define is Non-Repudiation, i.e. thatonce the winner has been announced -a winning bidder cannot claim that the winning bid was not sent by him. As discussed in [START_REF] Klay | Automatic methods for analyzing non-repudiation protocols with an active intruder[END_REF], Non-Repudiation can be expressed as form of authentication.

Definition 49 (Non-Repudiation) An auction protocol ensures the property of Non-Repudiation (NR) if for every auction process AP on every possible execution trace the event won(p,id) is preceded by a corresponding event bid(p,id).

The intuition is simple: If there was a trace on which a bidder would win without submitting the winning bid, he could try to claim that he did not submit the winning bid even in a case where he rightfully won.

Note two subtleties with this definition: Firstly, since only honest parties are explicitly modeled, it is clear that only honest parties can emit events. Hence one could think that our definition implicitly assumes some parties to be honesthowever, this is not the case: If we do not trust the party that would normally emit for example the event won, we can simply remove this party from the model and replace it with a new party that receives the parameters on a special channel, and then emits the event using these parameters. This gives the adversary total control about the events, as it would be the case for a distrusted authority 3 . Secondly, if the protocol supports multiple auctions in parallel, we need to use auction-dependent identifiers for the bidders in our events. This is to ensure that the protocol only accepts bids that were submitted to the same auction, and that an attacker cannot submit a bid from a different auction.

The second authentication property we model is Non-Cancellation, i.e. that a bidder cannot cancel a submitted bid before the winner is announced.

Definition 50 (Non-Cancellation) An auction protocol ensures the property of Non-Cancellation (NC) if given any auction process AP for the corresponding process AP {i} (Bσ id i σ b i ) chc , i.e. containing a bidder i which -reveals his secret data on channel chc (see Def. 18 on page 59), and which -submits the highest bid, i.e. ∀j = i : b i > b j , there is no trace containing the events recBid(b i , id i ) and won(b w , id w ) for another, lower bid, i.e. b w < b i .

The idea is the following: The bidder id i submits the highest bid, so he should win. If however there is the possibility that even though his bid was correctly received he did not win, this would mean that the intruder was able to cancel the bidder's bid even after reception. We require the bidder to reveal all his secret data to the intruder to capture the fact that the bidder himself might want to cancel his offer, in which case he could use his private data (keys etc.) to do so.

Note that technically we only defined Non-Cancellation for the winning bidder. This is sufficient since in a first-price auction the other bids do not influence the outcome. Additionally it can be generalized to other auction types by simply requiring that the winning price must be correct on all traces. This is to ensure that no other bids that influence the result can be canceled.

Both properties are independent: A protocol may implement the cancellation of bids as an official feature. For example after all bids have been submitted, bidders could be allowed to cancel their bids for a certain period of time, before the winner is finally announced. At the same time, such a protocol may ensure non-repudiation of the winner using e.g. signatures. Similarly a protocol may ensure Non-Cancellation but no Non-Repudiation if the submitted bids cannot be BPU WA SA SBPS [START_REF] Dong | Analysis of a receiptfree auction protocol in the applied pi calculus[END_REF] P canceled, but are not authenticated, so that the announced winner can successfully claim not having submitted the winning bid. Again, a protocol might ensure Non-Cancellation or Non-Repudiation for a certain trust setting, but not for another.

SRF[DJP11] FPSBA RF-U RF-WA RF-SA RF-BPS RF FPSBA CR-U CR-WA CR-SA CR-BPS CR FPSBA

BPU-C

WA-C SA-C SBPS-C P-C FPSBA RF-U-C RF-WA-C RF-SA-C RF-BPS-C RF-C FPSBA CR-U-C CR-WA-C CR-SA-C CR-BPS-C CR-C FPSBA

-Privacy Properties

We consider Privacy, Receipt-Freeness and Coercion-Resistance, and at each level two independent axes: -the losing bids may stay completely private (Strong Bidding-Price Secrecy (SBPS, RF-BPS, CR-BPS) and Strong Anonymity (SA, RF-SA, CR-SA)), or there might be list of all bids, which are however unlinkable to the bidders (Bidding-Price Unlinkability (BPU, RF-U, CR-U) and Weak Anonymity (WA, RF-WA, CR-WA)).

These definitions are expressed for protocols implementing a first-price sealed-bid auction. We also provide the generalized notions (P), (RF) and (CR), which can also be applied to other types of auctions such as second-price auctions. We show that if a protocol correctly implements a First-Price Sealed-Bid Auction (FPSBA), these notions coincide with the corresponding Strong Anonymity-notions (SA), (RF-SA) and (CR-SA). We also propose variants of the above notions including corrupted bidders.

Definition 51 (Strong Bidding-Price Secrecy (SBPS) [DJP11]) An electronic auction protocol ensures Strong Bidding-Price Secrecy (SBPS) if for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b B |Bσ id C σ b C ]
The intuition is the following: If the losing bids are private, a losing bidder may change his bid for another losing one without this being noticeable to an attacker. This is expressed as an observational equivalence between two situations where a losing bidder changes his bid. Note that Bσ id C does not necessarily win since in AP there might be a bidder offering a higher price, but b A , b B < b C guarantees that Bσ id A loses.

We propose the following, weaker notion of Bidding-Price Unlinkability, which allows the losing bids to be public, however their link to the bidders have to be secret.

Definition 52 (Bidding-Price Unlinkability (BPU)) An electronic auction protocol ensures Bidding-Price Unlinkability (BPU) if for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
In this definition we require two situations in which two losing bidders swap their bids to be bisimilar. This might be the case if the bids are public, but the real identity of the bidders is hidden, e.g. through the use of pseudonyms.

Theorem 49 If an auction protocol ensures Strong Bidding-Price Secrecy (SBPS), it also ensures Bidding-Price Unlinkability (BPU).

Proof As we have (SBPS), suppose for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b B |Bσ id C σ b C ]
We have to show that for any auction process AP and any bids b A , b B < b C we have

AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
Applying the hypothesis, can conclude as follows:

AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
Note that the previous two notions only concern the losing bids, yet we might also want to preserve the anonymity of the winning bidder.

Definition 53 (Strong Anonymity (SA)) An electronic auction protocol ensures Strong Anonymity (SA) if for an auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ]
Here we require two situations to be bisimilar where two different bidders win using the same offer, and the losing bidders may also use different bids in the two cases. This is stronger than Strong Bidding-Price Secrecy (SBPS).

Theorem 50 If an auction protocol ensures Strong Anonymity (SA), it also ensures Strong Bidding-Price Secrecy (SBPS).

Proof We have to show (SBPS), i.e. that for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b B |Bσ id C σ b C ]

Suppose that for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ]
Then we can conclude as follows.

AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ] ≈ l AP {A,C} [Bσ id A σ b B |Bσ id C σ b C ]
A slightly weaker notion is Weak Anonymity, which allows the bids to be public, however their link to the bidders have to be secret, even for the winner.

Definition 54 (Weak Anonymity (WA)) An electronic auction protocol ensures Weak Anonymity (WA) if for an auction process AP and any bids b

A < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b A ]
Here again two different bidders win using the same bid, but the losing bidder cannot choose his bid freely as above -the two bidders swap their bids. This corresponds for example to a situation with a public list of bids in clear, but where it is private which bidder submitted which bid.

Theorem 51 If an auction protocol ensures Strong Anonymity (SA), it also ensures Weak Anonymity (WA).

Proof We have to show that for any auction process AP and any bids b

A < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b A ]
Suppose that for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ] We set b B = b A to conclude.
Weak Anonymity (WA) is stronger than Bidding-Price Unlinkability (BPU) as even the winner remains anonymous.

Theorem 52 If an auction protocol ensures Weak Anonymity (WA), it also ensures Bidding-Price Unlinkability (BPU).

Proof We have to show that for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
Assume that for any auction process AP and any bids b A < b C we have

AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b A ]
Then we can proceed as follows.

AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b C |Bσ id C σ b B ] ≈ l AP {A,B,C} [Bσ id A σ b C |Bσ id B σ b A |Bσ id C σ b B ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
All these definitions are only meaningful for first-price auctions. To also deal with second-prices sealed-bid auctions, we can use the following generalization based on the published result (analogous to the definitions for weighted votes in Section 3.4).

Definition 55 (Privacy (P)) An electronic auction protocol ensures Privacy (P) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) we have AP A H | res ≈ l AP B H | res ⇒ AP A ≈ l AP B
The intuition is quite simple: any two instances (consisting of the same bidders) which give the same result, for example the same winning bid, have to be bisimilar.

It turns out that for a correct first-price sealed-bid auction protocol which only publishes the winning price, this coincides with Strong Anonymity.

Definition 56 (First-Price Sealed-Bid Auction (FPSBA)) An electronic auction protocol implements a First-Price Sealed-Bid Auction (FPSBA) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) we have AP A H | res ≈ l AP B H | res ⇔ max i b i,A = max i b i,B ∧ | arg max i b i,A | = | arg max i b i,B |
This definition requires the protocol to announce the same result if and only if the maximum among the submitted bids is the same and we have the same number of tied bids, independently of which bidder submitted which bid. Without the second condition we would require two situations to give the same result even if in one there is a tie, but not in the other. This would be too strict for many protocols that identify and publish ties, but not automatically break them.

It is easy to see that both conditions hold in the case of a correct first-price sealed-bid auction protocol. This allows us to prove the equivalence of (P) and (SA).

Theorem 53 If an electronic auction protocol implements a First-Price Sealed-Bid Auction (FPSBA), then Privacy (P) and Strong Anonymity (SA) are equivalent.

Proof We prove both implications separately:

-Suppose an electronic auction protocol ensures (P), i.e. if for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) we have AP A H | res ≈ l AP B H | res ⇒ AP A ≈ l AP B
We want to show (SA), i.e. that for any an auction process AP and any bids

b A < b C , b B < b C we have AP A := AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ] =: AP B
We can see that both sides have the number of maximal bids containing the same price, hence by (FPSBA) we obtain that AP A H | res ≈ l AP B H | res , which allows to conclude using (P).

-Suppose that we have (SA) and we want to show (P). Suppose AP A H | res ≈ l AP B H | res , then by (FPSBA) we have the same number of maximal bids containing the same price on both sides. If the winning bidder(s) did not change, only losing bids may have changed, and we can use a sequence of applications of (SA) to conclude (as in the proof of Theorem 50 on page 172).

If the winning bidder(s) did change, (SA) allows us to swap the winning bid, and then -as above -we can use a sequence of applications of (SA) to conclude for the other bids.

These definitions do not include corrupted bidders, which can be realized as follows.

For better readability we mark the differences to the corresponding definitions without corrupted bidders in bold.

Definition 57 (SBPS with Corrupted Bidders (SBPS-C)) An electronic auction protocol ensures

AP {A,C}∪I Bσ id A σ b A |Bσ id C σ b C | i∈I (Bσ id i ) c 1i ,c 2i ≈ l AP {A,C}∪I Bσ id A σ b B |Bσ id C σ b C | i∈I (Bσ id i ) c 1i ,c 2i
This definition is identical to the definition of (SBPS), except that any subset of the other bidders in the instance can be corrupted.

We can employ the same approach for Bidding-Price Unlinkability, Weak Anonymity and Weak Anonymity.

Definition 58 (BPU with Corrupted Bidders (BPU-C)) An electronic Auction protocol ensures

AP {A,B,C}∪I Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C | i∈I (Bσ id i ) c 1i ,c 2i ≈ l AP {A,B,C}∪I Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C | i∈I (Bσ id i ) c 1i ,c 2i
AP {A,C}∪I Bσ id A σ b A |Bσ id C σ b C | i∈I (Bσ id i ) c 1i ,c 2i ≈ l AP {A,C}∪I Bσ id A σ b C |Bσ id C σ b B | i∈I (Bσ id i ) c 1i ,c 2i

Definition 60 (Weak Anonymity with Corrupted Bidders (WA-C)) An electronic auction protocol ensures Weak Anonymity with Corrupted Bidders (WA-C) if for an auction process AP , any bids b A < b C and any subset of bidders

I with I ∩ {A, C} = ∅ we have AP {A,C}∪I Bσ id A σ b A |Bσ id C σ b C | i∈I (Bσ id i ) c 1i ,c 2i ≈ l AP {A,C}∪I Bσ id A σ b C |Bσ id C σ b A | i∈I (Bσ id i ) c 1i ,c 2i
Analogous to our definitions for eVoting, we can also include corrupted bidders in the generalized definition.

Definition 61 (Privacy with Corrupted Bidders (P-C)) An electronic auction protocol ensures Privacy with Corrupted Bidders (P-C) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l )

and any subset of bidders I ⊆ {1, . . . , n} with ∀i ∈ I : σ b i,A = σ b i,B we have

AP A H | res ≈ l AP B H | res ⇒ AP A I | i∈I (Bσ id i ) c 1i ,c 2i ≈ l AP B I | i∈I (Bσ id i ) c 1i ,c 2i
Then we have the following hierarchy between the different notions.

Theorem 54 We have for any X ∈ {P, SBPS, BPU, SA, WA}: -Any auction protocol ensuring (X-C) also ensures (X). -Any auction protocol ensuring (SBPS-C) also ensures (BPU-C). -Any auction protocol ensuring (SA-C) also ensures (SBPS-C).

-Any auction protocol ensuring (SA-C) also ensures (WA-C).

-Any auction protocol ensuring (WA-C) also ensures (BPU-C).

-If an auction protocol implements (FPSBA), then (P-C) and (SA-C) are equivalent.

Proof The first proposition is easy to show, we simply consider I = ∅. The remaining five propositions can be shown analogously to Theorems 49, 50, 51, 52 and 53. We simply add the set of corrupted bidders, the rest of the proofs remains unchanged.

B \out(chc,•) ≈ l Bσ id A σ b B and AP {A,C} (Bσ id A σ b A ) chc |Bσ id C σ b C ≈ l AP {A,C} B |Bσ id C σ b C
The intuition behind this definition is a follows: If the protocol is receipt-free, an attacker cannot distinguish between a situation where a losing bidder bids b A and reveals all his secret data on a channel chc, and a situation where the bidder bids b B and only pretends to reveal his secret data (the fake strategy, modeled by process B ). Note that Simple Receipt-Freeness (SRF) implies Strong Bidding-Price Secrecy (SBPS).

Theorem 55 An auction protocol ensuring Simple Receipt-Freeness (SRF) also ensures Strong Bidding-Price Secrecy (SBPS).

Proof We have to show that for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b B |Bσ id C σ b C ]
By hypothesis we have that for any auction process AP and any bids b A < b C , b B < b C there exists a process B such that

B \out(chc,•) ≈ l Bσ id A σ b B and AP {A,C} (Bσ id A σ b A ) chc |Bσ id C σ b C ≈ l AP {A,C} B |Bσ id C σ b C
We apply the context νchc id C (_|!in(chc id C , x)) on both sides, which gives

AP {A,C} (Bσ id A σ b A ) chc |Bσ id C σ b C \out(chc,•) ≈ l AP {A,C} [B |Bσ id C σ b C ] \out(chc,•)
By using Lemma 17 on page 60 we obtain

AP {A,C} (Bσ id A σ b A ) chc |Bσ id C σ b C \out(chc,•) ≡ AP {A,C} (Bσ id A σ b A ) chc \out(chc,•) |Bσ id C σ b C and AP {A,C} B |Bσ id C σ b C \out(chc,•) ≡ AP {A,C} (B ) \out(chc,•) |Bσ id C σ b C
We can now apply Lemma 16 on page 60 and use the fact that labeled bisimilarity is closed under structural equivalence and obtain

AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} (B ) \out(chc,•) |Bσ id C σ b C
where we can use (B ) \out(chc,•) ≈ l Bσ id A σ b B to conclude.

The definition by Dong et al. has several shortcomings: Firstly, it ensures receiptfreeness only for one losing bidder, whereas in reality several bidders might be under attack. Secondly, it does not necessary ensures the privacy of other bidders: Consider for example a protocol that allows a losing bidder to create a fake receipt for himself, e.g. using a trapdoor to generate a different decryption key, and that reveals all submitted bids to the participating bidders, e.g. to enable verifiability. Such a protocol would be secure according to above definition, but it would allow a coercer to ask a bidder to reveal the other participants bids, violating their privacy4 . To address these issues, we propose the following notions, inspired by the definitions developed for electronic voting in the previous chapter and the above privacy notions. there exist processes B i such that we have

Definition 63 (RF-XXX) An electronic auction protocol ensures RF-XXX if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that -if XXX=BPS (Bidding-Price-Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,
∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i
Consider the first case, (RF-BPS): In this definition any subset of losing bidders may create fake receipts at the same time, and the other bidders can also change their bids. It is easy to see that this definition implies Simple Receipt-Freeness (SRF).

Theorem 56 An auction protocol ensuring Receipt-Free Bidding-Price-Secrecy (RF-BPS) also ensures Simple Receipt-Freeness (SRF).

Proof By hypothesis we have for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B
and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅ there exist processes B i such that we have ∀i ∈ I :

B \out(chc i ,•) i ≈ l Bσ id i σ b i,B and AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i
We have to show that for any auction process AP and any bids b A , b B < b C there exists a process B such that

B \out(chc,•) ≈ l Bσ id A σ b B and AP {A,C} (Bσ id A σ b A ) chc |Bσ id C σ b C ≈ l AP {A,C} B |Bσ id C σ b C
We can conclude by setting

AP A = AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] , AP B = AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ]
and

I = {C}, where ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B holds.
Similarly to our privacy definitions, we can also weaken (RF-BPS) and only consider cases where the bids are merely unlinkable to the bidders, by only considering permutations of the bids: We obtain (RF-U), which implies (BPU).

Theorem 57 An auction protocol ensuring Receipt-Free Unlinkability (RF-U) also ensures Bidding-Price Unlinkability (BPU).

Proof We have to show that for any auction process AP and any bids b

A < b C , b B < b C we have AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] ≈ l AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
By hypothesis we have for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B
and a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, there exist processes B i such that we have

∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i
We can easily see that if we choose

AP A = AP {A,B,C} [Bσ id A σ b A |Bσ id B σ b B |Bσ id C σ b C ] AP B = AP {A,B,C} [Bσ id A σ b B |Bσ id B σ b A |Bσ id C σ b C ]
this fits the definition of (RF-U), i.e. we have for The third notion (RF-SA) is stronger in the sense that we also allow the winning bidder to be under attack, i.e. a winner needs to be able to create a fake receipt that proves that he lost, and a losing bidder needs to be able to create a fake receipt that proves that he won. Note that an attacker might ask a losing bidder to prove that he bid a certain price before the auction is over. If the bidder decides to bid less and create a fake receipt, the attacker may notice that he got a fake receipt if for example the winning bid is less than the price on the receipt. This is however an inherent problem of auctions, but our definition guarantees that a losing bidder can create a fake receipt for the winning price once the auction is over and the winning price is known.

J = arg max i b i,A = arg max i b i,B that ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B holds
Similarly to the other cases above, we have that (RF-SA) implies (SA).

Theorem 58 An auction protocol ensuring Receipt-Free Strong Anonymity (RF-SA) also ensures Strong Anonymity (SA).

Proof We have to show that for any auction process AP and any bids b

A , b B < b C we have AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] ≈ l AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ]
By hypothesis we have for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |,
and for any subset I ⊆ {1, . . . , k} there exist processes B i such that we have

∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i
We can easily see that if we choose

AP A = AP {A,C} [Bσ id A σ b A |Bσ id C σ b C ] AP B = AP {A,C} [Bσ id A σ b C |Bσ id C σ b B ]
this fits the definition of (RF-SA), i.e. we have max

i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B
|, hence we can choose I = ∅ and conclude.

Again, we can define a weaker version where the list of prices may be public, but it has to be unlinkable to the bidders, even for the winner: (RF-WA). Similarly to (RF-SA), we have that (RF-WA) implies (WA).

Theorem 59 An auction protocol ensuring Receipt-Free Weak Anonymity (RF-WA) also ensures Weak Anonymity (WA).

Proof As the proof of Theorem 58, but with b B = b A .

It is easy to see that (RF-SA) implies (RF-BPS) and (RF-WA), and that both (RF-BPS) and (RF-WA) imply (RF-U).

Theorem 60 We have:

-A protocol ensuring (RF-SA) also ensures (RF-BPS) and (RF-WA).

-A protocol ensuring (RF-BPS) or (RF-WA) also ensures (RF-U).

Proof The only difference between these pairs is the restriction on the bids and I:

-if XXX=BPS (Bidding-Price-Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,

. , k},

It is easy to see that SA includes WA, that BPS includes U, that SA includes BPS, and finally that WA includes U.

Finally, the following definition is a generalization of Receipt-Free Strong Anonymity (RF-SA) (analogous to (P) and (SA)): Any two instance giving the same result have to be bisimilar, even if bidders are under attack.

Definition 64 (Receipt-Freeness (RF)) A auction protocol ensures Receipt-Freeness (RF) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l )
and any subset I ⊆ {1, . . . , k}, there exist processes B i such that we have ∀i ∈ I :

B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A H | res ≈ l AP B H | res ⇒ AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i .
Similarly to Privacy (P), we prove that for protocols implementing a First-Price Sealed-Bid Auction (First-Price Sealed-Bid Auction), Receipt-Free Strong Anonymity (RF-SA) and Receipt-Freeness coincide.

Theorem 61 If an electronic auction protocol implements a First-Price Sealed-Bid Auction (FPSBA), then Receipt-Freeness (RF) and Receipt-Free Strong

Anonymity (RF-SA) are equivalent.

Proof Suppose an electronic auction protocol ensures (RF), i.e. if for any two auction processes

AP A = ν ñ .(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ .(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , k}, there exist processes B i such that we have

∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A H | res ≈ l AP B H | res ⇒ AP A I | i∈I (Bσ id i σ b i,A ) chc i ≈ l AP B I | i∈I B i .
We want to show (RF-SA), i.e. for any two auction processes

AP A = ν ñ .(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ .(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |,
and for any subset I ⊆ {1, . . . , k} there exist processes B i such that we have

∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i

Suppose that we have (RF-SA) and we want to show (RF). By (FPSBA) if we have AP A

H | res ≈ l AP B H | res , we have max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B
|, hence we can conclude using (RF-SA).

Note that the above definitions implicitly assumes that all bidders not under attack are honest. If one also wants to consider corrupted bidders, we can again replace some of the honest bidders Bσ id i σ b i,X by corrupted bidders (Bσ id i ) c 1i ,c 2i as follows. Again, differences to the definition without corrupted bidders are marked in bold.

Definition 65 (RF-XXX-C) An electronic auction protocol ensures RF-XXX-C if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that -if XXX=BPS (Bidding-Price-Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,
∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I∪H | i∈I (Bσ id i σ v i,A ) chc i | h∈H (Bσ id h ) c 1h ,c 2h ≈ l AP B I∪H | i∈I B i | h∈H (Bσ id h ) c 1h ,c 2h
Similarly our generalized definition looks as follows.

Definition 66 (Receipt-Freeness with Corrupted Bidders (RF-C)) An auction protocol ensures Receipt-Freeness with Corrupted Bidders (RF-C) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l )
≈ l Bσ id i σ b i,B and AP A H | res ≈ l AP B H | res ⇓ AP A I∪H | i∈I (Bσ id i σ v i,A ) chc i | h∈H (Bσ id h ) c 1h ,c 2h ≈ l AP B I∪H | i∈I B i | h∈H (Bσ id h ) c 1h ,c 2h .
Then again we have the following hierarchy between the different notions.

Theorem 62

We have for any XXX ∈ {BPS, U, SA, WA}:

-Any auction protocol ensuring (RF-XXX-C) also ensures (RF-XXX).

-Any auction protocol ensuring (RF-C) also ensures (RF).

-Any auction protocol ensuring (RF-BPS-C) also ensures (RF-U-C). -Any auction protocol ensuring (RF-SA-C) also ensures (RF-BPS-C). -Any auction protocol ensuring (RF-SA-C) also ensures (RF-WA-C). -Any auction protocol ensuring (RF-WA-C) also ensures (RF-U-C

).

-If an auction protocol implements (FPSBA), then (RF-C) and (RF-SA-C) are equivalent.

Proof The first two propositions follow directly for H = ∅. The remaining propositions can be shown analogously to Theorems 60 and 61. We simply add the set of corrupted bidders, the rest of the proofs remains unchanged. § 4.3.4.3. Coercion-Resistance. Coercion-Resistance is a stronger property than receipt-freeness: The intruder may not only ask for a receipt, but is also allowed to interact with the bidder during the bidding process and to give orders. We can generalize the previously discussed Receipt-Freeness notions to Coercion-Resistance as follows. there exist processes B i such that for any contexts C i , i ∈ I with

Definition 67 (CR-XXX) An electronic auction protocol ensures CR-XXX if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that -if XXX=BPS (Bidding-Price Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,
C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B
and

AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i B i
The difference to the previous receipt-freeness definitions is that the attacked bidders do not only reveal their data on channel c 1 , but also take orders on channel c 2 . The context C i models the attacker that tries to force them to bid the price b i,A (this is expressed by the condition on C i ). The protocol is hence coercion-resistant if there exists a counter-strategy B which allow the bidders to bid b i,B instead without the attacker noticing.

Note that the hierarchy we already observed for Privacy and Receipt-Freeness also holds on the level of Coercion-Resistance.

Theorem 63 We have: -A protocol ensuring (CR-SA) also ensures (CR-BPS) and (CR-WA). -A protocol ensuring (CR-BPS) or (CR-WA) also ensures (CR-U).

Proof Similar to Theorem 60: We only need to consider the different parameters, which are specializations of each other.

For non sealed-bid first-price auctions, we obtain the following definition.

Definition 68 (Coercion-Resistance (CR)) An electronic auction protocol ensures Coercion-Resistance (CR) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l )
and any subset I ⊆ {1, . . . , k}, there exists processes B i such that for any contexts C i , i ∈ I with

C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B and AP A H | res ≈ l AP B H | res ⇓ AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i [B i ]
Again the contexts C i model the part of the adversary interacting with the coerced bidders. The contexts are limited to force the bidders to bid their bids from the first instance to ensure that both instances with coercion result in the same election outcome, and are not trivially distinguishable. Similarly to Receipt-Freeness we can prove that for protocols implementing a First-Price Sealed-Bid Auction (FPSBA), Coercion-Resistant Strong Anonymity (CR-SA) and Coercion-Resistance (CR) coincide.

Theorem 64 If an electronic auction protocol implements a First-Price Sealed-Bid Auction (FPSBA), then Coercion-Resistant Strong Anonymity (CR-SA) and Coercion-Resistance (CR) are equivalent.

Proof Suppose an electronic auction protocol ensures (CR), i.e. if for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , k}, there exists processes B i such that for any contexts C i , i ∈ I with

C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B and AP A H | res ≈ l AP B H | res ⇓ AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i [B i ]
We want to show (CR-SA), i.e. that for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |
, and for any subset I ⊆ {1, . . . , k} there exist processes B i such that for any contexts C i , i ∈ I with

C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i we have ∀i ∈ I : C i [B i ] \out(chc i ,•) ≈ l Bσ id i σ v i,B
and

AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i B i Assume such AP A and AP B, then max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |,
b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B
|, hence we can conclude using (CR-SA).

We also note that similarly to the case of electronic voting, Coercion-Resistance is stronger than Receipt-Freeness.

Theorem 65 An electronic auction protocol ensuring Coercion-Resistance (CR) also ensures Receipt-Freeness (RF).

Proof Assume that for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , k}, there exists processes B i such that for any contexts C i , i ∈ I with

C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B and AP A H | res ≈ l AP B H | res ⇓ AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i [B i ]
We have to show that for any two auction processes

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l
) and any subset I ⊆ {1, . . . , k}, there exist processes B i such that we have ∀i ∈ I :

B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A H | res ≈ l AP B H | res ⇒ AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i .
Let C i , i ∈ I be evaluation contexts with

C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i
Note that such a C can be constructed directly from the bidders process B. By hypothesis we know that there are closed plain processes B i such that ∀i ∈ I :

C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B
and

AP A H | res ≈ l AP B H | res ⇓ AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i [B i ]
We have to find other processes B i such that

∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B and AP A H | res ≈ l AP B H | res ⇒ AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i Let ∀i : B i = C i [B i ].
This directly fulfills the first requirement. Assume AP A H | res ≈ l AP B H | res . We now use the hypotheses

AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i and AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i B i
As labeled bisimilarity is transitive, we can conclude

AP A I | i∈I (Bσ id i σ b i,A ) chc i ≈ l AP B I | i∈I C i B i which gives us the desired result for B i = C i [B i ].
This also holds for (CR-XXX). there exist processes B i such that for any contexts

Theorem 66 An electronic auction protocol ensuring (CR-XXX) also ensures (RF-XXX) for any XXX ∈ {BPS, U, SA, WA}.

Proof Assume that for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that -if XXX=BPS (Bidding-Price Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,
C i , i ∈ I with C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B
and

AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i B i
We have to show that for any two auction processes there exist processes B i such that we have

AP A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that -if XXX=BPS (Bidding-Price-Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,
∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i
Since the conditions on the σ b i,X and I depending on the parameter XXX are the same in both cases (CR and RF), we can proceed independently of XXX. Let C i , i ∈ I be evaluation contexts with

C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i
Note that such a C can be constructed directly from the bidders process B. By hypothesis we know that there are closed plain processes B i such that ∀i ∈ I :

C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B
and

AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i B i
We have to find other processes B i such that

∀i ∈ I : B \out(chc i ,•) i ≈ l Bσ id i σ b i,B
and

AP A I | i∈I (Bσ id i σ v i,A ) chc i ≈ l AP B I | i∈I B i Let ∀i : B i = C i [B i ].
This directly fulfills the first requirement. We now use the hypotheses

AP A I | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 ≈ l AP A I | i∈I (Bσ id i σ b i,A ) chc i and AP A I | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 ≈ l AP B I | i∈I C i B i
As labeled bisimilarity is transitive, we can conclude

AP A I | i∈I (Bσ id i σ b i,A ) chc i ≈ l AP B I | i∈I C i B i which gives us the desired result for B i = C i [B i ].
We can also include corrupted bidders as follows. Again, differences to the definition without corrupted bidders are marked in bold.

Definition 69 (CR-XXX-C) An electronic auction protocol ensures CR-XXX-C if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l ) such that -if XXX=BPS (Bidding-Price Secrecy), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,
C i , i ∈ I with C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I∪H | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 | h∈H (Bσ id h ) c 1h ,c 2h ≈ l AP A I∪H | i∈I (Bσ id i σ b i,A ) chc i | h∈H (Bσ id h ) c 1h ,c 2h we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B
and

AP A I∪H | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 | h∈H (Bσ id h ) c 1h ,c 2h ≈ l AP B I∪H | i∈I C i B i | h∈H (Bσ id h ) c 1h ,c 2h
For non sealed-bid first-price auctions, we obtain the following definition.

Definition 70 (Coercion-Resistance with Corrupted Bidders (CR-C)) An auction protocol ensures Coercion-Resistance with Corrupted Bidders (CR-C) if for any two auction processes AP

A = ν ñ.(Bσ id 1 σ b 1,A | . . . | Bσ id k σ b k,A | S | A 1 | . . . | A l ) and AP B = ν ñ.(Bσ id 1 σ b 1,B | . . . | Bσ id k σ b k,B | S | A 1 | . . . | A l )
C i = νc 1 .νc 2 .(_|P i ), ñ ∩ f n(C) = ∅ and AP A I∪H | i∈I C i (Bσ id i σ b i,A ) c 1 ,c 2 | h∈H (Bσ id h ) c 1h ,c 2h ≈ l AP A I∪H | i∈I (Bσ id i σ b i,A ) chc i | h∈H (Bσ id h ) c 1h ,c 2h we have ∀i ∈ I : C i B i \out(chc i ,•) ≈ l Bσ id i σ v i,B and AP A H | res ≈ l AP B H | res ⇓ AP A I∪H | i∈I C i (Bσ id i σ v i,A ) c 1 ,c 2 | h∈H (Bσ id h ) c 1h ,c 2h ≈ l AP B I∪H | i∈I C i [B i ] | h∈H (Bσ id h ) c 1h ,c 2h
Then again we have the following hierarchy between the different notions.

Theorem 67

We have for any XXX ∈ {BPS, U, SA, WA}:

-Any auction protocol ensuring (CR-XXX-C) also ensures (CR-XXX).

-Any auction protocol ensuring (CR-C) also ensures (CR).

-Any auction protocol ensuring (CR-BPS-C) also ensures (CR-U-C).

-Any auction protocol ensuring (CR-SA-C) also ensures (CR-BPS-C).

-Any auction protocol ensuring (CR-SA-C) also ensures (CR-WA-C).

-Any auction protocol ensuring (CR-WA-C) also ensures (CR-U-C).

-If an auction protocol implements (FPSBA), then (CR-C) and (CR-SA-C) are equivalent.

Proof The first two propositions follow directly for H = ∅. The remaining propositions can be shown analogously to Theorems 63 on page 186 and 64 on page 187. We can add the set of corrupted bidders without changing the rest of the proofs.

-Case Studies

We applied the previously explained definitions on three case studies using ProVerif: the protocol by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], the protocol by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and the protocol by Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. § 4.3.5.1. Protocol by Curtis, Pierprzyk and Seruga. The protocol by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF] was designed to support sealed-bid first-and second price auctions while guaranteeing fairness, privacy, verifiability and non-repudiation.

Description. The main idea of the protocol is the following: The bidders register with a trusted Registration Authority (RA) using a Public-Key Infrastructure (PKI), which issues pseudonyms that will then be used to submit bids to the Seller (S). It is split into three phases: Registration, Bidding, and Winner determination.

1. Registration: Each bidder sends his identity, a hash h(b i ) of his bidding price b i and a signature of h(b i ) to the RA. The RA checks the identity and the signature using the PKI, and replies with an encrypted (using the bidder's public key) and signed message containing a newly generated pseudonym p and the hashed bid h(b i ).

Bidding:

The RA generates a new symmetric key k. Each bidder will send c = Enc pk S (b i ), his bid b i encrypted with the seller's public key, and a signature of c, together with his pseudonym to the RA. The RA will reply with a signature on c, and encrypts the bidders message, together with the hashed bid h(b i ) from phase one, using the symmetric key k. This encrypted message is then sent to the seller.

3.

Winner determination: After all bids have been submitted, the RA will reveal the symmetric key k to the seller. The seller can then decrypt the bids, verify the correctness of the hash and determine the winner. To identify the winner using the pseudonym he can ask the RA to reveal the true identity.

Remark Note that the protocol does not specify how exactly the winner is determined. The seller obtains all bids in clear, and can thus apply any auction function. This may be a simple first-price auction (i.e. the highest bid wins), but also second-price auctions or other auction functions are supported. However, as some of our properties rely on the event won, we need to specify some auction function to be able to perform the verification. Hence we assume -for simplicitya first-price auction in the following.

Formal Model. We modeled the protocol in ProVerif using an equational theory inspired by the equations given in the original paper [START_REF] Curtis | An efficient eAuction protocol[END_REF], It contains equations for symmetric encryption (functions senc and sdec), asymmetric encryption5 (functions enc, dec and pk -which generates the public key corresponding to a secret key) and signatures (functions sign, checksign and getmessage):

sdec(senc(m, key), key) = m dec(enc(m, pk(sk)), sk) = m checksign(sign(m, sk), pk(sk)) = m getmessage(sign(m, sk)) = m
Listing 4.1 shows our model of the bidder, Listing 4.2 on the following page the code of the registrar. Here we employ ProVerif syntax, i.e. including types for the variables and parameters for the subprocesses, and type conversion functions (e.g. intToBit converting an integer to a bitstring). For a detailed explanation, see the ProVerif manual [START_REF] Blanchet | ProVerif -Automatic Cryptographic Protocol Verifier -User Manual and Tutorial[END_REF]. Listing 4.3 on page 197 gives the code for the auctioneer, and Listing 4.4 on page 197 shows the code for an instance with two bidders. The ProVerif code used for each of the verifications below is available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

Analysis. We assume an honest RA and an honest seller.

Non-Repudiation (NR):

To prove (NR), we have to show that on each possible trace the event won(p,id) is preceded by the event bid(p,id). ProVerif can verify such properties using queries, in this case using the query query p:price,id:identity; event(won(p,id)) ==> event(bid(p,id)). This query means that for any value p of type price and any id of type identity, if the event won(p,id) is recorded, it is preceded by the event bid(p,id). In this case we use the pseudonyms (of type bitstring) to identify the bidders, hence the query looks like this: query p:price,pseudo:bitstring; event(won(p,pseudo)) ==> event(bid(p,pseudo)).

ProVerif finds the following attack: Since the channel between the Registration Authority and the Seller is not protected, anybody can pretend to be the RA and submit false bids, encrypted with a self-chosen symmetric key. After all false bids are submitted, the attacker reveals the symmetric key and the seller will decrypt the bogus bids. Hence the event won(p,id) can be emitted on a trace without any event bid(p,id). We propose a solution to address this problem: If the messages from the RA to the seller are signed, the attacker cannot impersonate the RA any more and ProVerif is able to prove Non-Repudiation for the accordingly modified protocol.

Non-Cancellation (NC):

Here we have to show that even if a bidder reveals his secret data to the intruder, the intruder cannot cancel a submitted bid, i.e. there is no trace with the events recBid(p_1,id_a) and won(p_2,id_b) where p_1 > p_2. To verify this we need to model at least two distinct prices, which can be implemented using constants, i.e. by setting p_1 = max_price and p_2 = smaller_price, where max_price and smaller_price are two constants such that max_price > smaller_price 6 . Then we want to test the conjunction (not the precedence as above) of two events, which is not possible directly in ProVerif. A well-known solution is to replace the underlying events with messages over a private channel to a newly added processes which will call a conjunction event recBid_and_won once he received all the messages. Then we could use the following query: query event(recBid_and_won(p_1, id_a, p_2, id_b)).

where the first two parameters are from the event recBid(p_1,id_a) and the second from the event won(p_2,id_b), here instantiated with price constants as explained above and two constants for two different bidders. However, as above, we use the pseudonyms in our events recBid and won, as for example to seller (who executes the event won) does not know the real identity of a bidder. Hence we cannot have won(p_2,id_b), but only won(p_2,pseudonym). To associate the pseudonyms with bidders and still be able to execute the above query, we added an event getAlias(id,p) (and an output on a private channel to the process checking for the events) executed by the registrar when he attributes a pseudonym p to the identity id. This allows us to link pseudonyms to identities, hence the process checking for the conjunction can execute the event with the real identities as described above by linking them to the pseudonyms using his input from the RA.

For the original protocol, ProVerif finds a similar attack to the one described above: An attacker can delete the messages sent by the the RA to the seller, and choose a symmetric key and send bogus messages containing prices of his choice instead. When he reveals the symmetric key, a bidder of his choice will win, hence there will be an event won(smaller_price,id_b) for a smaller price than the one recorded by recBid(max_price,id_a). Even if we add signatures as proposed above, ProVerif still comes up with an attack: A dishonest bidder might submit a first bid triggering the event recBid for this bid, delete the forwarded message to the seller, and then submit a second bid at a different price7 . A first attempt to fix this issue would be -as proposed in the original paper -by including the number of bids in the message where the RA reveals the symmetric key. This would allow the seller to verify if he received the correct number of bids. However the attack still works if two auctions take place in parallel8 : Since the RA uses the same PKI in both cases, he will use the same keys. The malicious bidder could register in the second auction, obtain the signed bid and replace his original bid with this message. The new message will include a different pseudonym, but the seller has no means of verifying if a pseudonym corresponds to the current auction. A solution would be to use different keys for different auctions (which need to be set up in a secure way), but we were unable to verify the resulting protocol because ProVerif cannot maintain state information, which is necessary to model the counting of messages.

Noninterference: It is clear that the protocol does not ensure Strong Noninterference (SN) since an attacker can simply count the number of messages to determine the number of participants. However we can check Weak Noninterference (WN), i.e. that any two instances containing the same bidders and only differing in the bids are bisimilar up to the end of the bidding phase, using the following query in ProVerif: noninterf b_1, ..., b_n. This query will ask ProVerif to verify strong secrecy of the variables b_1, ..., b_n., i.e. to check that any two instances of the protocol that only differ in these variables are bisimilar. For the original protocol ProVerif finds an attack which is based on the first message, which includes the hashed bidding price. An attacker simply hashes the possible values and compares the result. If we encrypt this message using the RA's public key, ProVerif is able to prove Weak Noninterference (WN). This modification was proposed in the original paper to achieve anonymity of bidders, but turns out to be also necessary to ensure fairness.

Highest Price Wins (HPW):

Here we have to show that a malicious bidder cannot win the auction at a chosen price, even if another bidder submitted a higher bid. Again, we will assume that we have a finite number of possible prices. Then we can check the property using ProVerif by modeling two bidders, the first one bidding max_price, and the second one is corrupted by the adversary (according to Definition 19 on page 59). To prevent the adversary from just winning using the highest possible price (which would not necessarily correspond to an attack), we declare the constant max_price private9 . We also have to be sure that the protocol does not leak max_price before the end of the bidding phase (which would contradict the intention of declaring it private). As we already showed Weak Noninterference (WN), we can be sure that this is not the case. Hence we could check if the event won is reachable for the corrupted bidder id_B using the following query query bid:price; event(won(bid, id_B)).

Since bidder id_A submitted the highest possible price and the attacker cannot access and submit this value, he should be unable to make id_B win the auction. However, as the seller only knows the pseudonym, we again have to modify the query slightly. Our approach is the same as above: we use the event getAlias. Then we can execute the following query: query bid:price, alias:bitstring; event(won(bid, alias))

==> event(getAlias(id_A, alias)).

The idea is simple: we ask ProVerif to prove that if a bidder wins, it was bidder id_A. This implies that the corrupted bidder id_B cannot win, as in our first query.

For the original protocol -only corrected with added encryption of the first bid to ensure Weak Noninterference -, ProVerif finds an attack again using the fact that the messages from the RA to the Seller are not authenticated, hence an attacker can pretend to be RA and submit bids of his choice to win the auction at a price of his choice. If we add signatures again, ProVerif still comes up with an attack: A dishonest bidder might register twice and then replace the message from the RA to the seller containing the correct bid with his own, bogus bid obtained using the second registration. As above, this could probably be circumvented by counting the messages and using different keys for different auctions, but for the same reason as above we cannot verify this in ProVerif.

Privacy: The authors claim in the original paper that if the first message is encrypted, their protocol ensures anonymity of the bidders. Yet we can see that it does not ensure Strong Anonymity (SA) since after the symmetric key has been published, an attacker can obtain a list with hashes of all bids, which allows to distinguish h

(b A ), h(b C ) from h(b B ), h(b C
). Hence we checked Weak Anonymity (WA) using the choice[] operator in ProVerif, which verifies if the processes obtained by instantiating a variable with two different values are bisimilar. More precisely, we can check if for two swapping bidders (the first bidder bids b_A = choice[b_1,b_2], the second b_B = choice[b_2,b_1]) the resulting processes are bisimilar. This query leads to another possible attack: The intruder might delay the messages from the second bidder. He waits until the first bidder sent his final message and this was relayed to the seller by the RA. This allows the attacker to link this message to the first bidder and distinguish both cases based on the hash after decrypting the message using the published symmetric key. This type of attack is well-known in electronic voting [START_REF] Delaune | Verifying privacy-type properties of electronic voting protocols[END_REF]. As a solution, we have to ensure that both messages to the seller are sent at exactly the same time using synchronization. Inspired by some techniques used in ProSwapper [START_REF] Klus | Proswapper: Improved equivalence verifier for proverif[END_REF], we prove that the accordingly modified protocol ensures Weak Anonymity (WA) for two honest bidders. Note that technically our definition requires to consider any number of bidders, however due to the protocol structure ProVerif cannot do this automatically: the computation of the winner in the general case includes loops, which cannot be modeled in ProVerif. A manual proof following the idea of modularity used for voting protocols to reduce the general case to the case of two voters is also difficult, as the protocol structure violates such a modularity condition. One of the problems is the symmetric key used between the RA and the seller -decomposing instances will lead to several distinct keys (and hence also several messages where the key is revealed).

If we consider corrupted bidders, ProVerif discovers another weakness in the protocol: the corrupted bidder can essentially test if an honest bidder submitted a certain price. This works as follows. The corrupted bidder submits the hash of the price he wants to test to the RA as if it was his bid. The RA responds with an encrypted message containing the pseudonym and the hash of the bid, signed by the RA. The malicious bidder can decrypt this message, and then encrypt the signed values using the public key of the targeted bidder, and send him this message. The targeted bidder decrypts the message, verifies the signature and checks if the hash corresponds to his bid. If yes, he continues, if no, he aborts, which is visible to the attacker by observing the next message. A solution to this problem is to send this message from the RA to the bidder over an private channel. This was proposed in the original protocol description, however it is unclear why the message needs to be encrypted and signed if the channel is secure anywaymaybe this was intended as an implementation of a secure channel. Therefore we considered both versions here, and it turns out that the encryption and signature as proposed are insufficient. If the channel is private, ProVerif is again able to prove Weak Anonymity (WA) for two honest and one corrupted bidder.

It is also clear that the protocol is neither Receipt-Free nor Coercion-Resistant for any of the proposed notions since the hashed bidding price in the first message can be used as a receipt. Even if this message is encrypted, the data used to encrypt (keys, random values) can be used as a receipt.

Note that for all properties ProVerif responds in a few seconds on a standard PC. § 4.3.5.2. Protocol by Brandt. The protocol by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] was designed to ensure maximal privacy in a completely distributed way. It exploits the homomorphic properties of a distributed threshold El-Gamal Encryption scheme for a secure multi-party computation of the winner.

Informal Description. The participating bidders and the seller communicate using a broadcast channel10 , e.g. a bulletin board (an append-only memory accessible for everybody). The bids are encoded as bit-vectors where each entry corresponds to a price. The protocol then uses linear algebra operations on the bid vectors to compute a function f i , which returns a vector containing one zero if the bidder i submitted the highest bid, and only random numbers otherwise. To be able to compute this function in a completely distributed way, and to guarantee that no coalition of malicious bidders can break privacy, these computations are performed on the encrypted bids using homomorphic properties of a distributed n out of n threshold ElGamal encryption.

In a nutshell, the protocol realizes the following steps:

1. Firstly, the distributed key is generated: each bidder chooses his part of the secret key and publishes the corresponding part of the public key on the bulletin board.

2. Each bidder then computes the joint public key, encrypts his offer using this key and publishes it on the bulletin board.

3. Then the auction function f is calculated for every bidder using some operations exploiting the homomorphic property of the encryption scheme.

4. The outcome of this computation (n encrypted vectors) are published on the bulletin board, and each bidder partly decrypts each value using his secret key.

5. These partial decryptions are published and can be combined to obtain the winner11 .

Formal Model. We need to model the distributed encryption scheme and the distributed computations. The protocol assumes a finite set of possible prices, which we model as constants p 1 , . . . , p q . Assuming n bidders, we define the following equational theory. The first equation models steps 3 and 4 of the protocol:

f(enc(b 1 , pkey, r 1 ), . . . , enc(b n , pkey, r n ), sk i ) = share((max i {b i }, arg max i {b i }), (b 1 , ..., b n ), pkey, sk i , g(r 1 , .., r n ))
where the function arg max i returns the smallest i for which the maximum is reached, similar to the tie-breaking used in the protocol. The equation expresses the following properties of the function f: If we have bids b 1 , . . . , b n , encrypted using the same joint public key pkey, some random values r 1 , . . . , r n , and a part sk i of the secret key we obtain a share (a partial decryption) of the function outcome, i.e. the tuple (winning price, id of the winner), for the same public and secret keys and a function of the used random values. Since the share will look slightly different depending on the bids even if winning bid is the same, we also include b 1 , . . . , b n and the random values r 1 , . . . , r n in the share. This is necessary to avoid false attacks in ProVerif. The next equation corresponds to step 5 of the protocol and uses the function combine(pk(k 1 ), . . . , pk(k n )) which models the computation of the joint public key based on the individual ones.

dec(share(m, x 1 , combine(pk(k 1 ), . . . , pk(k n )), k 1 , r 1 ), . . . , share(m, x q , combine(pk(k 1 ), . . . , pk(k n )), k n , r n )) = m
The equation models that knowing all shares of the function outcome allows to decrypt it, if -all shares have been constructed using the same joint public key, which was computed using the function combine from the individual public keys, and -the individual public keys were computed from the same secret keys that were used to compute the shares.

Since the number of different prices q and the number of participants n are finite, we can enumerate all possible equations. In particular we can list all possible parameters of the function f, which allows us to enumerate all instances and replace the max and arg max functions which their actual values. As our definitions require at least two bidders and at least three different prices, we use n = 2 and q = 3. This yields a convergent equational theory, which allows ProVerif to verify all the tested properties in less than one second.

The process description is straightforward: an instance with two bidders (Listing 4.5 on the facing page) and one seller (Listing 4.6 on page 206) is described in Listing 4.7 on page 206.

Note that as the bidders have to exchange their bids we have to swap sending and receiving of the bids for both processes in order to avoid deadlocks. Note also that the events bid and recBid do not use the same data types concerning the bid, this is however not a problem since they do not occur simultaneously in the definition of a property.

Analysis. We use the same ProVerif techniques we discussed in the previous section. The protocol ensures none of the defined properties except for Weak Noninterference, mainly due the lack of authentication, even if all parties are trusted.

For Non-Repudiation we use the query query b:price, m:int; event(won(b, m)) ==> event(bid(b, m)).

ProVerif finds the following attack: Due to the lack of authentication, the attacker can simulate a completely different protocol execution towards the seller (i.e. setting up keys, encrypting bids of his choice, doing the calculation, and publishing the shares), which allows to construct a trace with event won, but without any event bid.

In the case of Non-Cancellation we have the problem that won and recBid use different data types. We can however address this using the conjunction event recBid_and_won as above and the query query m : price, pkey : shpkey, r : bitstring; event(recBid_and_won(enc(priceToBit(p1), pkey, r), one, p2, one)). i n ( chR , x : b i t s t r i n g ) ; i n ( chR , y : b i t s t r i n g ) ;

( * compute winner * ) l e t ( wbid : p r i c e , winner : i n t ) = dec ( x , y ) i n e v e n t won ( wbid , winner ) ; out (chW, ( wbid , winner ) ) . The query expresses that we look for a trace where the recorded bid was an encryption of the higher price p1, whereas the declared winning bid was the lower price p2, however from the same bidder one. Again ProVerif finds a trace violating the property: The adversary can simulate a different instance to the seller, hence replacing the initially recorded bid with a bid of his choice.

For Highest Price Wins ProVerif identifies a similar issue using the query query p:price; event(won(p, two)).

i.e. we look for a trace where bidder two wins, although bidder one submits the highest bid at the highest possible price. The attack is quite simple: since there is no authentication, the attacker can replace the bid of bidder one with a lower one to win.

Although the protocol claims to be fully private, when checking for Strong Bidding-Price Secrecy, ProVerif finds an attack that allows to completely uncover a bidder's bid: since there is no authentication, an intruder can simulate all other parties with respect to a participant. He will generate secret keys, publish the according public keys and on reception of the attacked bidder's bid, simply copy it and claim that it is his own bid. Then the joint computation and decryption will take place, and the announced winning price will be attacked bidder's offer, which is hence public. Note that this is not an attack on the security of the computation, but on the structure of the protocol.

Hence the protocol does also not ensure any notion of privacy with corrupted voter(s), and neither receipt-freeness nor coercion-resistance as all of them are vulnerable to this attack.

It is also clear that the protocol does not ensure Strong Noninterference since the number of participants is public, which allows to distinguish instances with different number of participants. However we prove Weak Noninterference using choice[] (the use of noninterf leads to false attacks).

As above, the ProVerif-code is available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF]. § 4.3.5.3. Protocol by Sako. Kazue Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF] proposed a protocol for sealed-bid first-price auctions which hides the bids of losing bidders and ensures verifiability. It turns out to ensure all of our properties except for receipt-freeness and coercion-resistance. In the paper Sako gives a high-level description based on primitives ensuring certain properties. Then she also proposes two instantiations using some particular cryptographic primitives: the first one uses Elgamal [EG85] encryption, and the second one employs a probabilistic version of RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. Note that in this protocol dishonest authorities can break privacy, but because of verifiability a manipulation of the auction outcome can be detected.

Informal Description. Informally, the protocol works as follows:

1. The authorities select a list of allowed bids p 1 , . . . , p m . 2. For each allowed bid p i , the authorities set up encryption and decryption algorithms E p i and D p i (in both implementations simply a public and private key pair). The encryption scheme must provide an indistinguishability property. The authorities publish the encryption algorithms (or public keys in the implementation) and the list of allowed bids on a bulletin board.

3. To bid for price p i , a bidder encrypts a public constant c using E p i , signs it and publishes the bid C j = E p i (c) together with the signature on the bulletin board.

4. After the bidding phase is over, the authorities check the signatures and start decrypting all bids with the highest possible price t = p m . If D t (C j ) = c, then bid j was a bid for price t. If all decryptions fail, the authorities decrease t and try again. Each time a decryption is done, they publish a proof of correct decryption to enable verifiability. This can be a zeroknowledge proof, or it might be achieved by simply publishing the secret key.

5. To verify the outcome, anybody can verify the signatures, and check the proofs of correct decryption.

In the rest of this section we consider the implementation based on public and private key pairs as a concretization of the general encryption/decryption algorithms, however we abstract away of the precise encryption scheme. Note that dishonest authorities can break privacy since they have access to all secret keys, but because of verifiability a manipulation of the auction outcome can be detected. Formal Model. To verify Sako's protocol we need to model public-key encryption, signatures and proofs of correct decryption. This can be done using the following equational theory:

checksign(sign(m, k), pk(k)) = m getmessage(sign(m, k)) = m dec(penc(m, pk(k), s), k) = m checkproof(decProof(penc(m, pk(k), s), m, k), penc(m, pk(k), s), m, pk(k)) = true checkproof(decProof(penc(m, pk(k1), s), dec (penc(m, pk(k1), s), k2), k2), penc(m, pk(k1)
, s), dec(penc(m, pk(k1), s), k2), pk(k2)) = true
The first two equations model signatures: If a signature on the message m is checked using the correct public key, we obtain the message m. Similarly the third equation models public-key encryption: A message encrypted with a public key can only be opened using the corresponding private key. The last two equations model proofs of correct decryption: The verification succeeds if the proposed plaintext is the actual decryption of the ciphertext under the claimed key, even if this decryption is not meaningful as the key is not the correct one.

Consider the ProVerif code in Listing 4.8 describing the behavior of a bidder in Sako's protocol. The bidder process has three parameters: the key b, corresponding to the key representing his bid, his secret key k used for signing and the channel to the bulletin board chBB. He draws a fresh random seed s, encrypts the constant bidval using the price-key b, computes a signature on the ciphertext, executes the event bid on his (signed) offer and sends it to the bulletin board.

The authority (in this case for an instance with two bidders) is modeled as shown in Listing 4.9 on the facing page. Firstly the bids are received from the bulletin board. Then the signatures are checked and the bids are decrypted using the key corresponding to the highest possible price, and the decryptions are published together with a proof. Finally, if the first bidder submitted a bid for the highest price, he is declared a winner, otherwise the second bid is checked. If none of the decryptions is correct, the authority decreases the price and tries l e t a u t h o r i t y ( p1 : skey , . . . , pm: skey , k1 : pkey , . . . , kn : pkey , chBB1 : channel , . . . , chBBn : channel , chO11 : channel , . . . , chOn1 : channel , . . . , chO1m : channel , . . . , chOnm : channel , chW : c h a n n e l ) = i n ( chBB1 , ( m1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ;

. . . i n ( chBBn , ( mn: b i t s t r i n g , sn : b i t s t r i n g ) ) ; i f c h e c k s i g n ( s1 , k1 ) = m1 && . . . && c h e c k s i g n ( sn , kn ) = mn then l e t dec11 = dec (m1, p1 ) i n out ( chO11 , ( m1, dec11 , d e c P r o o f (m1, dec11 , p1 ) ) ) ; . . . l e t dec1n = dec (mn, p1 ) i n out ( chOn1 , ( mn, dec1n , d e c P r o o f (mn, dec1n , p1 ) ) ) ; i f dec11 = b i d v a l then e v e n t won (

) e l s e i f . . . . . . e l s e i f dec1n = b i d v a l then e v e n t won (mn, pn ) ; out (chW, ( mn, sn , n , one ) ) e l s e . . . l e t decm1 = dec (m1,pm) i n out (chO1m , ( m1, decm1 , d e c P r o o f (m1, decm1 ,pm ) ) ) ; . . . l e t decmn = dec (mn,pm) i n out (chOnm , ( mn, decmn , d e c P r o o f (mn, decmn ,pm ) ) ) ; i f decm1 = b i d v a l then e v e n t won (m1, p1 ) ; out (chW, ( m1, s1 , one ,m) ) e l s e i f . . . . . . e l s e i f decmn = b i d v a l then e v e n t won (mn, pm ) ; out (chW, ( mn, sn , n ,m) ) . bidder one bids the same highest price one and wins. In situation one bidder two bids price two, in situation two he bids three. Since he loses in both situations, no information about his bid should be leaked, and both situations should be observationally equivalent. If we suppose an honest authority, ProVerif is able to prove this result.

ProVerif can prove the result even if we add a corrupted bidder, which might appear suprising as it is possible to copy bids. However, as only the losing bids are required to be private, an attack similar to the one on the protocol by Brandt does not work: the copied bid does not influence the outcome as anyway the honest bidder with the higher bid wins.

Note that the protocol is neither receipt-free nor coercion-resistant as the random values used to encrypt the constant can be used as a receipt.

Remark

In the literature an attack on fairness was described [START_REF] Abdalla | Robust encryption[END_REF][START_REF] Farshim | Robust encryption, revisited[END_REF]. The attack targets the implementation using the ElGamal encryption and works as follows. A dishonest bidder encrypts the constant using a key of his choice, but using zero as a random value. He obtains a ciphertext of the form (1, M ), which decrypts under any private key. A dishonest authority can then decrypt the bid at any chosen price, for example one euro higher than the highest other bid. This attack violates Highest Price Wins: a corrupted bidder that did not submit the highest bid wins -yet still we did not identify it for several reasons:

-We assume an honest authority, whereas the attack requires the authority to collude with the bidder.

-As we use an abstract model of the encryption, the underlying weakness of the ElGamal scheme is not represented in model. Our equational theory permits decryption only using the secret key corresponding to the public key used for encryption. This not surprising, as we wanted to check the high-level protocol, not the ElGamal-based implementation.

If we decide to consider dishonest authorities, we obviously have even simpler attacks: the authorities can simply announce a winner and winning price of their choice. To circumvent this problem, the protocol was designed to be verifiable, i.e. the bidders can verify the announced winner as the authorities provide proofs of correct decryption. In Section 4.4.3.1 we analyze verifiability in Sako's protocol in detail, and show that this attack will be detected during the verification phase. This allows us to argue that the assumption that the authority is honest is reasonable -if it behaves dishonestly, this can be detected in the verification phase.

-Summary

In this section we formalized auction protocols in the Applied π-Calculus and modeled fairness, authentication and privacy properties. We verified three case studies using ProVerif: the protocol by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], the protocol by Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and the protocol by Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF].

We identified several problems with the protocol by Curtis et al.: We need to encrypt the first message to ensure Weak Noninterference, and we need to add authentication for the messages from the RA to the seller to ensure Non-Repudiation. We also need to introduce synchronization for privacy. Even with these modifications, ProVerif still finds attacks for Highest Price Wins and Non-Cancellation by mixing several instances. This could probably be addressed by using different keys for different instances and counting the number of bids, however we were unable to analyze this in ProVerif because of a technical limitation of the tool: counting the number of bids requires to maintain state information, which is not supported in ProVerif.

The protocol by Brandt ensures Weak Noninterference, however fails to achieve any other property (including privacy) due to the lack of authentication.

Finally the protocol by Sako turns out to ensure all properties except for receipt-freeness and coercion-resistance, assuming an honest authority.

Verifiability in Auctions

In the previous section we discussed Fairness, Privacy and Authentication properties of auction protocols in the Applied π-Calculus. In this section we concentrate on Verifiability, but using a more general model that can be instantiated in the symbolic model (where we use the Applied π-Calculus again) and computational model (where we use CryptoVerif).

Auction verifiability is easy to achieve in isolation, as for example in the English "shout-out" auction. However, maintaining verifiability while ensuring other properties such as privacy is far more difficult. Yet in the literature verifiability is often claimed together with other properties, but these papers typically only provide informal arguments, e.g. [START_REF] Sako | An auction protocol which hides bids of losers[END_REF][START_REF] Brandt | How to obtain full privacy in auctions[END_REF]. To address this issue, we propose a generic formal framework to analyze verifiability independent of the type of auction implemented in the protocol.

The main contribution of this section is to identify a set of scheme-independent definitions, which, taken together, cover verifiability of auctions. To this end, we focus on the bidders (distinguishing verifiability for losing bidders from the winning bidder) and the seller. We present this framework as a set of formal verifiability tests. Moreover, we investigate the auction protocols by Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF] and by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF]. Sako claims verifiability without a formal proof, and we are able to give a computational and a symbolic proof for her protocol as our first case study. For the second protocol by Curtis et al. we identify several shortcomings with respect to verifiability. The rest of this section is structured as follows. In Section 4.4.1, we describe the new abstract model of auction protocols. In Section 4.4.2, we formalize the verifiability definitions, taking into account the point of view of the seller and the bidders. In Section 4.4.3, we then apply our model to the two examples.

-A Different Model of Auction Protocols

As explained above, we use a very general model of auction protocols in this section. We only specify the parts necessary to define verifiability, and remain very abstract to allow instantiations in different concrete models.

We consider a set of bidders B and a seller S. We do not model other parties as only bidders and the seller verify the execution of the protocol.

Bids are of type Bid (in the simplest case just a price). When being submitted the bids might be encrypted or anonymized to ensure privacy, hence we use the type EBid for such bids. We assume that there is a public list L of length n and type List(EBid) of all submitted bids, for example a bulletin board. To define the soundness of the verification tests we need a mapping between both types, i.e. a function getPrice : EBid → Bid that gives the bid for an encrypted bid. This function does not need to be computable for any party, as it is only used in the soundness definition.

Bidders have to register at some point, or are otherwise authenticated when bidding, in order to be able to obtain their goods once the auction has ended. This could for example be implemented using signatures, authentication tokens, MACs etc.. Therefore we require a function isReg : EBid → {true, false} that returns true if a bid was submitted by a registered bidder, and not modifiedthis integrity protection is necessary to prevent manipulation of bids.

In addition, we require a public function that -given a list of bids -computes the index of the winning bid within the list of all bids: win : List(Bid) → Index. This might simply be the index of the maximal bid among all bids, but there may be more complex operations to determine this index depending on the type of auction or to deal with ties (i.e. several maximal bids).

Lastly, we assume that the variable winBid of type Index refers to the index of the announced winning bid at the end of the auction, and that each bidder has a variable myBid of type Index that refers to the index of his bid in L.

Note that for a list l we write l[i] to denote the i-th element of the list starting with 1, and Indices(l) to denote the set of indices of l, i.e. {1, . . . , n} if l contains n elements.

Definition 71 An auction protocol is a tuple (B, S, L, getPrice, isReg, win, winBid) where -B is the set of bidders, -S is the seller, -L is a list of all submitted bids, -getPrice : EBid → Bid is a function mapping submitted bids to bids, -isReg : EBid → {true, false} is a function that returns true if a bid was submitted by a registered bidder, -win : List(Bid) → Index is a function that returns the index of the winning bid, -winBid is a variable referring to the index of the winning bid at the end of the auction.

-Defining Verifiability

Now we formally define verifiability for auction protocols with respect to the new generalized model. In the first part we consider only first-price auctions.

Thereafter we generalize the definitions to account for second-price, multi-price, and other types of auctions. § 4.4.2.1. First-Price Auctions. To understand which verifications are needed, we start by discussing three different stakeholder's perspectives:

-A losing bidder wants to be convinced that he actually lost, i.e. that:

the winning bid was actually superior to his bid (as defined by the win function), and that the winning bid was submitted by another bidder (preventing both seller and auctioneer from maliciously adding or manipulating bids to influence the final price).

-A winning bidder wants to check that:

he actually submitted the winning bid, -the final price is correctly computed, -all other bids originated from bidders, and no bid was modified.

Together, these verification checks ensure that the winning bidder is indeed the correct winner, for the correct price. Moreover, the last two checks ensure that the auction process was only influenced by legitimate bidders -neither seller nor auctioneer influenced the process.

-The seller wants to verify that:

the announced winner is correct, and the winning price is correct, in particular if the outcome of the auction was not determined publicly (e.g. privately by the auctioneer, or using distributed computations among the bidders).

To execute these verifications, we introduce the notion of Verification Tests.

Definition 72 (Verification Test) We define a Verification Test as an efficient terminating algorithm that takes as input the data visible to a participant of an auction protocol and returns a Boolean value.

We deliberately do not specify more details at this point as they will depend on the underlying protocol model. Such a test could be a logical formula (whose size is polynomial in the input) in a symbolic model or a polynomial-time Turing-machine in a computational model. Obviously there can be different tests for different participants (e.g. for bidders and the seller), since they may have different views of the protocol execution.

We then define verifiability as follows. as well as the following completeness condition:

-If all participants follow the protocol correctly, the above tests succeed (i.e., the implications hold in the opposite direction, ⇐=, as well).

where -with abuse of notation -we write getPrice(L) for getPrice(L[1]), . .

., getPrice(L[n]).

Consider the perspective of a losing bidder: He can verify that his bid was not the winning bid (ov l ), and that the winning bid was among the ones submitted by registered bidders, which were also not modified (rv s and rv w ). Similarly a winning bidder can check that his bid was actually the winning bid (ov w ), and that the other bids were submitted by other bidders and not modified (rv s ). Lastly, the seller can also check that the bids using for computing the winner were submitted only by registered bidders (rv s and rv w ), and that the outcome was correct (ov s ). Hence these tests cover all the verifications discussed above.

In the case of soundness, we require the conditions to hold even in the presence of malicious participants (since the tests should check if they did their work correctly), whereas in the case of completeness we only consider honest participants. This is necessary as otherwise e.g. a dishonest auctioneer could announce the correct result, but publish incorrect evidence. Hence the verification tests fail although the outcome is correct, but this is acceptable since the auctioneer did not "work correctly" in the sense that he deviated from the protocol specification.

Definition 73 can be applied to sealed-bid auctions, where all bids are submitted in a private way, as well as English auctions, where the price increases with each publicly announced bid. These latter are verified by applying the verification tests after each price increase.

Example 22 Consider a simple auction system where all bidders publish their (not encrypted and not signed) bids on a bulletin board, and at the end of the bidding phase the auctioneer announces the winner. In this case there is a simple test for rv w : anyone can simply test if the winning bid is one of the published ones. However there is no test for rv s since bids are not authenticated. If we require bidders to sign their bids before publishing them, we also have a simple test for rv s : verifying the signatures.

It is clear that we have simple tests for ov l , ov w and ov s since everybody can compute the winner on the public list of unencrypted bids. This however means that the protocol ensures no privacy, and no fairness since a bidder can choose his price depending on the previously submitted bids. If we add encryption for the bids to address this shortcoming, the situation becomes more complex and the auctioneer has to prove that he actually computed the winner correctly, for example using zero-knowledge proofs. § 4.4.2.2. Other Types of Auctions. Our definition can be extended to other auctions, including second-price auctions, more general (M + 1)st-price auctions, and even bulk-good auctions that have multiple winners at different prices. In a bulk-good auction, a seller offers N units of a good, and bidders can make offers such as "I want to buy X units at price Y ". In that case there may be a several winners, where each of them pays a different price. More generally, we could also imagine situations where the winner has to pay the mean of the first three bids, or other more complex values. In these types of auctions the price does also depend on the other submitted bids, and not only on the winning bid.

To deal with this, we enrich our model of an auction protocol with a type Price. The function win now returns a list of winners and prices win : List(Bid) → List(Index × Price). We also assume that for each bidder there is a variable myPrice of type Price instantiated as the price announced to a winning bidder respectively. Similarly winBid is now instantiated as a list of indices of bids and prices (List(Index × Price)).

For such auctions, registration verifiability does not change, but the winner(s) and the seller also want to verify the price they pay to prevent a malicious party from manipulating the price(s).

In the following definition we mark differences to Definition 73 in bold. where -with abuse of notation -we write getPrice(L) for getPrice(L[1]), . .

., getPrice(L[n]).

Note that e.g. in the case of a second-price auction verifying the price, for example in test ov w , may implicitly include some more registration verification, namely checking that the second-highest bid was actually submitted by a bidder. Otherwise a malicious seller could add a higher second-highest bid or manipulate the existing one to achieve a higher selling price. This is however included in our model as the function win only works on the list L, hence adding another bid later on to manipulate the bidding price violates the test, and adding or manipulating a bid in L violates rv s .

-Case Studies

We now discuss the two case studies: the protocols by The verification tests proposed by Sako can be translated to our framework as follows: The test rv s simply checks all the signatures. For rv w one can check if the encrypted value appears in the list of bids on the bulletin board when the winner is announced. Finally the test for ov l , ov w and ov s works as follows: Any participant can check that all decryptions corresponding to a potentially higher bid were unsuccessful (i.e. the result was different from M t ), and verify the proofs of correct decryption. To check if he won or lost, a bidder can simply compare his bid to the winning price. Similarly the seller can check if the announced winning bid is actually the winning bid.

We analyze the protocol in two different settings. We start using the Applied π-Calculus and ProVerif and give a first, symbolic analysis. Then, to show that our high-level model can also be instantiated in a computational setting, we provide a computational analysis with the help of CryptoVerif.

Verifiability in the Symbolic Setting. Based on the modeling of the protocol from Section 4.3.5.3 we also model the proposed tests in the Applied π-Calculus and formally show that they are actually sound and complete. The proofs are done by ProVerif for a simple case (e.g. only two bidders), and then extended manually to the general case. This is necessary as ProVerif is unable to handle the general case directly.

In order to verify the verification tests we model them as processes: they receive the necessary data on some channels and output whether they accepted this input or not. This also allows us to check soundness and completeness of the tests in ProVerif, since these properties can be modeled as reachability properties such as "If the input to the test was generated by honest participants according to the protocol, can the process "test" emit a message "KO"?" (which corresponds to completeness) or "Is it possible for an attacker to send messages to the process "test" such that it emits a message "OK" although the input is not correct?" (which corresponds to soundness).

The first test rv s , described in Listing 4.12 on the next page, is actually a simple implementation of our soundness condition (∀b ∈ L : isReg(b) = true): It receives all bidders' public keys and the bids, and then verifies all signatures. We show that is sound and complete in Theorem 68.

Theorem 68 The test rv s (see Listing 4.12 on the next page) for the protocol by Sako [Sak00] is sound and complete. l e t t e s t r v s (chRVS : channel , k1 : pkey , . . . , kn : skey , chBB1 : channel , . . . , chBBn : c h a n n e l ) = i n ( chBB1 , ( m1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ; . . . i n ( chBBn , ( mn: b i t s t r i n g , sn : b i t s t r i n g ) ) ; i f c h e c k s i g n ( s1 , k1 ) = m1 && . . . && c h e c k s i g n ( sn , kn ) = mn then out ( chRVS ,OK) e l s e out ( chRVS ,KO) .

Listing 4.12 -The test rv s . l e t t e s t r v s (chRVS : channel , k1 : pkey , . . . , kn : skey , chBB1 : channel , . . . , chBBn : c h a n n e l ) = i n ( chBB1 , ( m1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ; . . . i n ( chBBn , ( mn: b i t s t r i n g , sn : b i t s t r i n g ) ) ; i f c h e c k s i g n ( s1 , k1 ) = m1 && . . . && c h e c k s i g n ( sn , kn ) = mn then out ( chRVS ,OK) ; e v e n t a c c e p t (m1, s1 , . . . , mn, sn ) e l s e out ( chRVS ,KO) ; e v e n t r e j e c t ( ) . Proof We start by showing that it is sufficient to verify the case of only one bid, and that this generalizes to situations with many bids. More precisely, we show that rv s = true ⇒ ∀b ∈ L : isReg(b) = true holds for any length n of L (corresponding to the number of bids). Listing 4.12 on the facing page gives the test rv s for n bids. Let testrvs i denote analogously the test for i bids, and testrvs i * -→ OK denote that -given a protocol executionafter some interactions and reductions it outputs "OK " on channel chRVS. We assume that the test is sound and complete for one bid, i.e. for soundness

testrvs 1 * - → OK ⇒ isReg(L) = true (4.1)
and for completeness

isReg(L) = true ⇒ testrvs 1 * - → OK (4.2)
where L contains only one entry.

Then we can see from the code that

testrvs n * - → OK ⇓ ∀1 ≤ i ≤ n : testrvs 1 { ki /k1, chBBi /chBB1} * - → OK
since testrvs n checks the signatures of all bids on channels chBB1 to chBBn using the keys k1 to kn, and testrvs 1 { ki /k1, chBBi /chBB1} checks the signature of the bid i on channel chBBi using the key ki. If we suppose now that testrvs 1 is sound (4.1), we obtain

∀1 ≤ i ≤ n : testrvs 1 { ki /k1, chBBi /chBB1} * - → OK ⇓ ∀1 ≤ i ≤ n : isReg(List(L[i])) = true ⇓ ∀b ∈ L : isReg(b) = true
We can make a similar argument for completeness:

∀b ∈ L : isReg(b) = true ⇓ ∀1 ≤ i ≤ n : isReg(List(L[i])) = true ⇓ ∀1 ≤ i ≤ n : testrvs 1 { ki /k1, chBBi /chBB1} * - → OK ⇓ testrvs n * - → OK
Hence it is sufficient to check the case of only one bid, i.e. (4.1) and (4.2). As hinted above, these are reachability properties ("The test will not output "OK " if a bid was not submitted by a registered bidder", "The test will not output KO if the bid was correctly submitted by a registered bidder"). We prove (4.1) and (4.2) automatically using ProVerif.

For (4.1) we add two events accept (cf. Listing 4.13 on page 220) and send (inside a registered bidder) to the model, and ProVerif shows that any event accept is preceded by a corresponding send, i.e. the test only accepts bids sent by registered bidders: query m:bitstring, s:bitstring; event(accept(m, s)) ==> event(send(m, s)).

For (4.2) we add an event event reject in the process testrvs (cf. Listing 4.13 on page 220) and ProVerif shows that it is unreachable if an honest bidder sends his bid over a private channel12 : query event(reject()).

The code used is available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

The second test rv w , given in Listing 4.14 on the next page, takes all published bids on channel chBB and the winning bid published on channel chW and checks if the winning bid is among the published ones. This is again the direct implementation of the soundness condition, and we show that it is sound and complete in the following theorem.

Theorem 69

The test rv w (see Listing 4.14 on the facing page) for the protocol by Sako [Sak00] is sound and complete. l e t t e s t r v w (chRVW: channel , chW : channel , chBB1 : channel , . . . , chBBn : c h a n n e l ) = i n ( chBB1 , ( m1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ; . . . i n ( chBBn , ( mn: b i t s t r i n g , sn : b i t s t r i n g ) ) ; i n (chW, (m: b i t s t r i n g , s : b i t s t r i n g , i n d : i n t , p r i c e : i n t ) ) ; l e t t e s t r v w (chRVW: channel , chW : channel , chBB1 : channel , . . . , chBBn : c h a n n e l ) = i n ( chBB1 , ( m1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ; e v e n t onBB(m1, s 1 ) ; . . . i n ( chBBn , ( mn: b i t s t r i n g , sn : b i t s t r i n g ) ) ; e v e n t onBB(mn, sn ) ; i n (chW, (m: b i t s t r i n g , s : b i t s t r i n g , i n d : i n t , p r i c e : i n t ) ) ; Proof Again, Listing 4.14 on the previous page gives the test rv w for n bids, and let testrvw i denote the test rv w for i bids. testrvw i * -→ OK denotes that -given a protocol execution -after some interactions and reductions the test outputs "OK " on channel chRVW. Similarly to rv s , we automatically prove using ProVerif that in the case of only one bid, the test only accepts the winning bid if it was published on the bulletin board (soundness):

testrvw 1 * - → OK ⇒ winBid ∈ Indices(L) (4.3)
using the query query m:bitstring, s:bitstring; event(accept(m, s)) ==> event(onBB(m, s)).

and the annotated process in Listing 4.15 on the preceding page.

We also show that the test succeeds if the authority follows the protocol (completeness):

winBid ∈ Indices(L) ⇒ testrvw 1 * - → OK (4.4)
where L contains only one entry, using the query query event(reject()).

using the same annotations (cf. Listing 4.15 on the previous page), and an honest bidder and an honest authority interacting over private channels.

We now have to show that this generalizes to situations with many bids. More precisely, we need to prove that rv w = true ⇒ winBid ∈ Indices(L) holds for any length n of L (corresponding to the number of bids). Again, by analyzing the code we have

testrvw n * - → OK ⇓ ∃1 ≤ i ≤ n : testrvw 1 { chBBi /chBB1} * - → OK
since testrvw n checks if the winning bid received on channel chW equals one of the bids received on channels chBB1 to chBBn, and testrvw 1 { chBBi /chBB1} checks if the winning bid received on channel chW equals the bid i received on channel 4.4. Verifiability in Auctions chBBi. Using (4.3), we obtain that

∃1 ≤ i ≤ n : testrvw 1 { chBBi /chBB1} * - → OK ⇓ ∃1 ≤ i ≤ n : winBid ∈ Indices(List(L[i])) ⇓ winBid ∈ Indices(L)
We can make a similar argument for completeness:

winBid ∈ Indices(L) ⇓ ∃1 ≤ i ≤ n : winBid ∈ Indices(List(L[i])) ⇓ ∃1 ≤ i ≤ n : testrvw 1 { chBBi /chBB1} * - → OK ⇓ testrvw n * - → OK using (4.4).
For the outcome verification tests we employ a similar approach. Firstly note that for Sako's protocol the tests ov l , ov w and ov s are all the same, described by process testov (Listing 4.16 on the following page). The winning bid, the winning price and the winner's index are announced on channel chW. Morevover the proofs of correct decryption are published on channels chOij. The test then takes the first set of proofs of correct decryption and verifies them (lines 5-9). Then it checks if the announced winning price and winner are correct with respect to the obtained decryptions, i.e. if one of the decryptions corresponds to the constant, and if this is the one announced as the winner (lines 10-17). If within the set no decryption corresponds to the constant, it repeats the same checks for the next set of decryptions and proofs (lines 18-35). Note that the test accepts the case when all decryptions for all prices fail and the winning price is none of the checked ones. This might be the case if the authority correctly followed the protocol, but the bidders sent wrong encryptions. We show that this test is sound and complete in Theorem 70.

Theorem 70 The test testov (see Listing 4.16 on the next page) for the protocol by Sako [Sak00] is sound and complete.

Proof Again, Listing 4.16 on the following page gives the test testov for n bids and m possible prices. Let testov i,j denote the test for i bids and j possible prices, and testov i,j * -→ OK denote that -given a protocol execution -after some interactions and reductions it outputs "OK " on channel chOV, and k = winBid l e t t e s t o v (chOV : channel , chW : channel , pk1 : pkey , . . . , pkm : pkey , chO11 : channel , . . . , chOn1 : channel , . . . , chO1m : channel , . . . , chOnm : c h a n n e l ) = i n (chW, ( m, s , w, p ) ) ; i n ( chO11 , ( c1 , m1, p1 ) ) ; . . . l e t t e s t o v (chOV : channel , chW : channel , pk1 : skey , pk2 : skey , chO11 : channel , chO21 : c h a n n e l ) = i n (chW, (m: b i t s t r i n g , s : b i t s t r i n g , w : i n t , p : i n t ) ) ; i n ( chO11 , ( c1 : b i t s t r i n g , m1 : b i t s t r i n g , p1 : b i t s t r i n g ) ) ;

i n ( chO21 , ( c2 : b i t s t r i n g , m2 : b i t s t r i n g , p2 : b i t s t r i n g ) ) ; the index of the winning bid. Using ProVerif we show that in the case of i = 2 bids and j = 1 price, the test only accepts the announced winner and winning price if they are correct (soundness):

testov 2,1 * - → OK ⇓ (getPrice(L[winBid]) = one ⇒ winBid = win(getPrice(L))) (4.5)
To prove this using ProVerif we use the process depicted in Listing 4.17 on the previous page. The idea is the following: the adversary generates the input for the test, i.e. chooses the keys, generates the bids and proofs of decryption and announces the winner. Every time the test accepts an outcome based on the proofs, we check if the decryptions using the secret key actually give the values they are supposed to give. For example if the winner is bidder one at price one, his bid must decrypt correctly under key pk1 to the constant. Similarly, if the winner is bidder two at price one, his bid must decrypt correctly under key pk1 to the constant and the other bidder's bid must not decrypt correctly under this key. If such a test fails, an event bad is executed. Using the following query ProVerif can then prove that such an event is unreachable: query event(bad()).

We also show that the test succeeds if the authority follows the protocol correctly (completeness):

(getPrice(L[winBid]) = one ⇒ winBid = win(getPrice(L))) ⇓ testov 2,1 * - → OK (4.6)
using -once again -a variant of the process testov containing events reject where the process outputs KO and the query query event(reject()).

We now show that this generalizes to situations with many bids and prices. We start by discussing soundness, the proofs of completeness are analogous. First we prove the generalization to m prices, but still for two bids. We have to show that the following holds:

testov 2,m * - → OK ⇒ winBid = win(getPrice(L))
By analyzing the code we can see that

testov 2,m * - → OK ⇓ ∀1 ≤ i ≤ m : testov 2,1 { pki /pk1, chO1i /chO11, chO2i /chO21, i /one} * - → OK
i.e. that if testov 2,m holds for the winner input from channel chW, prices (i.e. public keys) pk1 to pkm, decryptions and proofs from channels chO11 to chO2m, then for any i testov 2,1 { pki /pk1, chO1i /chO11, chO2i /chO21, i /one} holds for the same winner, but only checking price i instead of one, and hence considering only the price (key) pki and proofs from channels chO1i and chO2i. Using (4.5), we deduce that: Firstly note that in this protocol the highest bid wins, and that in the case of ties the bid with the lowest index in the list wins (cf. Listing 4.9 on page 209), i.e. we have winBid = win(getPrice(L)) We now make a similar argument for completeness, starting again by proving soundness for 2 bids and m prices.

∀1 ≤ i ≤ m : testov 2,1 { pki /pk1, chO1i /chO11, chO2i /chO21, i /one} * - → OK ⇓ ∀1 ≤ i ≤ m : getPrice(L[winBid]) = i ⇒ winBid =
∀1 ≤ i ≤ n : (getPrice(L[i]) ≤ getPrice(L[winBid])) ∧ (getPrice(L[i]) = getPrice(L[winBid]) ⇒ i > winBid) (∀i
winBid = win(getPrice(L)) ⇓ ∀1 ≤ i ≤ m : getPrice(L[winBid]) = i ⇒ winBid = win(getPrice(L)) ⇓ ∀1 ≤ i ≤ m : testov 2,i { pki /pk1, chO1i /chO11, chO2i /chO21, i /one} * - → OK ⇓ testov 2,m * - → OK
We conclude for n bids as follows.

winBid = win(getPrice(L)) ⇓ (∀i < winBid : win(getPrice(L[i], L[winBid])) = 2) ∧ (∀i > winBid : win(getPrice(L[winBid], L[i])) = 1) ⇓ (∀i < winBid : testov 2,m { chOi1 /chO11, chOk1 /chO21, . . . , chOim /chO1m, chOkm /chO2m, two /w} * - → OK ) ∧ (∀i > winBid : testov 2,m { chOk1 /chO11, chOi1 /chO21, . . . , chOkm /chO1m, chOim /chO2m, one /w} * - → OK ) ⇓ testov n,m * - → OK
We thus conclude that all proposed tests are sound and complete, hence the protocol by Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF] is verifiable. The code used is available on our website [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

Verifiability in the computational setting. Next, we analyze both soundness and completeness of the verifiability tests in the computational setting using CryptoVerif [START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF]. CryptoVerif has two input modes: the mode "channels" and "oracles". The mode "channels" takes process descriptions and queries similar to ProVerif. These are then translated into "oracles", and CryptoVerif tries to prove the queries using a sequence of games. This sequence of games can be found automatically in simple cases, or manually using an interactive front-end. Each transition can be a simplification of the current game, the application of an equation or of a cryptographic hypotheses such as IND-CPA (indistinguishability under chosen plaintext attacks [START_REF] Bellare | Relations among notions of security for public-key encryption schemes[END_REF]) for public key encryption or UF-CMA (existential unforgeability against adaptive chosen message attacks [START_REF] Goldwasser | A digital signature scheme secure against adaptive chosen-message attacks[END_REF]) for signatures. For more details on CryptoVerif, we refer to the original paper [START_REF] Blanchet | A computationally sound mechanized prover for security protocols[END_REF] or the CryptoVerif Manual [BC12].

Due to the similarities with ProVerif, we employ the mode "channels". We do not repeat the model and tests, but directly discuss the verification games. However, as we are not in a symbolic setting any more, we need to slightly adapt our model. We replace the abstract primitive "proof of correct decryption" with the implementation originally proposed by Sako: the authority simply reveals the secret key to enable verification of the decryption. Again, the entire code used is available on our website [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

For the first test, rv s , we assume a UF-CMA probabilistic signature scheme. In Listing 4.18 on the next page we present our CryptoVerif code which works as follows: up to N bidders post their bids on the bulletin board (the choice of the price is left to the adversary), and then the adversary can submit bids to the test. Note in here we model the test for N bidders by allowing the adversary to submit N messages, and that he wins if he can reach the event accept(m) at least once without using one of the honest bids.

CryptoVerif is able to conclude automatically that the test is sound, i.e. it will only accept registered bidders: each event accept(m) is preceded by an event send(m). For N bidders the advantage computed by CryptoVerif is N * adv sign , where adv sign is the advantage against the signature scheme. Similarly, in Listing 4.19 on the facing page, we describe our CryptoVerif code for completeness of rv s : A honest bidder creates his keys, registers himself and submits a bid to the test. To avoid false attacks, we use "inlining" again, i.e. we merge the bidder's process with the test process. CryptoVerif concludes automatically that the event reject is unreachable, i.e. that such bids are always accepted. Here we need no cryptographic hypothesis, only the correctness of the signature scheme, i.e. that check(m, pkgen(r), sign(m, skgen(r), r2)) = true holds for any message m and any seeds r and r2. The computed advantage is 0, but this only means that -since the signature scheme is correct -the bid will always be accepted. CryptoVerif immediately finishes the soundness and completeness proofs for test rv w (Listings 4.20 and 4.21 on the following page, respectively). For soundness we prove that each event accept(m,s) is preceded by an event onBB(m,s). For completeness we show that the event reject is unreachable. Again, we connect the processes directly to not rely on channels in order to avoid false attacks. We note that CryptoVerif does not rely on any cryptographic hypothesis for proving soundness or completeness of this test, hence the adversary has an advantage of 0 in both cases. holds for any message m, secret key r and seed r2. For soundness we also need two properties about the keys:

-we assume that there is a function pkgen which computes the corresponding public key to a given secret key, and -if several different secret keys share the same public key, all decryptions (i.e. using any of the private keys sharing the same public key) give the same result. This is in particular the case for the ElGamal encryption scheme used in the implementation proposed by Sako: given a secret key x one can compute the public key y = g x mod n, and any secret key x with g x = g x mod n decrypts correctly. Completeness can again be verified automatically for the base case with two bidders and one price 13 , however we were unable to prove soundness, even in CryptoVerif's manual mode. This is due to the heuristic employed in CryptoVerif's handling of equations, prohibiting the application of equations where both sides are complex terms, i.e. not a simple variable [START_REF] Blanchet | Re: Lien exact entre proverif et le pi-calcul applique [e-mail[END_REF]. Hence, we prove Theorem 71 manually.

Theorem 71

The test for ov {l,w,s} (see Listing 4.22 on page 237) is sound with advantage 0 if the following conditions hold:

-we assume that there is a function pkgen which computes the corresponding public key to a given secret key, and dec(enc(m, pkgen(r), r2), r) = m holds for any message m, secret key r and seed r2

-if several different secret keys share the same public key, all decryptions (i.e. using any of the private keys sharing the same public key) give the same result: if pkgen(r) = pkgen(r ) then dec(enc(m, pkgen(r), r2), r) = dec(enc(m, pkgen(r), r2), r )

Proof Consider the test in Listing 4.22 on page 237. We have to show that it is sound, i.e. that it will only accept correct outcomes. Similar to the symbolic case above, we show that when the test accepts the provided data, this corresponds to a correct outcome. More precisely, we show that if a bid is accepted as a winning bid, it actually decrypts to the constant under the private key corresponding to the claimed price, and that none of the other bids decrypts under any of the keys corresponding to higher prices.

Consider the first acceptance in line 9. By the test pk1=pkgen(p1) in line 3 we know that p1 is a correct secret key for the published public key pk1, i.e. by the hypotheses decrypts to the same value as the original secret key (the key used to generate the public key used do encrypt). Note that the test in line 3 is important, otherwise an attacker could submit a wrong secret key to claim that no ciphertext decrypts to bidval. Hence the following tests to check that the decryptions are correct (lines 3-4) use a correct key. Thus, the tests following in lines 5-7 operate on correctly decrypted values, and only accept if the announced winner corresponds to the observed (correct by the previous tests) decryptions.

If none of the decryptions gives the constant bidval, i.e. no bidder chose the price corresponding to the key pk1, the same procedure is repeated for the next key. Finally, if even for the last key no decryption returns the constant, the test stills as there was apparently no valid bid for any of the prices -this might correspond to bidders spoiling their bids on purpose.

Finally, the adversary's advantage is 0, as none of the used hypothesis gives the adversary any advantage.

Remark In Section 4.3.5.3 we discussed the attack by Abdalla et al. [START_REF] Abdalla | Robust encryption[END_REF] on fairness. It turns out that this attack can be discovered if the verification is carried out as specified in Listing 4.22 on the next page.

Recall the attack: the dishonest bidder uses the randomness 0 to encrypt his bid, hence the resulting ciphertext has the form (1, bidval), and decrypts correctly under any key to the value bidval. This allows a colluding authority to open the bogus bid at a price of his convenience, for example at price x m + 1 if x m is the value of the highest bid. This however is not possible if the verification is carried out correctly. If the authority decides to open the bogus bid at price x m + 1, he has to prove that the bogus bid does not decrypt to the value bidval for any key corresponding to a price higher than x m + 1. Since the bogus bid decrypts under any key, he is unable to do so. The only possible way to pass the verification test is to open the bogus bid at the highest possible price and to declare the dishonest bidder a winner at this price, since then no other keys are used in the verification. This however gives the bidder no advantage over simply submitting a bid for the highest price using a correct encryption, hence the attack does not compromise fairness if the verification is carried out correctly.

Note however that our relatively abstract modeling of the encryption scheme and its correctness is not able to identify the underlying problem of using a particular random seed to construct an illegal ciphertext: equation (4.9) states nothing about the result of a decryption using a secret key that does not correspond to the public key used for encryption. To detect this issue, we would need to explicitly model the ElGamal encryption and its mathematical properties. l e t t e s t r v w ( chP1 : channel , . . . , chPn : channel , chW : channel , chRVW: c h a n n e l ) = i n ( chP1 , ( p1 : b i t s t r i n g , c1 : b i t s t r i n g , h1 : b i t s t r i n g ) ) ;

. . . i n ( chPn , ( pn : b i t s t r i n g , cn : b i t s t r i n g , hn : b i t s t r i n g ) ) ;

i n (chW, ( p : b i t s t r i n g ) ) ; l e t t e s t r v w ( chP1 : channel , . . . , chPn : channel , chW : channel , chRVW: c h a n n e l ) = i n ( chP1 , ( p1 : b i t s t r i n g , c1 : b i t s t r i n g , h1 : b i t s t r i n g ) ) ;

e v e n t o n L i s t ( p1 ) ;

. . . i n ( chPn , ( pn : b i t s t r i n g , cn : b i t s t r i n g , hn : b i t s t r i n g ) ) ;

e v e n t o n L i s t ( pn ) ; With respect to our model of verifiability, we have the set of bidders B and a seller S. We do not need to specify the type of bids Bid since the protocol supports any type of bids. The bids are published when the auctioneer reveals the symmetric key, i.e. L contains bids of the following type: (Pseudo × PEnc(Bid) × Hash), where Pseudo is the type of pseudonyms, PEnc is a public-key encryption and Hash are hash values. The function getPrice simply decrypts the encrypted bid (the second entry of the tuple). The function isReg returns true if and only if the hash value is correct, the pseudonym was actually attributed by the RA and the bid was submitted correctly signed by the bidder with this pseudonym. The protocol is independent of the used auction mechanism and hence does not define win. The seller simply decrypts all bids and can then apply any function win. He publishes the winning price and the winning bidders pseudonym, and winBid denotes the index of the bid containing this pseudonym.

As a concrete instance of this abstract model, we employ the model in the Applied π-Calculus already used in Section 4.3.5.1. l e t t e s t r v s ( k1 : pkey , . . . , kn : pkey , chH1 : channel , . . . , chHn : channel , chP1 : channel , . . . , chPn : channel , chRVS : c h a n n e l ) = i n ( chH1 , ( h1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ;

. . . i n ( chHn , ( hn : b i t s t r i n g , sn : b i t s t r i n g ) ) ;

i n ( chP1 , ( p1 : b i t s t r i n g , c1 : b i t s t r i n g , h1 : b i t s t r i n g ) ) ;

. . . i n ( chPn , ( pn : b i t s t r i n g , cn : b i t s t r i n g , hn : b i t s t r i n g ) ) ; l e t t e s t r v s ( k1 : pkey , . . . , kn : pkey , chH1 : channel , . . . , chHn : channel , chP1 : channel , . . . , chPn : channel , chRVS : c h a n n e l ) = i n ( chH1 , ( h1 : b i t s t r i n g , s 1 : b i t s t r i n g ) ) ;

. . . i n ( chHn , ( hn : b i t s t r i n g , sn : b i t s t r i n g ) ) ;

i n ( chP1 , ( p1 : b i t s t r i n g , c1 : b i t s t r i n g , h1 ' : b i t s t r i n g ) ) ;

. . . i n ( chPn , ( pn : b i t s t r i n g , cn : b i t s t r i n g , hn ' : b i t s t r i n g ) ) ; Analysis. As already noted in Section 4.3.5.1, the protocol does not specify the output computation, hence we do not consider the tests ov s , ov l and ov w .

For rv w we propose the following test: checking if the pseudonym of the winner appears in the list of bids. Using ProVerif we were able to show that this test (Listing 4.23 on page 238) is sound and complete, using the same techniques as in the case of the protocol by Sako: we instrument the process with events (Listing 4.24 on page 238), and show that any accept(p) is preceded by a corresponding onList(p). Similarly we show that if a honest seller announces one of the bidders as the winner, the event reject is unreachable14 . In both cases we only consider the case with one bidder, however we can show that this generalizes to an arbitrary number of bidders similarly to Theorem 69 on page 222.

For rv s the situation is more complicated. Essentially, a verifier can only check if the hash was correctly signed when previously submitted to the RA as all other data is encrypted or otherwise inaccessible. We implemented such a test in ProVerif (Listing 4.25 on the previous page) and were able to prove its completeness using the same technique as above: we show that the event reject is not reachable if all parties are honest. To check soundness we verify if each event accept is preceded by the corresponding send, where send is an event executed by the bidders when submitting the bid. ProVerif immediately finds an attack: since the messages from the RA to the seller are not authenticated, anybody can modify all values except for the hash, in particular the pseudonyms. Hence there is no assurance that a pseudonym actually corresponds to a bidder. Even if the messages from the RA were authenticated, a verifier still needs to trust the RA, since the RA can still manipulate the pseudonyms, for example swap two pseudonyms or create fake ones. Note also that if we want to ensure privacy of the bids the first message containing the signed hash also needs to be encrypted (cf. Section 4.3.5.1), hence even this insufficient check is not possible any more.

Curtis et al. explicitly state that the RA needs to be trusted for correctness. However, they also propose a property "robustness" which states that an auction protocol should be able to handle corrupt behavior. Clearly, their protocol is not robust to dishonest behavior by the RA, and this cannot be fixed using verification checks, as they also would require trust in the RA. We argue that basing verifiability tests on such a trust assumption at least partly contradicts the main point of verifiability, which is to back up trust assumptions by providing evidence that a trusted party actually behaved honestly.

Again, the code used is available on our website [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

-Summary

In this section we defined verifiability for auction protocols using a high-level model that can be instantiated with different concrete model, including symbolic and computational ones. Our definitions cover first-price auctions as well as second-price or even bulk good auctions.

We applied our definitions on two case studies. Our first example, the protocol by Sako, ensures verifiability as it provides sound and complete verification test. We showed this in a symbolic setting using ProVerif and in a computational setting using CryptoVerif. The protocol by Curtis et al. is our second case study and suffers from several problems. For example the bids lack authentication in the last step of the protocol, and one needs to trust the registration authority to manage the pseudonyms correctly.

Towards True Bidder-Verifiable Auctions

In the previous section we defined and analyzed verifiability. As discussed in the introduction, the goal of verifiability is to enable the participants to verify the correct execution of the protocol in order to reduce the necessary trust hypothesis. We were able to show that the protocol by Sako, one of our two case studies, fulfills our definition of verifiability. However, to achieve this, it relies on cryptographic operations such as signatures and public-key cryptography.

Yet, achieving verifiability through cryptography is somewhat disingenuous: any participant lacking cryptographic expertise cannot ascertain for himself that the verification procedure is indeed correct, and is thus forced to trust the judgment of cryptographic experts that designed this procedure. This means that to some extent the verification procedure does not reduce the necessary trust, but simply shifts the trust from the parties participating in the protocol execution to the cryptographers that designed the protocol.

The same problem was already identified in electronic voting. In 2004, Chaum [START_REF] Chaum | Secret-ballot receipts: True voter-verifiable elections[END_REF] argued along the same lines that the verifiable cryptographic voting protocols proposed up to this date did little to empower actual voters to verify elections, as even the verification procedures were to complex for a normal voter to understand. This view was shared by the German Constitutional Court in its decision on electronic voting machines: "the use of electronic voting machines requires that the essential steps of the voting and of the determination of the result can be examined by the citizen reliably and without any specialist knowledge of the subject" [Bun09]. To address this issue, Chaum proposed a voting protocol using visual cryptography: the ballot was distributed over two layers that on top of each other showed the voter's choice. Then, one layer was destroyed, leaving the voter with a layer full of random dots from which no choice can be inferred. However, anyone can verify that the system accurately recorded this layer -without any cryptographic expertise. Chaum called this "true voter-verifiable elections", hence our idea of "true bidder-verifiable auctions".

In this section we explore this idea of "true bidder-verifiable auctions" based on physical properties. We propose two examples of protocols ensuring "true bidder-verifiability". Although these protocols have some limitations with respect to scalability, they illustrate how we can realize secure auctions by exclusively relying on physical objects and their properties. Since we already established our formal security definitions for auctions protocols (Fairness, Authentication, Privacy and Verifiability), we also propose a first approach allowing to model physical objects and their properties in the Applied π-Calculus, in an attempt to apply our previous definitions on the new physical protocols.

Inspired by Sako's protocol, we propose a physical protocol called Cardako15 . This protocol does not rely on cryptography nor on trusted parties, yet retains the verifiability, privacy, authentication and fairness properties of Sako's protocol. We provide a formal analysis of these security properties in ProVerif, modeling their physical properties using a special equational theory. Although ensuring privacy for the losing bidders (if the authorities are trusted), both the Sako and the Cardako protocol publicly reveal the winner.

To improve privacy, we propose Woodako16 : a physical auction protocol that only reveals the winner and winning price to the seller and the winner, but not to the losing bidders (similar to [START_REF] Brandt | How to obtain full privacy in auctions[END_REF]). However, we show that the result remains verifiable even for losing bidders. We build a concrete prototype of this protocol, and verify the security properties with the help of ProVerif.

We argue that both protocols can be understood by a non-expert in the spirit of "true bidder-verifiable auctions".

-The "Cardako" Protocol

The Cardako protocol is a practical implementation of the main concepts of Sako's protocol [Sak00] using office material. § 4.5.1.1. Description. In the Cardako protocol each bidder has a piece of cardboard marked with a number of positions corresponding to possible prices in descending order from left to right (see Figure 4.4 on the facing page). A bidder chooses his price (in Figure 4.4, the second-highest price p m-1 ), and punches a hole in the position corresponding to his bid. Next, he inserts the card into a special envelope of the same size with marks corresponding to the different prices on the outside (see Figure 4.5 on the next page), and signs on the outside of the envelope. The envelope is sealed and shown to all other bidders so that they can check the signature. Once all bidders have finished creating bids and shown their signatures, the bidders swap envelopes and jointly try to punch a needle through the marked areas of each envelope, starting with the highest possible price. If this succeeds, they find a hole and hence a bid for this price. The signature on the outside then allows the identification of the winner. If this fails for all bids, the bidders repeat the procedure for the second price, etc.. Since the order of the prices is important, the cards and envelopes are designed such that they can only fit together in one way. This ensures that the card cannot accidentally or maliciously be turned around.

To fully ensure verifiability, the protocol must also ensure that only eligible bidders can bid. This is achieved through the verification of the signatures on the envelopes by the seller and bidders when bids are posted. The Cardako protocol relies on the physical properties of the cardboard and the envelopes: Nobody can see from the outside the contents of a bid, but by trying to punch with a needle the bidders can test if it was an offer for a certain price. It offers verifiability similar to Sako's protocol as well as non-cancellation and non-repudiation due to the signatures and the swapping of the envelopes. It ensures fairness since no premature information is leaked (Weak Non-Interference) and due to the joint bid opening no cheating is possible (Highest Price Wins).

Obviously a malicious bidder can open an envelope and read its contentsbut this is actually similar to Sako's protocol, where dishonest authorities can break privacy. The difference is that in Cardako such a behavior will be detected by the other bidders, since the envelope is damaged and the other parties are in the same room. An extension to improve privacy could be to put the signed envelopes into slightly bigger and indistinguishable envelopes after the signature has been verified by the other parties. These envelopes can be posted into a ballot box to break the link between a bidder and his bid. Hence a malicious bidder will only be able to break the privacy of a random bid, but not necessary the one he is interested in.

A positive side effect of using indistinguishable envelopes is that ties can be detected and resolved fairly without revealing the identities of the tied bidders (unlike Sako's protocol). This happens as follows: first, the protocol determines which envelopes contain winning bids. As the envelopes are indistinguishable from one another, the identity of the tied bidders is not revealed yet. The tie is then broken by selecting a random envelope (e.g. by rolling a die, or drawing an envelope from a hat). § 4.5.1.3. Formal Analysis. We model the bidders as processes exchanging messages (envelopes or real communication messages), however we also need to model the physical properties of the objects used. Our approach consists in modeling the properties using an equational theory. We describe the envelope using a function envelope that is created using a random seed to hide its contents and can only be opened using that seed, similar to a cryptographic commitment. However we also have functions testone, testtwo, . . . , testm, that can test for a certain value without opening the envelope (i.e., the needle tests The last three equations model signatures. The first equation allows to verify a signature, the second equation to obtain the signed message, and the last one to identify the person who signed the message.

The honest participants obviously only test for the values that they are supposed to, but dishonest participants can also apply tests they are not supposed to execute. To model the fact that any party in possession of an envelope can open it, the bidders give away the random seed they used to create it when giving away the envelope.

The process model is given in Listings 4.27 on the preceding page, 4.28 and 4.29. The bidder (Listing 4.27 on the previous page) encloses his bid inside the envelope and sends the envelope together with the key to the synchronization and swap process (Listing 4.28). This process waits until he has all bids, and then redistributes them in inverse order over all bidders. This is to model that once all envelopes are ready, they are swapped between the bidders. The bidders then receive the envelopes, and test for the first (i.e. highest) price. If this succeeds, they announce the winner and stop. If it fails, they let the other bidders know, and wait if any of the other bidders finds a winner. If yes, they stop, otherwise they test for the next possible price, and so on. to check the registration one checks the signatures and if the announced winner is among the initial bids.

This model allows us to repeat the same verification steps as for Sako's protocol18 and to conclude that the protocol ensures Non-Repudiation, Non-Cancellation, Weak Non-Interference, Highest Price Wins and Verifiability.

When verifying Privacy, ProVerif finds the obvious attacks of opening the envelopes or testing for all values. If however we keep the seeds private and remove all tests except for the required ones (in an attempt to model the fact that bidders do not want to risk being caught when breaking the rules) ProVerif is able to prove secrecy of the losing bids. All the above verifications succeed within a few seconds on a standard office PC.

The full code is available online [START_REF] Dreier | The code and scripts used to automatically verify the examples is available at[END_REF].

-The "Woodako" Protocol

To improve the privacy of the Cardako protocol, we developed Woodako, which relies on a special wooden box. Our prototype is designed for 3 bidders and 5 possible prices, but such a box can be built for any number n of bidders and any number k of prices. Figure 4.6 on the facing page shows all components of the box. The Woodako auction system uses:

-Five black marbles per bidder, each size represents one price.

-Six layers (L0 -L5): Layers L0 and L1 are made of transparent plexiglass and have no holes. The other layers are made of wood and contain four holes per column. The size of these holes corresponds to the size of the marbles, i.e. the holes in L2 are only big enough for the smallest marbles, the holes in L3 for the second-smallest etc.

Towards True Bidder-Verifiable Auctions

-Three top layers T 1, T 2, T 3. Each layer is associated with a bidder.

-Two inclined layers: these are placed below the layers, near the bottom of the box.

-Locks and keys: each bidder and the seller has a set of locks and keys.

-One front side made of wood that closes the box and contains holes to insert the extremities of the layers. These extremities will stick out and so constitute a place where the parties can put locks. These locks are used to ensure security properties regarding that layer, for example that it cannot be removed unless everybody agrees. correct design of the machine. The seller gives black marbles of different sizes to each bidder. The smallest marble corresponds to the biggest price and the biggest marble represents the lowest price. Moreover the seller and each bidder have a set of padlocks and keys (as in Figure 4.8 on the facing page). Once all bidders have checked the box and received their material (in the case of our prototype five marbles and eight padlocks with keys), the seller closes the box with the front side. The seller and each bidder put a padlock on the box (on each corner of Figure 4.9 on page 254, marked with 1, 2, 3, and S). The seller places the layers L1 -L5 in the box, but neither the individual top layers T 1, T 2 and T 3 nor the transparent layer L0. The seller also places the two inclined layers in the bottom of the box. Finally, he puts one lock on each layer on the middle column, and all four locks on the inclined layers. He also assigns a column to each bidder.

2) Bidding Phase: Each bidder selects a marble corresponding to the price he wants to bid and puts it in his column without showing the marble to the other parties. He then closes his column using his top layer T i and secures it using one of his locks. He also puts locks on the five layers L1 -L5 below. In Figure 4.8 on the facing page you can see the box after bidder number 2 assigned to the middle column has made his bid. Once all bids are made and all locks in place, the seller introduces the transparent plexiglass layer L0, i.e. in the hole between the individual top layers and the first full layer L1. Finally each participant puts a lock on plexiglass layer L0.

3) Opening Phase:

The seller and all bidders verify that each bidder inserted exactly one marble by removing the inclined layers (to which the seller has the keys) and looking through the holes of layers L2 -L5 and the plexiglass layer L1 from below. After the inclined layers have been reinstalled and locked by the seller, all participants remove their lock on the layer L1, and the seller removes it. If somebody chose to bid the highest possible price, i.e. insert the smallest possible marble, it will now fall down through all the holes (since all lower layers have bigger holes) and all participants know the winning price, yet not the winner. If no marble falls down, they repeat this process with the next layer below corresponding to the next price. In Figure 4.9 on page 254, we see the back of the box once the two first prices have been tested. The inclined layers are there to hide from which column the marble fell, as all marbles will end up in the bottom left part independently of where they came from (cf. Figure 4.7 on page 250).

4) Verification Phase:

Once a marble has fallen down, each bidder can open his lock on his top layer T i and individually check if his marble is still inside. In Figure 4.10 on page 255, bidder number two notes that his marble is still inside the box, so he did not win. Similarly the seller can remove the two inclined layers and check for each column, whether there is still a marble inside, hence determining the winner (the column with no marble). An example is given in Resolving ties: Note that in the case of a tie two (or more) marbles will fall down at the same time. Thus everybody knows that there is a tie, the seller can also identify the tied parties, and the bidders know if they are tied or not. Note also that a tied party can prove to anybody that he is tied by opening his top and showing that his compartment is empty. To resolve the situation either an external tie-breaking mechanism can be used (e.g. rolling a die), or the auction can simply be restarted. Using an external mechanism implies revealing the identity of the tied parties or trusting the seller, since he is the only one who knows who is tied. If privacy is the main concern and the seller is not to be trusted, the auction can simply be restarted and giving the bidders the chance to modify their bids. Note that Sako's protocol (our inspiration) also reveals the identity of the tied parties. § 4.5.2.2. Securities Properties. We now argue how the properties defined Sections 4.3 and 4.4 are achieved by our protocol, as long as there is at least one honest party following the protocol (i.e. one bidder or the seller).

Non-cancellation and non-repudiation. Everybody can see in which column a bidder inserted his marble. Due to the fact that the layer L0 is locked by all the participants, nobody can change his price during the execution of the protocol. Hence nobody can cancel his bid. Similarly nobody can deny that it was his marble that fell down as the seller and the concerned bidder can verify in which column a marble is still present. Moreover the check at the beginning of the opening phase ensures due to the transparent layer L1 that there is exactly one marble per bidder.

Fairness. We consider the two aspects defined in Section 4.3.2:

-Highest-Price-Wins: By the design of the box and the holes of different size in layers L2 -L5, the highest price offered by a bidder which is represented by the smallest marble is the first marble to fall down. No bidder can make a larger marble drop before a smaller one.

-Weak-Non-Interference: For a given set of bidders no information about the bids is leaked until the end of the bidding phase, since each bidder can choose his marble privately and drop it into the box in such a way that nobody can identify its size.

Privacy. The winner is only known to the seller and himself, but everybody knows the winning price. The inclined layers prevent anybody else from determining the winner by observing from which column the marble fell19 . Once a marble has dropped, the winner can check if his column is empty by unlocking his top layer T i and looking inside. As shown in Figure 4.11 on the preceding page, the seller can also determine the winner by removing the inclined layers and checking which column is empty. Since the remaining marbles are too big to fall through the holes, the seller can only see if there is a marble, but will be unable to determine its size, as all marbles have the same color. This preserves the secrecy of the losing bids. The losing bidders can also open their top layers T i and verify if their marbles are still inside as shown in Figure 4.10 on page 255. This leaks no information about the winner, yet they know the price from the moment when the marble falls as each layer corresponds to a price. We use an equational theory to model possible changes to it. A machine(•) has the following parameters, where the index i represents a bidder among the n bidders, j a price among the m prices, and s the seller:

Verifiability

b ji representing the different compartments (for each bidder and price, i.e. above L1 to L5 for bidder one, two and three in our prototype) of the box, which can be empty or contain a marble of a certain size.

l ji and l js represent the locks (or rather: the keys necessary to open the locks) that need to be opened to remove a layer Lj (where j ∈ {1, . . . , n}) from the "sieve" part of the machine, one for each bidder and one for the seller.

t i are the locks used by the bidders to close the top layer T i after they inserted their bid.

p i and p s are the locks on the plexiglass layer L0.

b s represents the locks by the seller on the inclined layers at the bottom (for simplicity we model only one instead of four).

w k (k ∈ {1, . . . , n * m}) represent the lower left part of the box where the "winning" marbles that have fallen down end up. We need multiple variables since all marbles fall down if all layers are removed. To simplify the equational theory we have different variables for each price, as this allows us to have independent equations for removing each layer -otherwise we need to take the current state of the w k s into account, which further increases the number of equations.

We also define the following functions:

-check_window: takes as input a machine and returns the w k to check if a marble has fallen down. This function dose not require any key to be applied.

-price_j: takes as input a machine, the keys l ji and l js , and returns a machine where the layer j was removed and potentially marbles have fallen down.

-open_top_i: takes as input a machine and the key t i , and returns the contents of all b ji for bidder j. This corresponds to the bidder verification check by looking through the plexiglass layer L0.

-open_bottom: takes as input a machine and the key b s , and returns a vector indicating if the columns contain marbles or not. This corresponds to the seller verification check.

-change_top_i: takes as input a machine, all the keys p k (k among all the bidders), p s and the single t i and a new marble to place into bidder i's top compartment.

Consider an example of two bidders and two prices. Suppose the first bidder bids the highest possible price (constant one), and the second bidder bids the lower price two. Then the initial state of the machine m is: Since the number of parameters of the machine depends on the number of bidders and prices, we are unable to define them in a general way in ProVerif. However we have developed a python script that generates the necessary equations for a given number of bidders and prices. For the functions price_j and open_bottom this also consists in enumerating all possible cases based on the possible bid values. The ProVerif code used is shown in Listing 4.37. Note that above we did not model this part of the set-up phase explicitly, we simply modeled the interaction between the bidder and the machine as secret channels. This has the following reason: If we used the model with "hiding" and "authentication" above, the machine would be checking the authentication of the bidders, which is simply not the case. On the contrary, as the machine does not ensure that it is used by the correct participants, somebody else could insert his marble instead of an honest participant, and this would not be prevented by the machine itself. However, this will be detected by the other participants as we show here, and thus they will not continue the protocol. Hence we can argue that if the machine ends up being set up properly, authentication was correctly ensured, and hence that the model based on secret channels used above is realistic. Concerning ov l , ov w and ov s , we use the verification functions designed for this purpose: A losing bidder checks that his column is not empty, a winning bidder that his column is empty, and the seller opens the bottom to identify the winner. Actually, these functions are already employed during the winner determination process, hence we only check that this is sound and complete, i.e. that they only accept a correct outcome, and accept the outcome if everybody behaves honestly. We check this using the reachability of an event bad, similar to the previous case studies.

m = machine(

-Summary

We argued that verifiability of an auction should not depend on cryptographic expertise: without understanding, there is no meaningful verifiability. With that in mind, we proposed two protocols based on physical objects, inspired by the cryptographic auction protocol due to Sako. In both cases, we can achieve the desired security properties without cryptography or trusted parties20 .

In our first proposal, the Cardako protocol, each bidder marks their bid by making a hole in their piece of cardboard, which is then put into an envelope. Using a needle, it is possible to detect if a hole is in a certain place (i.e., if the envelope contains a bid for this price), without opening the envelope, and hence determine the winner without revealing the contents of the losing bids. We modeled the physical process of testing the envelope for a certain price using an special equational theory in ProVerif, which allows us to apply the exact same analysis as for the cryptographic protocols in previous sections. The analysis successfully proved Non-Repudiation, Non-Cancellation, Weak Non-Interference, Verifiability, and Highest Price Wins. For privacy, an issue was automatically found: dishonest participants may open an envelope or test an envelope for all possible bids. A mitigation is that such actions are readily detectable by all, as any handling of the envelopes occurs in public, and any such test either breaks the envelope or leaves a hole that can be detected by the other bidders. If we assume that such actions are not undertaken, we can show Strong Bidding-Price Secrecy using ProVerif.

To achieve an even higher level of privacy, we introduced the Woodako protocol. This protocol is again inspired by Sako's protocol, and again replaces cryptography and trusted parties by physical properties. This time, bids are represented by marbles, where smaller marbles denote higher bids. Bidders place the marble corresponding to their bid in their designated column in an entirely mechanical machine. Then, the first layer below all columns is removed, leaving a new layer with holes the size of the smallest marble. If at least one marble falls through, there is a winner, otherwise this layer is removed and the next layer with larger holes is now the base layer. We argued that Woodako achieves Non-Repudiation, Non-Cancellation, Weak Non-Interference, Verifiability, and Highest Price Wins. Moreover, this argumentation did not require any expert knowledge to understand, nor did it hinge on correct behavior by trusted parties.

Finally, we formally analyzed the Woodako protocol, again modeling physical properties in equational theory. The model of our physical implementation was proven correct with respect to the mentioned security properties using ProVerif. As the seller knows the winning bidder, a dishonest seller can reveal the winner.

As such, we automatically proved privacy for all bidders including anonymity of the winner in case of an honest seller, and simple privacy for losing bidders in case of a dishonest seller.

We admit that both protocols have practically issues. Neither of them scales well for higher numbers of bidders or possible prices, and both require all bidders to be in the same room at least during the winner determination phase. Hence we need to find more practical protocols.

Moreover, the soundness of our models is a major direction of future work. How can we argue that a model is sound with respect to the physical work and its infinite amount of possibilities of interactions and combinations of objects? This is an important issue in particular for coercion-resistance: physical objects can be manipulated in many ways in order to create receipts or divulge information using side-channels.

Additionally, the proofs we currently have for both protocols are not generic in the number of bidders and bids. As future work, we are looking to provide a fully generic proof. One main issue is the state space of the Woodako protocol: it scales too fast for automated proofs with higher numbers of bidders and prices.

Conclusion

In this chapter we discussed auction protocols. We identified many desirable security properties: We defined the Fairness, Authentication and Privacy properties in the Applied π-Calculus and automatically analyzed three case studies using ProVerif: the protocols due to Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. We were able to prove all properties except for receipt-freeness and coercion-resistance for the protocol due to Sako, but identified several problems with the other two. The protocol by Brandt completely lacks authentication. The protocol by Curtis et al. leaks some information about the bids, and also lacks authentication in the final messages between the registration authority and the seller.

In the next part of the chapter, we proposed a high-level model of Verifiability in auctions. We defined soundness and completeness conditions for the necessary verification tests, inspired by the perspectives of the participants. Our definitions were initially designed for first-price auctions, however we also gave a generalized version that can accommodate second-price or bulk-good auctions.

We then showed using the example of Sako's auction protocol how this definition can be instantiated in the symbolic model as well as in the computational model. We were able to prove that the verification test are sound and complete, using ProVerif in the symbolic model, and CryptoVerif in the computational model. We also analyzed the protocol by Curtis et al., and identified several issues. For example, some messages lack the necessary authentication, and the registration authority needs to be trusted for the management of pseudonyms.

In the last part of the chapter we discussed true bidder-verifiable auctions. Starting from the observation that auction protocols typically heavily rely on cryptography to achieve verifiability, which makes them too complex for many bidders to understand, we explored the idea of ensuring verifiability (as well as other properties) only using physical properties of physical objects.

We proposed two protocols: Cardako and Woodako. Cardako is a simple implementation of Sako's protocol using office material, whereas Woodako uses a wooden machine to compute the winner in a private, but verifiable way. We argued that both protocols ensure the desired properties, and also analyzed them formally in ProVerif. To model the properties of the physical objects we used special equational theories.

-Limitations and Future Work.

Most of our Fairness and Authentication definitions are only meaningful for firstprice auctions, however a generalization to other auction types appears to be feasible. We would also like to refine the model used for the protocol by Brandt to capture that the losing bidders do not learn the winner. Then we would like to fix the issues identified with the protocols by Brandt and Curtis et al., and prove the security of the resulting protocols. This however implies dealing with some limitations of ProVerif, in particular concerning state. Similarly we often had to extend the ProVerif proofs manually to cover the general case, it would be desirable to obtain these results directly. There are already some extensions of ProVerif addressing the limitations, for example StatVerif [START_REF] Arapinis | Statverif: Verification of stateful processes[END_REF] allows to model stateful processes. We would also like to test our notions of Receipt-Freeness and Coercion-Resistance on suitable protocols.

Concerning our computational analysis of the protocol by Sako, it would be interesting to refine the proof by replacing the abstract public key decryption with the concrete ElGamal cryptosystem to obtain an even stronger result.

Finally concerning our work on true bidder-verifiable auctions, we would like to have more practical protocols. Another direction for future work is the soundness of models including physical objects -how can we obtain models that are arguably sound with respect to all the possibilities present in the physical world?

Chapter 5 Conclusion I n this chapter we summarize our results. We also discuss the limitations of our work, and directions for future research.

Summary

We introduced the context and motivated this work in Chapter 1.

In Chapter 2, we recalled the syntax and semantics of the Applied π-Calculus. We also identified two important subclasses of processes: Normed and finite processes. Normed processes are processes that have a finite complete trace, and finite processes are processes where all complete traces are finite. We showed that any normed process P can be rewritten as the parallel composition of prime factors in a unique (up to ∼ l ) way, i.e. such that P ∼ l P 1 | . . . |P n . Each factor P i is prime in the sense that any further decomposition into P i ∼ l P A i |P B i implies that at least one of the factors is trivial, i.e. either P A i ∼ l 0 or P B i ∼ l 0. We also showed that any finite process P can be decomposed uniquely up to ≈ l into (weakly) parallel prime factors P ≈ l P 1 | . . . |P n .

We then discussed privacy in eVoting in Chapter 3. We proposed a taxonomy of privacy in eVoting protocols in the Applied π-Calculus. It accounts for different attacker capabilities (insider or outsider), special attacks (e.g. forced-abstention) as well as different levels of coercion (simple vote-privacy, receipt-freeness or coercion-resistance). As case studies we discussed the protocols by Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF], Lee et al. [LBD + 03] and Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF]. The protocol by Fujioka et al. ensures Vote-Privacy for an insider but is not secure against forced abstention attacks. Receipt-Freeness against an insider is ensured by the protocol by Okamoto, yet it remains vulnerable to forced abstention attacks. Both protocols can be secured against forced abstention attacks by using a private channel to a trusted administrator. The protocol by Lee et al. ensures Coercion-Resistance, but only against an outsider, and is vulnerable to forced abstention attacks. Finally Bingo Voting achieves Coercion-Resistance against an insider and is secure against forced abstention attacks, if the list of participating voters is not publicly announced.

In the next part, we developed generalized privacy definitions to accommodate protocols supporting weighted votes. We proposed such definitions for Privacy, Receipt-Freeness and Coercion-Resistance, with and without one or several corrupted voters. For Receipt-Freeness and Coercion-Resistance we also considered multiple coerced voters. Moreover, we established precise links between the new and the previous notions in the taxonomy. We considered a variant of the protocol by Fujioka et al. as a case study. Additionally we showed that for protocols ensuring a certain modularity condition the notions with and without corrupted bidders are equivalent. We were also able to prove that in such a case Multi-Voter Coercion-Resistance and Single-Voter Coercion-Resistance as well as Multi-Voter Receipt-Freeness and Single-Voter Receipt-Freeness coincide.

In Chapter 4, we analyzed electronic auction protocols. We started by giving 5.1. Summary a formal model of auction protocols in the Applied π-Calculus, and by defining fairness, authentication and privacy properties. We defined Non-Repudiation, Non-Cancellation, Weak and Strong Non-Interference, Highest Price Wins as well as different notions of Privacy, Receipt-Freeness and Coercion-Resistance. These different privacy notions allow to accommodate protocols where the winner stays anonymous or not, and where losing bids are public (yet unlinkable to the bidders) or remain private. We also provided generalized notions for auctions that are not first-price auctions, and provided a formal link to the previous notions. As case studies, we analyzed the protocols by Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. The protocol by Sako turned out to ensure all properties except for receipt-freeness and coercion-resistance, yet the authority needs to be trusted for privacy. The protocols by Curtis et al. and Brandt both suffered from several shortcoming, in particular both lacked authentication of some messages which can be exploited by an attacker. For the protocol by Curtis et al. we also provided some corrections.

In the next part of the chapter we analyzed Verifiability in electronic auction protocols. We gave a new, high-level model of an auction protocol and the necessary verification tests. This definition can be instantiated in the symbolic or the computational model. To illustrate this, we provided a symbolic (i.e. using ProVerif and a manual generalization) and a computational (using mostly CryptoVerif and one manual proof) proof of Verifiability for Sako's protocol. We also analyzed the protocol by Curtis et al. using ProVerif, and again identified several flaws.

Finally we explored the idea of "true bidder-verifiable auctions", i.e. auctions that can be verified without any specialist knowledge. To achieve this, we proposed two protocols ensuring verifiability only through physical properties. The first one, called "Cardako", only uses office material: bids are holes in a piece of cardboard, which is then inserted into an envelope. This allows to test if a bid contains a specific price, without revealing the bid entirely. We argued informally that the protocol ensures all the desired properties, and also proposed a modeling of the physical objects and their properties in ProVerif using a special equational theory to apply our formal definitions. Using this model we identified an attack on privacy if the parties are dishonest, however this attack can be detected by the other bidders.

Our second protocol is called "Woodako" and relies on a wooden box determining the winner in a secure way based on the properties of the box. In this case bids are marbles (of different sizes), and the first marble to come out of the machine determines the winner. In addition to Cardako this protocol is secure even if all other parties are dishonest, and reveals the winner only to the winner and the seller -the losing bidders only learn that they lost. Again, we provided informal and formal arguments for its security. Similarly to Cardako we model the box using a special equational theory and use ProVerif to conclude.

Limitations and Directions for Future Research

Concerning our unique decomposition results, we see two lines of future work. The first line is concerned with the extension of a parallel decomposition to infinite processes containing replication. A first approach in this direction was proposed by Hirschkoff and Pous [START_REF] Hirschkoff | On bisimilarity and substitution in presence of replication[END_REF] for a subset of CCS with top-level replication. They introduced the concept of a seed of a process P . It is defined as the process Q, Q bisimilar to P , of least size in terms of prefixes whose number of replicated components is maximal among the processes of least size. They showed that this representation is unique. Moreover, they showed that this generalizes to the Restriction-Free-π-Calculus (i.e. without "ν"). It remains however open if a similar result can be obtained for the full calculus.

The second line of research is to find an efficient algorithm that converts a process into its unique decomposition. It is unclear if such an algorithm exists and can be efficient, as simply deciding if a process is finite can be non-trivial.

A more technical relic is that we did not prove that Strong Labeled Bisimilarity is closed under the application of contexts, although we expect such a result to hold due to its close similarity to Weak Labeled Bisimilarity.

Similarly, we did not give a formal proof showing that we can replace a process P synchronizing (i.e. containing a sync) with other processes within a context C[_], with a bisimilar (modulo the synchronization) processes P ≈ l P , i.e. that we have C[P ] ≈ l C[P ], although again we expect this result to hold.

With respect to our work on Privacy we also see two main directions for future work. Firstly most of our proofs were manual, and it would be great to mechanize more of these proofs as they tend to be long and cumbersome. The main obstacles are too complex equational theories (as in the case of the protocol by Okamoto in Section 3.3.5.2) and the universally quantified attacker context in the definition of Coercion-Resistance. A step in this direction was undertaken by Smyth et al. [START_REF] Smyth | Translating between equational theories for automated reasoning[END_REF]. They propose to replace the complex equational theory with a simpler, but equivalent one which can be then treated by ProVerif. Moreover, KISS [START_REF] Ciobâcă | Computing knowledge in security protocols under convergent equational theories[END_REF] and AKISS [START_REF] Chadha | Automated verification of equivalence properties of cryptographic protocols[END_REF] can deal with more complex equational theories. KISS can verify the static equivalence of frames, which allowed us to verify the static equivalence of the final frames in the proof of the protocol by Okamoto. AKISS can prove trace equivalence in a calculus similar to the Applied π-Calculus. However, it is still an open problem to automatically reason about the universally quantified context in the definitions of Coercion-Resistance.

A second direction for future work is a translation of our definitions to a computational setting. In our symbolic model we do not consider probabilities, i.e. we call a protocol secure if there is a possibility for the voter to escape coercion, even if an attacker has a noticeable probability of detecting this. A computational variant of our definition would be able to take this into account.

Concerning our work on eAuctions, we see many possibilities for future work. A first idea is to try to fix all the identified issues with the protocols by Curtis et al. and Brandt. As we already noted, this also implies dealing with some of the limitations of ProVerif. Moreover, the current model of the protocol by Brandt is a simplification, it would be interesting to extend this to a more precise model.

When using ProVerif we often were unable to prove the general case directly, and had to provide a manual proof to show that the result holds for any number of bidders. An extension of ProVerif with loops could permit to obtain the general proof directly.

Additionally, none of our case studies turned out to ensure any notion of Receipt-Freeness or Coercion-Resistance. The auction protocol by Abe and Suzuki [START_REF] Abe | Receipt-free sealed-bid auction[END_REF] was shown to ensure Receipt-Freeness in the model by Dong et al. [START_REF] Dong | Analysis of a receiptfree auction protocol in the applied pi calculus[END_REF], it would be interesting to see if this generalizes to our model.

To strengthen our computational proof of verifiability of Sako's protocol, we would like to refine the model by replacing the abstract primitive "secure and correct encryption" with the concrete ElGamal encryption.

Finally, we would like to develop more practical and scalable true bidderverifiable auction protocols. However even the current protocols raise many interesting questions for future work with respect to the application of formal methods to protocols that combine cryptography with physical properties. The main question is how to model physical objects and their interactions in a realistic way. Given the richness of the physical world this is not obvious, and the question of soundness is a challenging one. For cryptographic protocols we usually consider soundness with respect to the computational model (although this still abstracts away from implementation errors and side-channels), yet when considering physical objects it is not clear with respect to which model our reasoning should be "sound".

Moreover, in [START_REF] Dreier | Brandt's fully private auction protocol revisited[END_REF] we provided a detailed cryptanalysis of Brandt's fully private auction protocol [START_REF] Brandt | How to obtain full privacy in auctions[END_REF]. Although we did not discuss the results in this thesis, in particular the discovered flaws and proposed fixes, it would be interesting to provide a formal (computational) proof of the corrected protocol.

Introduction

De plus en plus d'échanges commerciaux se passent sur internet, par exemple la vente des biens -Amazon.com a atteint en 2012 un chiffre d'affaires de plus de 61 milliards de dollars [Ama13] -ou les ventes aux enchères en ligne via des sites tels que eBay dont le chiffre d'affaires en 2012 fût de plus que 14 milliards de dollars [START_REF] Donahoe | To our stockholders[END_REF]. D'autre part, les administrations et le gouvernement utilisent de plus en plus des systèmes informatiques pour des applications d'administration. Par exemple le vote électronique, qui est utilisé par exemple en Estonie [Est] ou dans certains cantons suisses [Gen13, Reg13].

Pour faire interagir différents systèmes ou implémenter une application comme le vote ou les ventes aux enchères en ligne, de nombreux protocoles ont été développés. Ces protocoles définissent l'interaction entre les différents participants, et sont conçus pour assurer des propriétés de sécurité (comme l'authentification ou le secret) aussi bien que des propriétés fonctionnelles (comme la disponibilité ou une réponse en temps réel).

Malheureusement le développement de tels protocoles est difficile et sensible aux erreurs. Une approche pour maîtriser cette problématique est l'utilisation des méthodes formelles. Les méthodes formelles utilisent des modèles formelles comme des logiques dédiées, des algèbres de processus ou des arguments statistiques ou probabilistes pour analyser la sécurité d'un système. Elles permettent non seulement de découvrir des erreurs, mais aussi de prouver qu'un système est sûr par rapport à une propriété précise dans un modèle donné. Les principaux défis restent le choix du modèle, la formalisation des propriétés de sécurité, et le développement des outils de vérification automatique.

Dans cette thèse nous étudions deux applications principales : le vote électronique et les ventes aux enchères électroniques. Les systèmes de vote électroniques ont été utilisés dans de nombreux pays du monde, et maintenant même des systèmes de vote en ligne sont introduits, par exemple en Estonie [Est] Dans les deux domaines d'application nous considérons des systèmes complexes et des propriétés non-triviales comme le respect de la vie privée, l'équité et la vérifiabilité. Le respect de la vie privée peut simplement vouloir dire le secret du vote (ou de l'offre), mais aussi l'anonymat du votant ou de l'enchérisseur. L'équité est souvent liée au respect de la vie privée car par exemple des résultats préliminaires peuvent influencer les votants restants, mais inclut aussi la protection contre la fraude, et le respect des règles des protocoles de vente aux enchères. Finalement la vérifiabilité permet aux participants d'un protocole de vérifier à la fin que le protocole s'est bien déroulé, et que les résultats annoncés sont corrects. Ceci est particulièrement intéressant pour les systèmes complexes, car la vérification peut être plus simple que l'exécution du protocole.

Puisque les définitions en langue naturelle sont souvent imprécises, un défi majeur pour la vérification formelle est le développement des définitions formelles précises, qui couvrent tous les aspects de la propriété en question, et qui sont adaptées à la vérification automatique.

Le but de cette thèse est de proposer des modèles et des définitions qui permettent de vérifier des propriétés de sécurité dans les deux contextes. Pour le vote, nous nous concentrons sur les propriétés d'anonymat, qui incluent l'absence de reçu et la protection contre la coercition, c'est-à-dire contre un intrus qui essaye de forcer les votants à voter pour un candidat de son choix. Pour les ventes aux enchères nous proposons des modèles et des définitions pour les propriétés d'anonymat, d'équité et de vérifiabilité. De plus, nous examinons plusieurs études de cas, ce qui amène aussi bien à des preuves de sécurité qu'à la découverte de plusieurs failles de sécurité. Finalement nous présentons aussi un résultat théorique dans le π-calcul appliqué qui nous permet de prouver l'équivalence de plusieurs notions d'anonymat.

-Contributions

Dans le chapitre 2, nous rappelons la syntaxe et la sémantique du π-calcul appliqué, qui est utilisé de manière récurrente dans la thèse. Nous présentons ainsi deux résultats de décomposition unique pour des processus dans le π-calcul appliqué. Nous commençons par la définition de deux sous-classes de processus : les processus normés et finis, c'est-à-dire les processus qui possèdent au moins une trace complète (c'est-à-dire qui se termine dans un état ou aucune transition n'est possible) finie, et les processus où toutes les traces complètes sont finies respectivement. Dans un premier temps, nous démontrons que tout processus normé peut se réécrire de manière unique (modulo la bisimulation forte) sous forme de composition parallèle de plusieurs facteurs premiers, c'est-à-dire nous avons P ∼ l P 1 | . . . |P n où tous les P i sont premiers, c'est-à-dire ne peuvent pas être décomposés dans des facteurs non-triviaux. Dans un deuxième temps, nous prouvons que tout processus fini (c'est-à-dire toutes les traces sont finies) peut se réécrire de manière unique (modulo la bisimulation faible) sous forme de composition parallèle de plusieurs facteurs premiers : P ≈ l P 1 | . . . |P n . Ces résultats démontrent l'existence d'une forme normale, et impliquent un résultat d'annulation sur les processus : nous obtenons que A|B ∼ C|B implique A ∼ C. Ce résultat est utilisé au chapitre 3 dans une preuve d'équivalence de différentes notions de sécurité.

Dans le chapitre 3 nous analysons le respect de la vie privée dans les systèmes de vote électroniques. Dans un premier temps, nous proposons une taxonomie formelle du respect de la vie privée dans le π-calcul appliqué. Cette taxonomie tient compte de différentes capacités de l'intrus (par exemple un intrus interne qui participe aussi au vote, ou un intrus externe qui est juste observateur), de différents types d'attaques (l'abstention forcée), et du niveau de coercition employé par l'intrus. Nous appliquons cette taxonomie dans plusieurs études de cas : les protocoles de Fujioka et al. [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], de Okamoto [START_REF] Okamoto | An electronic voting scheme[END_REF], de Lee et al [LBD + 03], et Bingo Voting [START_REF] Bohli | Bingo voting: Secure and coercion-free voting using a trusted random number generator[END_REF].

Dans un deuxième temps, nous généralisons les notions du respect de la vie privée pour prendre en compte les votes pondérés, par exemple dans le cas d'une société où les votes seraient proportionnels aux nombres d'actions de chaque votant. Dans un tel cas les définitions précédentes fondées sur la permutation ne sont plus adaptées, car une permutation peut changer le résultat de l'élection et donc rendre les deux situations trivialement distinguables. Notre solution consiste à s'abstraire du résultat, et à considérer toutes les distributions de votes qui amènent au même résultat. Nous appliquons ces nouvelles notions à un protocole inspiré par le protocole d'Eliasson and Zúquete [START_REF] Eliasson | An electronic voting system supporting vote weights[END_REF], qui implémente des votes pondérés. De plus, nous établissons des liens précis entre les notions généralisées, et les notions de la taxonomie précédente : nous démontrons que les deux sont équivalentes sous l'hypothèse que les votes ont tous le même poids. Dans une étape supplémentaire, nous démontrons que si le protocole est fini et satisfait une certaine condition de modularité (ce qui est le cas dans beaucoup d'exemples), la coercition d'un ou de plusieurs votants est équivalente. Ces conditions permettent aussi de prouver que le cas avec des votants corrompus par l'intrus peut se réduire au cas sans votants corrompus. Cela permet de simplifier les preuves de sécurité, car il suffit d'analyser le cas sans votants corrompus et avec un seul votant sous coercition.

Dans le chapitre 4 nous analysons les protocoles de vente aux enchères en ligne. Dans la première partie nous proposons des définitions des propriétés d'authentification comme la non-répudiation et la non-annulation, des propriétés d'équité comme la non-interférence des offres et la protection contre la fraude, et de la protection de la vie privée de l'anonymat dans le π-calcul appliqué. Dans la suite nous analysons trois études de cas : les protocoles de Curtis et al. Dans la dernière partie nous explorons l'idée des « enchères vraiment vérifiables par les enchérisseurs », c'est-à-dire des protocoles qui assurent la vérifiabilité sans utiliser des opérations cryptographiques complexes, et qui sont donc compréhensibles même pour une personne non spécialiste. Nous proposons d'utiliser des propriétés physiques de certains objets, et développons deux protocoles inspirés du protocole proposé par Sako. Le premier s'appelle « Cardako » et n'utilise que du matériel de bureau, c'est-à-dire du carton et des enveloppes. Le deuxième s'appelle « Woodako » et utilise une boîte en bois qui détermine le gagnant de manière privée et vérifiable. Bien que ces protocoles aient leur limitations pour passer à l'échelle, ils illustrent qu'on peut réaliser des enchères simplement en utilisant des objets physiques. Nous proposons aussi d'appliquer les définitions formelles proposées plus tôt à ces protocoles, et discutons leur vérification formelle automatique en ProVerif en utilisant une théorie équationnelle particulière qui modélise les propriétés physiques. Avec cette approche, nous obtenons que les deux ont les propriétés souhaitées.

Finalement, nous résumons nos résultats dans le chapitre 5 et discutons des perspectives.

-Publications précédentes

Une grande partie du travail présenté dans cette thèse a déjà été publiée avant la publication de cette thèse à l'occasion de plusieurs conférences internationales.

Les résultats sur la décomposition unique du chapitre 2 ont été présentés à FoSSaCS 2013 [START_REF] Dreier | On unique decomposition of processes in the applied pi-calculus[END_REF]. Les premiers résultats du travail présenté dans le chapitre 3 ont été exposés à FPS 2011 [START_REF] Dreier | Voteindependence: A powerful privacy notion for voting protocols[END_REF], ICC-SFCS 2012 [START_REF] Dreier | A formal taxonomy of privacy in voting protocols[END_REF] et à ESORICS 2012 [START_REF] Dreier | Defining privacy for weighted votes, single and multi-voter coercion[END_REF]. Une grande partie des résultats du chapitre 4 a aussi été publiée : à POST 2013 [START_REF] Dreier | Formal verification of e-auction protocols[END_REF] et à ASIACCS 2013 [START_REF] Dreier | Defining verifiability in e-auction protocols[END_REF].

Bien que cela ne fasse pas partie du travail présenté dans cette thèse, nous avons aussi publié une analyse détaillée du protocole par Brandt à Africacrypt 2013 [START_REF] Dreier | Brandt's fully private auction protocol revisited[END_REF].

Le π-calcul appliqué et la décomposition unique des processus

Le π-calcul appliqué [AF01] est une algèbre de processus. Il s'agit d'une variante du π-calcul adaptée à la vérification des protocoles. Dans cette algèbre, les participants du protocole sont décrits sous forme de processus qui peuvent interagir, par exemple échanger des messages. Tous les messages sont composés de termes, qui sont évalués par rapport à une théorie équationnelle qui modélise par exemple les propriétés des opérations cryptographiques (par exemple dec(enc(m, k), k) = m pour un chiffrement symétrique).

Les grammaires pour la construction des termes et des processus sont données dans les figures 2.1, 2.2 and 2.3 : le processus 0 ne fait rien, la composition parallèle P |Q exécute P et Q en parallèle, et la réplication !P exécute un nombre infini de copies de P en parallèle. νn.P crée un nom frais et restreint n, puis continue tant que P . if M = N then P else Q se comporte comme P si N = E M , ou comme Q sinon. Le processus in(u, x).P reçoit un message sur le canal u, l'affecte à la variable x et puis continue comme P . La sémantique est donnée dans les figures 2.4, 2.5 et 2.6. Cette sémantique permet de définir plusieurs notions d'équivalence, notamment la bisimulation forte (∼ l ) et la bisimulation faible (≈ l ). Dans la bisimulation forte chaque transition d'un côté doit être simulée par exactement une transition de l'autre côté, dans le cas de la bisimulation faible une transition peut être simulée par plusieurs transitions (internes).

Dans une algèbre de processus comme le π-calcul appliqué une question naturelle est celle de la décomposition en facteurs parallèles : étant donné un processus P , existent-ils des processus P 1 , . . . , P n tel que P peut se réécrire comme P 1 | . . . |P n ? Et si cette décomposition existe, est-elle unique ? Une telle décomposition a plusieurs applications : elle sert de forme normale, ce qui simplifie certaines preuves, elle permet de vérifier l'équivalence de deux processus en vérifiant qu'ils ont la même forme normale, ou encore elle implique un résultat d'annulation, c'est-à-dire que P |Q ≈ P |R implique Q ≈ R.

Dans ce chapitre nous démontrons que dans le π-calcul appliqué tout processus « normé » P peut se réécrire de manière unique modulo la bisimulation forte sous la forme suivante P ∼ l P 1 | . . . Ce dernier résultat permet dans le chapitre 3 de démontrer l'équivalence de plusieurs notions d'anonymat pour les protocoles de vote.

Les protocoles de vote

Puisque le vote est un acte central de participation dans les démocraties modernes, de nombreuses propriétés de sécurité ont été proposées :

-Correction : le résultat annoncé correspond à la somme de tous les votes.

-Éligibilité : seulement les votants enregistrés peuvent voter, et au plus une fois.

-Équité : le processus de vote est équitable, notamment aucun résultat prélimi-naire n'est publié afin de ne pas influencer les autres votants.

-Robustesse : le protocole peut tolérer des votants avec un comportement incorrect.

-Vérifiabilité : le protocole possède des mécanismes qui permettent de vérifier l'exactitude du résultat.

-Respect de la vie privée : tous les votes restent secrets.

La dernière propriété est cruciale pour assurer que les votants soient libres de leurs choix. Dans la littérature, elle est souvent divisée en plusieurs notions (p.ex. dans [DKR09, LSB + 09, SC11, SB13, Jon09, DHvdG + 13]) :

-Secret du vote : Tous les votes restent secrets pour un observateur extérieur.

-Absence de reçu : Un votant ne peut pas créer un reçu qui permet de prouver à une tierce partie qu'il a voté pour un certain candidat. Ceci permet d'éviter l'achat des votes.

-Résistance à la coercition : Même si un votant interagit avec un intrus pendant tout le processus de vote, l'intrus ne peut pas savoir avec certitude si le votant a suivi ses ordres ou voté différemment.

-Protection contre l'abstention forcée : Un intrus ne peut pas forcer un votant à s'abstenir.

-Indépendance des votes : Aucun votant ne peut lier son vote au vote d'un autre votant1 .

-Secret perpétuel : Le secret des votes n'est pas seulement assuré au moment de l'élection, mais aussi sur le long terme, quand la puissance de calcul de l'intrus aura considérablement augmenté.

Dans ce chapitre nous étudions toutes ces notions, sauf le secret perpétuel.

-Taxonomie

Dans le contexte du vote, le respect de la vie privée est difficile à définir formellement à cause de la grande variété d'attaques et de capacités de l'intrus. Pour systématiser notre définition, nous proposons une taxonomie basée sur une approche modulaire.

Dans notre scénario, l'intrus cible un votant (le votant ciblé) et essaye de connaître son vote. Si l'intrus connaît les votes de tous les autres votants, il peut déduire son vote à partir du résultat affiché. Nous supposons donc que l'intrus ne connaît pas le vote d'au moins un autre votant (le votant de compensation).

Nous exprimons le secret comme une équivalence observationnelle entre deux situations. Dans la première situation, le votant ciblé vote comme l'intrus le souhaite, dans la deuxième il vote différemment. Le votant de compensation contrebalance le vote changé en changeant son propre vote pour assurer que le résultat reste le même dans les deux situations. Si le protocole assure le secret du vote, l'intrus devrait donc être incapable de distinguer les deux situations.

En partant des définitions de résistance à la coercition, de l'absence de reçu et de secret du vote nous proposons de factoriser trois dimensions : communication entre le votant ciblé et l'intrus, intrus interne ou externe, et protection contre l'abstention forcée.

Les protocoles de vente aux enchères

Les ventes aux enchères représentent une méthode simple pour la vente de biens ou de services : un vendeur propose un bien ou un service, et les enchérisseurs soumettent des offres.

Dans la littérature beaucoup de propriétés de sécurité ont été proposées, ici nous analysons les suivantes en détail :

-Équité : D'abord un protocole de Nous appliquons toutes les définitions précédentes avec ProVerif sur trois études de cas : les protocoles de Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], de Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF], et de Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. Seulement le protocole de Sako s'avère sûr, les deux autres contiennent plusieurs faiblesses, essentiellement liées à des problèmes d'authentification.

La définition de vérifiabilité peut aussi s'instancier dans le modèle calculatoire. Pour illustrer cela, nous prouvons que le protocole par Sako assure la vérifiabilité aussi dans le modèle calculatoire. Pour ce faire nous utilisons majoritairement CryptoVerif, mais aussi une preuve manuelle car une limite de CryptoVerif ne permet pas de finir cette preuve automatiquement.

Le but de la vérifiabilité est de permettre aux utilisateurs de vérifier le bon déroulement du protocole. En même temps, pour assurer cette propriété, les protocoles utilisent des opérations cryptographiques complexes. Ces opérations sont très puissantes, mais souvent trop complexes pour être vraiment comprises par un utilisateur lambda, qui doit donc faire confiance aux experts qui ont développé (et peut-être vérifié formellement) la procédure de vérification. Pour proposer une solution à cette problématique, nous avons développé deux protocoles d'« enchères vraiment vérifiable par les enchérisseurs », c'est-à-dire des protocoles qui garantissent la vérifiabilité sans utiliser la cryptographie complexe -mais basés sur des objets et propriétés physiques.

Le premier protocole, une variante du protocole de Sako basé sur du carton et des enveloppes, s'appelle « Cardako 2 ». Il peut être réalisé entièrement avec du matériel de bureau. Le deuxième protocole s'appelle « Woodako 3 ». Il s'agit aussi d'une variante du protocole de Sako, mais implémenté avec une boîte en bois, qui permet de désigner le gagnant de manière privée et vérifiable. Pour consolider notre affirmation que ces protocoles sont effectivement sûrs et vérifiables, nous les analysons formellement en ProVerif en utilisant les mêmes définitions que pour les protocoles cryptographiques. Pour modéliser les objets physiques et leurs propriétés nous utilisons une théorie équationnelle particulière, ce qui permet de conclure que les protocoles sont sûrs.

Conclusion

Nous avons introduit notre travail et son contexte dans le chapitre 1.

Dans le chapitre 2, nous avons rappelé le π-calcul appliqué, sa syntaxe et sa sémantique. Nous avons identifié deux sous-classes de processus : des processus normés, et des processus finis. Nous avons démontré que tout processus normé P peut se réécrire de manière unique (modulo ∼ l ) comme composition parallèle de facteurs premiers : P ∼ l P 1 | . . . |P n . Chaque facteur est premier dans le sens où il ne peut pas se décomposer en facteurs non-triviaux. De plus, nous avons démontré que tout processus fini peut se décomposer de manière unique (modulo ≈ l ) en processus premiers, c'est-à-dire que P ≈ l P 1 | . . . |P n .

Dans la suite, chapitre 3, nous nous sommes intéressées au vote électronique. Nous avons proposé une taxonomie du respect de la vie privée dans le π-calcul appliqué. Elle prend en compte différents pouvoirs de l'intrus (interne ou externe), des attaques spécifiques (comme l'abstention forcée), et des niveaux de coercition différents (secret du vote, absence de reçu, résistance à la coercition). Comme études de cas, nous avons analysé les protocoles de Fujioka et al. Dans la deuxième partie du chapitre, nous avons développé des notions généralisées pour prendre en compte des votes pondérés. Nous avons proposé des définitions du secret du vote, de l'absence de reçu et de la résistance à la coercition, avec et sans votants corrompus par l'intrus. Pour l'absence de reçu et la résistance à la coercition nous avons aussi développé des notions où un seul ou plusieurs votants sont sous attaque. De plus, nous avons établi des liens formels avec les définitions précédentes de notre taxonomie. Nous avons analysé une variante du protocole par Fujioka et al. comme étude de cas, et prouvé que si un protocole est fini et respecte une condition de modularité, les cas avec un seul ou plusieurs votants sous attaque sont équivalents. Nous avons obtenu un résultat similaire sous réplication. Ils ont prouvé que cette représentation est unique, et que ce résultat se généralise au π-calcul sans restriction (sans ν). Il reste ouvert si un résultat similaire peut être obtenu pour le π-calcul intégral.

Une deuxième piste consiste à proposer un algorithme efficace qui calcule la décomposition unique d'un processus. Il n'est pas certain qu'un tel algorithme existe, car simplement déterminer si un processus est fini peut être non-trivial.

De plus, il reste deux autres résultats à démonter : il reste à prouver que la bisimulation forte est clos sous l'application de contexte (comme son pendant faible), et qu'on peut remplacer des processus contenant la synchronisation avec des processus bisimilaires, et que le résultat reste bisimilaire.

Par rapport aux résultats concernant la vie privée dans les protocoles de vote nous avons identifié deux pistes. La première consiste à automatiser nos preuves (qui pour la plupart étaient manuelles). Pour cela les défis principaux sont des théories équationnelles complexes, et le contexte qui représente l'intrus dans la définition de la résistance à la coercition. La deuxième piste est la traduction de nos définitions symboliques dans le modèle calculatoire, pour par exemple pouvoir raisonner sur la probabilité qu'un intrus devine correctement le vote du votant ciblé.

Concernant nos résultats sur les ventes aux enchères, nous voyons plusieurs pistes. Une première idée est d'essayer de corriger les problèmes identifiés avec les protocoles de Curtis et al. et Brandt. Cela implique de surmonter certaines limites de ProVerif, et de préciser le modèle utilisé pour le protocole de Brandt.

Dans nos applications ProVerif était souvent incapable de prouver le cas général directement, ce qui a nécessité des preuves de généralisation manuelles. Une extension de ProVerif permettant de traiter des boucles et de l'état global est donc nécessaire.

De plus, aucun de nos protocoles ne garantit l'absence de reçu ou la résistance à la coercition. Il serait intéressant d'analyser un tel protocole, comme celui d'Abe et Suzuki [START_REF] Abe | Receipt-free sealed-bid auction[END_REF].

Pour renforcer notre preuve calculatoire de vérifiabilité pour le protocole de Sako, il serait intéressant de remplacer la primitive de chiffrement abstraite par le chiffrement d'ElGamal concret.

Finalement, nous aimerions développer des protocoles d'« enchères vraiment vérifiables par les enchérisseurs » qui passent facilement à l'échelle. De plus, la modélisation formelle des propriétés physiques soulève encore beaucoup de questions : comment être sûr que le modèle est assez précis et permet de détecter toutes les attaques ? Par ailleurs, dans [START_REF] Dreier | Brandt's fully private auction protocol revisited[END_REF] nous avons proposé une analyse détaillée du protocole de Brandt. Bien que cela ne soit pas présenté dans cette thèse, il serait intéressant faire une preuve calculatoire démontrant que les corrections que nous

Figure 2 . 1 -

 21 Figure 2.1 -Grammar for terms

Figure 2 . 2 -Figure 2 . 3 -

 2223 Figure 2.2 -Grammar for Plain Processes

Figure 2 . 6 - 2

 262 Figure 2.6 -Labeled semantics

Example 3

 3 Consider the following processes, where f is a function of arity one: P 0 = νa.out(c, a) P 1 = νa.νd.(out(d, a)|(in(d, y).out(c, y))) P 2 = νa.νd.(out(d, a)|(in(d, y).out(c, (y, f (y)))))

  then B → * B and A R B for some B , 3. if A α -→ A and f v(α) ⊆ dom(A) and bn(α)∩f n(B) = ∅, then B → * α -→→ * B and A R B for some B .

2 .

 2 if A → A , then B → B and A R B for some B , 3. if A α -→ A and f v(α) ⊆ dom(A) and bn(α) ∩ f n(B) = ∅, then B α -→ B and A R B for some B .

Figure 2 . 7 -Figure 2 . 8 -

 2728 Figure 2.7 -Channel/Link Passing in the Applied π-Calculus

  R) < N (P ) and we can apply the induction hypothesis. Suppose w.l.o.g. N (Q) = 0 < N (P ), then N (R) = N (P ) by Lemma 2. Since Q ∼ l 0 this implies |dom(Q)| > 0 by Lemma 3, hence |dom(R)| < |dom(P )|, and we can use the induction hypothesis to conclude.

2 . 3 .

 23 Let (C, D) ∈ R. Hence A → * C and A → * D. If C → C , we have A → * C , hence (C , D) ∈ R (and symmetrically for D → D ). The last condition is trivially true. Suppose there exists (C, D) ∈ R such that C α -→ C , then we have A → * α -→ C , which contradict the hypothesis. The symmetrical case is analogous. Obviously we have (A, A ) ∈ R for any A with A → * A .

1.

  By hypothesis for any (C, D) ∈ R we have ∅ = dom(A) = dom(C) (as internal reductions do not change the active substitutions, Lemma 9) and dom(D) = dom(0) = ∅, hence C ≈ s D. 2. Let (C, D) ∈ R. Hence A → * C and D = 0. If C → C , we have A → * C , hence (C , 0) ∈ R with 0 → * 0. Note that symmetrically 0 cannot perform any transition, hence the condition is trivially true. 3. The last condition is trivially true. Suppose there exists (C, D) ∈ R such that C α -→ C , then we have A → * α -→ C , which contradicts the hypothesis. Symmetrically by definition 0 cannot perform any transitions at all.

  R)| > 0 (by Lemma 11 since Q ≈ l 0 and R ≈ l 0), we have |dom(Q)| < |dom(P )| and |dom(R)| < |dom(P )|, hence we can use the induction hypothesis to conclude.

  by Lemma 11 this implies |dom(Q)| > 0, hence |dom(R)| < |dom(P )|, and we can use the induction hypothesis to conclude.

  hence either S or A m can do a transition the other cannot match. This transition can be a visible transition or an internal reduction. Suppose S µ -→ S with |S | t < |S| t such that A m cannot match the transition. As we have P ≈ l Q, S|A lm m µ -→ S |A lm m = Q gives us that P → * µ

Contents 3 . 1 3 . 3 A

 3133 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 3.1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.1.2 Outline of the Chapter . . . . . . . . . . . . . . . . . . . . . 51 3.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Formal Taxonomy of Privacy in Voting . . . . . . . . . . 54 3.3.1 Formalizing Voting Protocols . . . . . . . . . . . . . . . . . 54 3.3.2 Defining Privacy: A Modular Approach . . . . . . . . . . . 60 3.3.3 Definitions in the Applied π-Calculus . . . . . . . . . . . . 62 3.3.4 Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 3.3.5 Case Studies . . . . . . . . . . . . . . . . . . . . . . . . . . 68

--

  Outsider (O): I := {A, B} and V C := 0 -If Abs is: Participation Only (P O): V σ id A does not abstain -Security against Forced-Abstention-Attacks (F A): he may abstain.

  Applied π-Calculus. We use the following equational theory: open(commit(m, r), r) = m checksign(sign(m, sk), pk(sk)) = m unblind(blind(m, r), r) = m unblind(sign(blind(m, r), sk), r) = sign(m, sk) We can then express the behavior of the different parties using the following processes. ( * p r i v a t e k e y s * ) ν ska . ν skva . ν skvb . ν s k v c . ( * p u b l i c k e y s * ) l e t ( pka , pkva , pkvb , pkvc ) = ( pk ( ska ) , pk ( skva ) , pk ( skvb ) , pk ( s k v c ) ) i n ( * p u b l i c key d i s c l o s u r e * ) out ( ch , pka ) . out ( ch , pkva ) . out ( ch , pkvb ) . out ( ch , pkvc ) . ( * a d m i n i s t r a t o r s * ) ( ( l e t pkv = pkva i n p r o c e s s A ) | ( l e t pkv = pkvb i n p r o c e s s A ) | ( l e t pkv = pkvc i n p r o c e s s A ) | p r o c e s s C | p r o c e s s C | p r o c e s s C | ( * v o t e r s * ) ( l e t skv = skva i n l e t v = a i n p r o c e s s V ) | ( l e t skv = skvb i n l e t v = b i n p r o c e s s V ) | ( l e t skv = s k v c i n l e t v = c i n p r o c e s s V ) ) Listing 3.1 -The main process

Listing 3 . 2 -

 32 νb . ν r . l e t commitedvote = commit ( v , r ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n out ( ch1 , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . i n ( ch2 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i f r e s u l t = b l i n d e d v o t e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 . out ( ch3 , ( commitedvote , s i g n e d v o t e ) ) . i n ( ch4 , ( l , commitedvote ' , s i g n e d v o t e ' ) ) . i f commitedvote ' = commitedvote then i f s i g n e d v o t e ' = s i g n e d v o t e then sync 2 . out ( ch5 , ( l , r ) ) The voting process When the administrator (Listing 3.4 on the next page) receives the blinded commitment, he checks the signature, signs, and sends the result back.

  νb . out ( c1 , b ) . ν r . out ( c1 , r ) . l e t commitedvote = commit ( v , r ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n i n ( c2 , y2 ) . out ( ch1 , y2 ) . i n ( ch2 , m2 ) . out ( c1 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i n ( c2 , y3 ) . i f y3 = t r u e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 .

Listing 3 . 3 -Listing 3 . 4 -

 3334 The voting process under control of the attacker p r o c e s s A = i n ( ch1 , m1 ) . l e t ( pubkeyv , s i g , b l i n d e d v o t e ) = m1 i n i f pubkeyv = pkv && c h e c k s i g n ( s i g , pkv ) = b l i n d e d v o t e then out ( ch2 , s i g n ( b l i n d e d v o t e , ska ) ) The administrator process p r o c e s s C = i n ( ch3 , ( m3, m4 ) ) . i f c h e c k s i g n (m4, pka ) = m3 then ν l . out ( ch4 , ( l , m3, m4 ) ) . i n ( ch5 , ( l ' , rand ) ) . i f l = l ' then l e t voteV = open (m3, rand ) i n out ( r e s , voteV ) Listing 3.5 -The collector process

Listing 3 . 6 -

 36 a t e k e y s * ) ν ska . ν skva . ν skvb . ν s k v c . ( * p u b l i c k e y s * ) l e t ( pka , pkva , pkvb , pkvc ) = ( pk ( ska ) , pk ( skva ) , pk ( skvb ) , pk ( s k v c ) ) i n ( * p r i v a t e c h a n n e l s * ) νchT . ( * p u b l i c key d i s c l o s u r e * ) out ( ch , pka ) . out ( ch , pkva ) . out ( ch , pkvb ) . out ( ch , pkvc ) . ( * a d m i n i s t r a t o r s * ) ( p r o c e s s A | p r o c e s s A | p r o c e s s A | p r o c e s s C | p r o c e s s C | p r o c e s s C | p r o c e s s T | p r o c e s s T | p r o c e s s T | ( * v o t e r s * ) ( l e t skv = skva i n l e t v = a i n p r o c e s s V ) | ( l e t skv = skvb i n l e t v = b i n p r o c e s s V ) | ( l e t skv = s k v c i n l e t v = c i n p r o c e s s V ) ) The main process

  νb . ν r . ν td . l e t commitedvote = tdcommit ( v , r , td ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n out ( ch1 , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . i n ( ch2 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i f r e s u l t = b l i n d e d v o t e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 . out ( ch3 , ( commitedvote , s i g n e d v o t e ) ) . out ( chT , ( v , r , commitedvote ) ) Listing 3.7 -The voting process p r o c e s s V c 1 c 2 = i n ( c2 , y1 ) . i f x1 = t r u e then sync 1 . sync n 2 e l s e νb . out ( c1 , b ) . ν r . out ( c1 , r ) . ν td . out ( c1 , td ) . l e t commitedvote = tdcommit ( v , r , td ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n i n ( c2 , y2 ) . out ( ch1 , y2 ) . i n ( ch2 , m2 ) . out ( c1 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i n ( c2 , y3 ) . i f y3 = t r u e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 . i n ( c2 , y4 ) . out ( ch3 , y4 ) . i n ( c2 , y5 ) . out ( chT , y5 ) Listing 3.8 -The voting process under control of the attacker 3. eVoting p r o c e s s V c h c = i f v = a b s t a i n then sync 1 . sync n 2 e l s e νb . ν r . ν td . out ( chc , b ) . out ( chc , r ) . out ( chc , td ) . l e t commitedvote = tdcommit ( a , r , td ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n out ( ch1 , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . out ( chc , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . i n ( ch2 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i f r e s u l t = b l i n d e d v o t e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 . out ( ch3 , ( commitedvote , s i g n e d v o t e ) ) . out ( chc , ( commitedvote , s i g n e d v o t e ) ) .

Listing 3 . 13 -

 313 processV ' = i f a = a b s t a i n then νb . ν r . ν td . l e t commitedvote = tdcommit ( b , r , td ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n out ( ch1 , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . i n ( ch2 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i f r e s u l t = b l i n d e d v o t e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 . out ( ch3 , ( commitedvote , s i g n e d v o t e ) ) . out ( chT , ( b , r , commitedvote ) ) . e l s e νb . ν r . ν td . out ( chc , b ) . out ( chc , f ( b , r , td , a ) ) . out ( chc , td ) . l e t commitedvote = tdcommit ( b , r , td ) i n l e t b l i n d e d v o t e = b l i n d ( commitedvote , b ) i n out ( ch1 , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . out ( chc , ( pk ( skv ) , s i g n ( b l i n d e d v o t e , skv ) , b l i n d e d v o t e ) ) . i n ( ch2 , m2 ) . l e t r e s u l t = c h e c k s i g n (m2, pka ) i n i f r e s u l t = b l i n d e d v o t e then l e t s i g n e d v o t e = u n b l i n d (m2, b ) i n sync 1 . out ( ch3 , ( commitedvote , s i g n e d v o t e ) ) . out ( chc , ( commitedvote , s i g n e d v o t e ) ) . out ( chT , ( b , r , commitedvote ) ) . out ( chc , ( a , f ( b , r , td , a ) , commitedvote ) ) Listing 3.10 -The process V' p r o c e s s A = i n ( ch1 , m1 ) . l e t ( pubkeyv , s i g , b l i n d e d v o t e ) = m1 i n i f pubkeyv = pkv && c h e c k s i g n ( s i g , pkv ) = b l i n d e d v o t e then out ( ch2 , s i g n ( b l i n d e d v o t e , ska ) ) Listing 3.11 -The administrator process p r o c e s s C = sync 1 . i n ( ch3 , ( m3, m4 ) ) . i f c h e c k s i g n (m4, pka ) = m3 then sync n 2 . out ( ch , ( m3, m4) ) Listing 3.12 -The collector process 3. eVoting p r o c e s s T = sync 1 . ( * r e c e i v i n g t h e commitment * ) i n ( chT , ( vt , r t , xt ) ) . sync 2 . i f open ( xt , r t ) = vt then out ( r e s , vt ) The timeliness process Theorem 21 The protocol by Okamoto respects SwRF I,P O .

  p 2 i n p r o c e s s V ) | ( l e t privChM = privChM 3 i n l e t privChRNG = privChR 3 i n l e t v = p 3 i n p r o c e s s V ) ) Listing 3.14 -The main process processRNG = ( * g e n e r a t e random number * ) ν r . ( * output t o v o t i n g machine * ) out ( privChM , r ) . ( * output t o v o t e r * ) out ( privChV , r ) Listing 3.15 -The random number generator (RNG) p r o c e s s V = i f v = a b s t a i n then sync i d i e l s e ( * v o t i n g * ) out ( privChM , v ) . ( * r e c e i p t * ) f o r ( i = 1 t o l ) i n ( privChM , r e c e i p t i ) ( * random value , t o v e r i f y r e c e i p t * ) i n ( privChRNG , r ) Listing 3.16 -The voting process p r o c e s s V c 1 c 2 = i n ( c1 , x1 ) . i f x1 = t r u e then sync i d i e l s e ( * v o t i n g * ) i n ( c1 , x2 ) . out ( privChM , x2 ) . ( * r e c e i p t * ) f o r ( i = 1 t o l ) i n ( privChM , r e c e i p t i ) . out ( c2 , r e c e i p t i ) ( * random value , t o v e r i f y r e c e i p t * ) i n ( privChRNG , r ) . out ( c2 , r ) Listing 3.17 -The process V c1,c2 3. eVoting processV ' = i n ( c1 , x1 ) . ( * v o t i n g * ) i f x1 = t r u e then out ( privChM , b ) . ( * random value , t o v e r i f y r e c e i p t * ) i n ( privChRNG , r ) . ( * r e c e i p t * ) f o r ( i = 1 t o l ) i n ( privChM , r e c e i p t i ) . ( * output n o t h i n g s i n c e c l a i m i n g t o a b s t a i n * ) e l s e i n ( c1 , x2 ) . out ( privChM , b ) . ( * random value , t o v e r i f y r e c e i p t * ) i n ( privChRNG , r ) . ( * r e c e i p t * ) f o r ( i = 1 t o l ) i n ( privChM , r e c e i p t i ) . out ( c2 , r e c e i p t i ) ( * output c o r r e c t random v a l u e * ) f o r ( i = 1 t o l ) i f ( x2 = p i ) then out ( c2 , r e c e i p t i ) Listing 3.18 -The process V processM ' = i n ( privChV , v ) . i n ( privChR , r ) . f o r ( j = 1 t o l ) l e t r e c e i p t j = c h o o s e ( p j , v , r , n i,j ) i n out ( privChV , r e c e i p t j ) ; sync k 1 . ( * output r e s u l t * ) out ( r e s , v ) ( * output r e c e i p t s * ) f o r ( j = 1 t o l ) out ( chRec , r e c e i p t j ) ( * output unused dummy v o t e s * ) p a r f o r

Listing 3 .

 3 19 -The voting machine 3. eVoting again any k out of the 2k synchronization points sync k 1 (as there are two voting machine processes per voter each containing a sync k 1 command) are sufficient for continuation.Analysis. As announced above, Bingo Voting respects SwCR I,F A .Theorem 23 Bingo Voting respects SwCR I,F A , i.e. Coercion-Resistance against an inside attacker and security against forced abstention attacks.

  privChV , v ) . i n ( privChR , r ) . f o r ( j = 1 t o l ) l e t r e c e i p t j = c h o o s e ( p j , v , r , n i,j ) i n out ( privChV , r e c e i p t j ) ; sync k 1 . ( * output r e s u l t * ) out ( r e s , v ) ( * output v o t e r l i s t * ) out ( v o t e r s , i d i ) ( * output r e c e i p t s * ) f o r ( j = 1 t o l ) out ( chRec , r e c e i p t j ) ( * output unused dummy v o t e s * ) p a r f o r

  Applied Pi Calculus. We use a model similar to the one developed by Delaune et al. [DKR09], but we include signatures by the voters on the submitted ballots and add a third voter. This model is closer to the original protocol description. It uses the following equational theory: decrypt(penc(m, pk(sk), r), sk) = m checksign(sign(m, sk), pk(sk)) = m rencrypt(penc(m, pk(sk), r1), r2) = penc(m, pk(sk), f (r1, r2)) checkdvp(dvp(x, rencrypt(x, r), r, pk(sk)), x, rencrypt(x, r), pk(sk)) = ok checkdvp(dvp(x, y, z, skv), x, y, pk(skv)) = ok These equations are standard, except for the reencryption and DVPs. The function reencrypt models reencryption usig a new random value. The second to last equation allows to verify a DVP of reencryption, and the last equation allows the designated verifier to forge a DVP for a different value using his secret key.

(

  * p r i v a t e c h a n n e l s * ) ν skcCh . νpkcCh . ν votCh . ν skvaCh . ν skvbCh . ν skvcCh . ν skdaCh . ν skdbCh . ν skdcCh . νpkvaCh . νpkvbCh . ν pkvcCh . νpkdaCh . νpkdbCh . νpkdcCh . ( * a d m i n i s t r a t o r s * ) ( p r oc e ss K | p r o c e s s C | p r o c e s s C | p r o c e s s C | ( * v o t e r s * ) ( l e t skvCh = skvaCh i n l e t pkdCh = pkdaCh i n l e t v = a i n p r o c e s s V ) | ( l e t skvCh = skvbCh i n l e t pkdCh = pkdbCh i n l e t v = b i n p r o c e s s V ) | ( l e t skvCh = skvcCh i n l e t pkdCh = pkdcCh i n l e t v = c i n p r o c e s s V ) | ( * t r u s t e d d e v i c e s * ) ( l e t skdCh = skdaCh i n l e t pkvCh = pkvaCh i n p r o c e s s D ) | ( l e t skdCh = skdbCh i n l e t pkvCh = pkvbCh i n p r o c e s s D ) | ( l e t skdCh = skdcCh i n l e t pkvCh = pkvcCh i n p r o c e s s D ) ) Listing 3.21 -The main process corrupted.

Theorem 25

 25 The protocol by Lee et al. respects SwCR O,P O (Swap-Coercion-Resistance against an outside attacker in the Participation Only case). Proof We suppose that all authorities are honest and that all key distribution pro c e ss K 2 = ( * p r i v a t e k e y s * ) ν s k c . ν skva . ν skvb . ν skda . ν skdb . ( * p u b l i c k e y s * ) l e t ( pkc , pkva , pkvb , pkda , pkdb ) = ( pk ( s k c ) , pk ( skva ) , pk ( skvb ) , pk ( skda ) , pk ( skdb ) ) i n ( * p u b l i c key d i s c l o s u r e * ) out ( ch , pkc ) . out ( ch , pkva ) . out ( ch , pkvb ) . out ( ch , pkda ) . out ( ch , pkdb ) . ( * d i s t r i b u t e k e y s : * ) ( * v o t e r s * ) ( out ( skvaCh , skva ) | out ( skvbCh , skvb ) | out ( pkdaCh , pkda ) | out ( pkdbCh , pkdb ) | out ( pkcCh , pkc ) | out ( pkcCh , pkc ) | ( * t r u s t e d d e v i c e s * ) out ( skdaCh , skva ) | out ( skdbCh , skvb ) | out ( pkvaCh , pkva ) | out ( pkvbCh , pkvb ) | ( * c o l l e c t o r s * ) out ( votCh , ( pkva , pkda ) ) | out ( votCh , ( pkvb , pkdb ) ) | out ( skcCh , s k c ) | out ( skcCh , s k c ) ) Listing 3.23 -The key distribution process for two voters p r o c e s s V = ( * p r i v a t e key * ) i n ( skvCh , skv ) . ( * p u b l i c k e y s o f t h e t r u s t e d d e v i c e and t h e c o l l e c t o r * ) i n ( pkdCh , pubkd ) . i n ( pkcCh , pubkc ) . sync 1 . ν r . l e t e = penc ( v , pubkc , r ) i n out ( chD , ( pk ( skv ) , e , s i g n ( e , skv ) ) ) . i n ( chD , m2 ) . l e t ( re , sd , dvpV ) = m2 i n i f checkdvp ( dvpV , e , re , pk ( skv ) ) = ok then i f c h e c k s i g n ( sd , pubkd ) = r e then out ( ch1 , ( re , s i g n ( sd , skv ) ) ) Listing 3.24 -The voting process 3. eVoting p r o c e s s V c h c = ( * p r i v a t e key * ) i n ( skvCh , skv ) . out ( chc , skv ) . ( * p u b l i c k e y s o f t h e t r u s t e d d e v i c e and t h e c o l l e c t o r * ) i n ( pkdCh , pubkd ) . out ( chc , pubkd ) .i n ( pktCh , pubkc ) . out ( chc , pubkc ) . sync 1 . ν r . out ( chc , r ) . l e t e = penc ( v , pubkc , r ) i n out ( chD , ( pk ( skv ) , e , s i g n ( e , skv ) ) ) . i n ( chD , m2 ) . out ( chc , m2 ) . l e t ( re , sd , dvpV ) = m2 i n i f checkdvp ( dvpV , e , re , pk ( skv ) ) = ok then i f c h e c k s i g n ( sd , pubkd ) = r e then out ( ch1 , ( re , s i g n ( sd , skv ) ) ) Listing 3.25 -The voting process revealing its secret data p r o c e s s D = ( * p r i v a t e key * ) i n ( skdCh , skd ) . ( * p u b l i c key o f t h e v o t e r * ) i n ( pkvCh , pubkv ) . sync 1 . i n ( chD , m1 ) . l e t ( pubv , enc , s i g ) = m1 i n i f pubv = pubkv then i f c h e c k s i g n ( s i g , pubkv ) = enc then ν r 1 . l e t r e e n c = r e n c r y p t ( enc , r 1 ) i n l e t signD = s i g n ( r e e n c , skd ) i n l e t dvpD = dvp ( enc , r e e n c , r1 , pubkv ) i n out ( chD , ( r e e n c , signD , dvpD ) ) Listing 3.26 -The trusted device process p r o c e s s V c 1 c 2 = ( * p r i v a t e key * ) i n ( skvCh , skv ) . out ( c1 , skv ) . ( * p u b l i c k e y s o f t h e t r u s t e d d e v i c e and t h e c o l l e c t o r * ) i n ( pkdCh , pubkd ) . out ( c1 , pubkd ) .

Listing 3 .

 3 28 -The voting process resisting coercion 3. eVoting p r o c e s s C = ( * r e g i s t e r l e g i t i m a t e v o t e r s * ) i n ( votCh , ( pubkv , pubkd ) ) . ( * c o l l e c t o r ' s s e c r e t key * ) i n ( skcCh , s k t ) . sync 1 . i n ( ch1 , m1 ) . l e t ( enc , s i g ) = m1 i n i f c h e c k s i g n ( c h e c k s i g n ( s i g , pubkv ) , pubkd ) = enc then sync 2 . out ( r e s , d e c r y p t (m, s k c ) )

§ 3 . 4 . 2 . 2 .

 3422 Model and Analysis. We use the following equational theory and model: open(commit(m, r), r) = m checksign(sign(m, sk), pk(sk)) = m unblind(blind(m, r), r) = m unblind(sign(blind(m, r), sk), r) = sign(m, sk)

  c e s s A = i n ( ch1 , m1 ) . l e t ( pubkeyv , s i g , b l i n d e d v o t e ) = m1 i n i f pubkeyv = pkv && b l i n d e d v o t e = c h e c k s i g n ( s i g , pkv ) then out ( ch2 , s i g n ( b l i n d e d v o t e , ska ) ) Listing 3.30 -The administrator process p r o c e s s C = synch 1 . i n ( ch3 , ( m3, m4 ) ) . i f c h e c k s i g n (m4, pka ) = m3 then ν l . out ( ch4 , ( l , m3, m4 ) ) . i n ( ch5 , ( l ' , rand ) ) . i f l = l ' then l e t voteV = open (m3, rand ) i n out ( r e s , voteV ) Listing 3.31 -The collector process p r o c e s s V = f o r ( i = 1 t o w) νb i . ν r i . l e t commitedvote i = commit ( v , r i ) i n l e t b l i n d e d v o t e i = b l i n d ( commitedvote i , b i ) i n out ( ch1 , ( pk ( skv ) , s i g n ( b l i n d e d v o t e i , skv ) , b l i n d e d v o t e i ) ) f o r ( i = 1 t o w) i n ( ch2 , m i ) . l e t r e s u l t i = c h e c k s i g n (m i , pka ) i n i f r e s u l t i = b l i n d e d v o t e i then l e t s i g n e d v o t e i = u n b l i n d (m i , b i ) i n sync 1 . f o r ( i = 1 t o w) out ( ch3 , ( commitedvote i , s i g n e d v o t e i ) ) . i n ( ch4 , ( l ,= commitedvote i ,= s i g n e d v o t e i ) ) sync 2 .

Definition 41 (

 41 MCR with a single corrupted voter (MCR SC )) A voting protocol ensures Multi-Voter Coercion-Resistance with a single corrupted voter (MCR SC ) if it ensures Multi-Voter Coercion-Resistance with multiple corrupted voters (MCR M C ) for any |J| ≤ 1.

Figure 3 . 2 -Figure 3 . 3 -

 3233 Figure 3.2 -The hierarchy of generalized privacy notions. A C -→ B means that under the assumption C a protocol ensuring A also ensures B.

  else out(res, (sign((b n , n), ska), (b n , n))) B = νr.let ebid = enc(b, pka, r) in out(ch, (sign(ebid, skb), ebid)) S = in(res, (sig, (price, id))).

Figure 4 . 1 -

 41 Figure 4.1 -Relations among the privacy notions. A C -→ B means that under the assumption C a protocol ensuring A also ensures B.

Figure 4 . 2 -

 42 Figure 4.2 -Relations among the privacy notions including corrupted bidders. A C -→ B means that under the assumption C a protocol ensuring A also ensures B.

-Figure 4 . 3 -

 43 Figure 4.3 -Relations between the privacy notions with and without corrupted bidders. A C -→ B means that under the assumption C a protocol ensuring A also ensures B.

Figures 4 .

 4 1 on the previous page, 4.2 on the preceding page and 4.3 provide overviews of the different notions and their relations. § 4.3.4.1. Privacy. The first privacy notion we consider was proposed by Dong et al. [DJP11].

  Strong Bidding-Price Secrecy with Corrupted Bidders (SBPS-C) if for an auction process AP , any bids b A < b C , b B < b C and any subset of bidders I with I ∩ {A, C} = ∅ we have

  Bidding-Price Unlinkability with Corrupted Bidders (BPU-C) if for an auction process AP , any bids b A < b C , b B < b C and any subset of bidders I with I ∩ {A, B, C} = ∅ we have

Definition 59 (

 59 Strong Anonymity with Corrupted Bidders (SA-C)) An electronic auction protocol ensures Strong Anonymity with Corrupted Bidders (SA-C) if for an auction process AP , any bids b A < b C , b B < b C and any subset of bidders I with I ∩ {A, C} = ∅ we have

§ 4 . 3 . 4 . 2 .

 4342 Receipt-Freeness. A first Receipt-Freeness definition for auction protocols was proposed by Dong et al. [DJP11]. It is a generalization of Strong Bidding-Price Secrecy (SBPS). Definition 62 (Simple Receipt-Freeness (SRF) [DJP11]) An electronic auction protocol ensures Simple Receipt-Freeness (SRF) if for an auction process AP and any bids b A < b C , b B < b C there exists a process B such that

  B and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |, and for any subset I ⊆ {1, . . . , k}, -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k},

  , and a permutation Π with ∀i : b i,B = b Π(i),A , hence we can choose I = ∅ and conclude.

  B and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅,-if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |, and for any subset I ⊆ {1, . . . , k}, -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . .

  Assume such AP A and AP B, then max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |, hence by (FPSBA) we obtain that AP A H | res ≈ l AP B H | res , which allows to conclude using (RF).

  B and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅ there exist processes B i such that for any subset H ⊆ {1, . . . , k} with H ∩ J = ∅ and-if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A ,and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅ there exist processes B i such that for any subset H ⊆ {1, . . . , k} with H ∩ J = ∅ and -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B | and for any subset I ⊆ {1, . . . , k} there exist processes B i such that for any subset H ⊆ {1, . . . , k} -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k} there exist processes B i such that for any subset H ⊆ {1, . . . , k} with ∀h ∈ H : σ b h,A = σ b h,B and H ∩ I = ∅, we have

  B and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |, and for any subset I ⊆ {1, . . . , k}, -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k},

  B and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅,-if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |, and for any subset I ⊆ {1, . . . , k}, -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k},

  B and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k}, I ∩ J = ∅, -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B |, and for any subset I ⊆ {1, . . . , k}, -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k},

  B and for any subset I ⊆ {1, . . . , k} with I ∩ J = ∅ there exist processes B i such that for any subset H ⊆ {1, . . . , k} with H ∩ J = ∅ and-if XXX=U (Unlinkability), for J = arg max i b i,A = arg max i b i,B with ∀j ∈ J : b j,A = b j,B = max i b i,A = max i b i,B and a permutation Π with ∀i : b i,B = b Π(i),A ,and for any subset I ⊆ {1, . . . , k} with I ∩ J = ∅ there exist processes B i such that for any subset H ⊆ {1, . . . , k} with H ∩ J = ∅ and -if XXX=SA (Strong Anonymity), max i b i,A = max i b i,B and | arg max i b i,A | = | arg max i b i,B | and for any subset I ⊆ {1, . . . , k} there exist processes B i such that for any subset H ⊆ {1, . . . , k} -if XXX=WA (Weak Anonymity), there exists a permutation Π with ∀i : b i,B = b Π(i),A , and for any subset I ⊆ {1, . . . , k} there exist processes B i such that for any subset H ⊆ {1, . . . , k} with ∀h ∈ H : σ b h,A = σ b h,B and H ∩ I = ∅ we have that for any contexts

Figure 4 .

 4 Figure 4.3 on page 170 sums up the relations between all the above notions.

4. 3 .

 3 Fairness, Authentication and Privacy in Auctions l e t b i d d e r ( b : i n t , k : skey , rk : pkey , ak : pkey , chR : c h a n n e l ) = ( * f i r s t message t o r e g i s t r a r : s i g n e d hash o f b i d * ) l e t ha = h ( i n t T o B i t ( b ) ) i n out ( chR , ( ha , s i g n ( ha , k ) ) ) ; ( * answer c o n t a i n i n g pseudonym P * ) i n ( chR ,m: b i t s t r i n g ) ; l e t (P : b i t s t r i n g , hc : b i t s t r i n g ) = c h e c k s i g n ( dec (m, k ) , rk ) i n i f ha = hc then ( * b i d d i n g * ) l e t c = enc ( i n t T o B i t ( b ) , ak ) i n e v e n t b i d ( b , P ) ; out ( chR , ( P , c , s i g n ( c , k ) ) ) .

Listing 4 . 1 -

 41 The bidder.

  l e t s u b r e g i s t r a r ( k : skey , bk : pkey , ak : pkey , syk : sykey , chS : channel , chA : channel , chR : c h a n n e l ) = ( * s i g n e d hash o f b i d from b i d d e r * ) i n ( chR , ( ha : b i t s t r i n g , s a : b i t s t r i n g ) ) ; i f ha = c h e c k s i g n ( sa , bk ) then ( * c r e a t e pseudonym * ) new p : b i t s t r i n g ; out ( chR , enc ( s i g n ( ( p , ha ) , k ) , bk ) ) ; ( * r e c e i v e b i d * ) i n ( chR , ( p1 : b i t s t r i n g , c : b i t s t r i n g , s c : b i t s t r i n g ) ) ; i f p = p1 && c h e c k s i g n ( sc , bk ) = c then e v e n t r e c B i d ( ha , p ) ; ( * c o n f i r m a t i o n t o b i d d e r * ) out ( chR , ( c , s i g n ( c , k ) ) ) ; ( * e n c r y p t e d b i d t o a u c t i o n e e r * ) out ( chA , s e n c ( ( p , c , ha ) , syk ) ) ; ( * s y n c h r o n i z a t i o n * ) out ( chS , ack ) . l e t r e g i s t r a r ( k : skey , bk1 : pkey , . . . , bkn : pkey , ak : pkey , chA : channel , chR : c h a n n e l ) = ( * c r e a t e symmetric key * ) new syk : sykey ; ( * c h a n n e l f o r s y n c h r o n i z a t i o n * ) new chS : c h a n n e l ; ( * s u b p r o c e s s e s * ) s u b r e g i s t r a r ( k , bk1 , ak , syk , chS , chA , chR ) | . . . s u b r e g i s t r a r ( k , bkn , ak , syk , chS , chA , chR ) | ( * r e v e a l symmetric key a f t e r s y n c h r o n i z a t i o n * ) i n ( chS , x1 : b i t s t r i n g ) ; . . . ; i n ( chS , xn : b i t s t r i n g ) ; out ( chA , syk ) .

Listing 4 . 2 -

 42 The registrar. l e t a u c t i o n e e r ( k : skey , pkR : pkey , chA : c h a n n e l )= ( * r e c e i v e b i d s and sym . key * ) i n ( chA , x1 : b i t s t r i n g ) ; . . . i n ( chA , xn : b i t s t r i n g ) ; i n ( chA , sk : sykey ) ; ( * d e c r y p t i o n * ) l e t ( p1 : b i t s t r i n g , c1 : b i t s t r i n g , ha1 : b i t s t r i n g ) = s d e c ( x1 , sk ) i n l e t b i d 1 : b i t s t r i n g=dec ( c1 , k ) i n . . . l e t ( pn : b i t s t r i n g , cn : b i t s t r i n g , han : b i t s t r i n g ) = s d e c ( xn , sk ) i n l e t bidn : b i t s t r i n g = dec ( cn , k ) i n ( * d e t e r m i n e winner * ) i f h ( b i d 1 ) = ha1 && . . . && h ( bidn ) = han then i f geq ( b i t T o I n t ( b i d 1 ) , b i t T o I n t ( b i d 2 ) ) && . . . && geq ( b i t T o I n t ( b i d 1 ) , b i t T o I n t ( bidn ) ) then e v e n t won ( b i t T o I n t ( b i d 1 ) , p1 ) ; out (chW, p1 ) e l s e i f geq ( b i t T o I n t ( b i d 2 ) , b i t T o I n t ( b i d 1 ) ) && . . . && geq ( b i t T o I n t ( b i d 2 ) , b i t T o I n t ( bidn ) ) then e v e n t won ( b i t T o I n t ( b i d 2 ) , p1 ) ; out (chW, p2 ) e l s e . . .

Listing 4 . 3 -Listing 4 . 4 -

 4344 The auctioneer. p r o c e s s ( * c r e a t e k e y s * ) new skb1 : s k e y ; new skb2 : s k e y ; new ska : s k e y ; new s k r : s k e y ; ( * p u b l i c k e y s a r e p u b l i s h e d * ) out ( chPKI , pk ( skb1 ) ) | out ( chPKI , pk ( skb2 ) ) | out ( chPKI , pk ( ska ) ) | out ( chPKI , pk ( s k r ) ) | ( * two b i d d e r s , t h e r e g i s t r a r and t h e a u c t i o n e e r * ) b i d d e r ( b1 , skb1 , pk ( s k r ) , pk ( ska ) , chR ) | b i d d e r ( b2 , skb2 , pk ( s k r ) , pk ( ska ) , chR ) | r e g i s t r a r ( skr , pk ( skb1 ) , pk ( skb2 ) , pk ( ska ) , chA , chR ) | a u c t i o n e e r ( ska , pk ( s k r ) , chA ) The main process for an instance with two bidders.

  l e t b i d d e r 1 ( b : p r i c e , chK : channel , chB : channel , chR : c h a n n e l ) = ( * s e t up j o i n t key : c r e a t e and p u b l i s h one p a r t * ) new shkey : s h s k e y s ; out ( chK , pk ( shkey ) ) ; ( * compute j o i n t key u s i n g s e c o n d p u b l i c key * ) i n ( chK , pk2 : s h p k e y s ) ; l e t pkey = combine ( pk ( shkey ) , pk2 ) i n ( * e n c r y p t b i d * ) new r : b i t s t r i n g ; l e t b i d 1 = enc ( p r i c e T o B i t ( b ) , pkey , r ) i n e v e n t b i d ( b , one ) ; out ( chB , b i d 1 ) ; ( * r e c e i v e o t h e r b i d * ) i n ( chB , b i d 2 : b i t s t r i n g ) ; e v e n t r e c B i d ( bid2 , two ) ; ( * compute p a r t i a l d e c r y p t i o n * ) l e t r e s = win ( bid1 , bid2 , shkey ) i n out ( chR , r e s ) . l e t b i d d e r 2 ( b : p r i c e , chK : channel , chB : channel , chR : c h a n n e l ) = ( * s e t up j o i n t key : c r e a t e and p u b l i s h one p a r t * ) new shkey : s h s k e y s ; i n ( chK , pk2 : s h p k e y s ) ; ( * compute j o i n t key u s i n g s e c o n d p u b l i c key * ) out ( chK , pk ( shkey ) ) ; l e t pkey = combine ( pk2 , pk ( shkey ) ) i n ( * e n c r y p t b i d * ) new r : b i t s t r i n g ; l e t b i d 1 = enc ( p r i c e T o B i t ( b ) , pkey , r ) i n ( * r e c e i v e o t h e r b i d * ) i n ( chB , b i d 2 : b i t s t r i n g ) ; e v e n t r e c B i d ( bid2 , one ) ; ( * p u b l i s h own b i d * ) e v e n t b i d ( b , two ) ; out ( chB , b i d 1 ) ; ( * compute p a r t i a l d e c r y p t i o n * ) l e t r e s = win ( bid2 , bid1 , shkey ) i n out ( chR , r e s ) .

Listing 4 . 5 -

 45 The bidders. l e t s e l l e r ( chR : channel , chW : c h a n n e l ) = ( * r e c e i v e p a r t i c a l d e c r y p t i o n s * )

Listing 4 . 6 -

 46 The seller. p r o c e s s b i d d e r 1 ( b1 , chK , chB , chR ) | b i d d e r 2 ( b2 , chK , chB , chR ) | s e l l e r ( chR , chW) Listing 4.7 -The aution process.

l e t b

  i d d e r ( b : pkey , k : skey , chBB : c h a n n e l ) = new s : s e e d ; l e t o f f e r : b i t s t r i n g = penc ( b i d v a l , b , s ) i n e v e n t b i d ( o f f e r , pk ( k ) ) ; out ( chBB , ( o f f e r , s i g n ( o f f e r , k ) ) ) .

Listing 4 . 8 -

 48 The bidder.

Listing 4 . 9 -

 49 The authority. p r o c e s s new keyone : s k e y ; new k1 : s k e y ; new k2 : s k e y ; out ( chPKI , pk ( keyone ) ) | out ( chPKI , pk ( k1 ) ) | out ( chPKI , pk ( k2 ) ) | a u t h o r i t y ( keyone , pk ( k1 ) , pk ( k2 ) , chBB1 , chBB2 , chO11 , chO21 , chO12 , chO22 , chW) | b i d d e r ( b1 , k1 , chBB1 ) ) | b i d d e r ( b2 , k2 , chBB2 ) ) Listing 4.10 -An instance with two bidders. l e t b i d d e r ( b : pkey , k : skey , chBB : channel , chAd : c h a n n e l )= new s : s e e d ; out ( chAd , ( s , b ) ) ; i n ( chAd , o f f e r : b i t s t r i n g ) ; e v e n t send ( o f f e r , pk ( k ) ) ; out ( chBB , ( o f f e r , pk ( k ) ) ) .

Listing 4 .

 4 11 -The dishonest bidder.

  Registration and Integrity Verifiability (RV):-Anyone can verify that all bids on the list were submitted by registered bidders:rv s =true =⇒ ∀b ∈ L : isReg(b) = true -Anyone can verify that the winning bids are among the submitted bids: rv w = true =⇒ ((b, p) ∈ winBid ⇒ b ∈ Indices(L)) (b) Outcome Verifiability (OV): Let winBidsPrices = win(getPrice(L)). -A losing bidder can verify that his bid was not the winning bids: ov l = true =⇒ ∀i : winBidsPrices[i] = (myBid, _) -A winning bidder can verify that his bid was among the winning bids, and that his price is correct: ov w = true =⇒ ∃i : winBidsPrices[i] = (myBid, myPrice) -The seller can verify that the list of winners and the winning prices are correctly determined: ov s = true =⇒ winBid = winBidsPrices 2. Completeness: If all participants follow the protocol correctly, the above tests succeed (i.e., the implications hold in the opposite direction, ⇐=, as well).

Listing 4 . 13 -

 413 The test rv s with events.

  i f (m1 = m && s 1 = s ) | | . . . | | (mn = m && sn = s ) then out (chRVW,OK) e l s e out (chRVW,KO) .

Listing 4 .

 4 14 -The test rv w .

  i f (m1 = m && s 1 = s ) | | . . . | | (mn = m && sn = s ) then out (chRVW,OK) ; e v e n t a c c e p t (m, s ) ; e l s e out (chRVW,KO) ; e v e n t r e j e c t ( ) .

Listing 4 .

 4 15 -The test rv w with events.

  i n ( chOn1 , ( cn , mn, pn ) ) ; i f c h e c k p r o o f ( p1 , c1 , m1, pk1 ) && . . . && c h e c k p r o o f ( pn , cn , mn, pk1 ) then i f p = one && ( (w = one && m1 = b i d v a l ) | | . . . | | (w = n && m1 <> b i d v a l && . . . && m( n-1) <> b i d v a l && mn = b i d v a l ) ) then out (chOV ,OK) e l s e i f m1 <> b i d v a l && . . . && mn <> b i d v a l && p <> one then . . . i n (chO1m , ( c1 , m1, p1 ) ) ; . . . i n (chOnm , ( cn , mn, pn ) ) ; i f c h e c k p r o o f ( p1 , c1 , m1, pkm) && . . . && c h e c k p r o o f ( pn , cn , mn, pkm) then i f p = m && ( (w = one && m1 = b i d v a l ) | | . . . | | (w = n && m1 <> b i d v a l && . . . && m( n-1) <> b i d v a l && mn = b i d v a l ) ) then out (chOV ,OK) e l s e i f m1 <> b i d v a l && . . . && mn <> b i d v a l && p <> m then out (chOV ,OK)

Listing 4 .

 4 16 -The test for ov {l,w,s} .

  i f ( c h e c k p r o o f ( p1 , c1 , m1, pk ( pk1 ) ) ) && ( c h e c k p r o o f ( p2 , c2 , m2, pk ( pk1 ) ) ) then i f p = one && w = one && m1 = bidToBit ( b i d v a l ) then i f dec ( c1 , pk1 ) <> bidToBit ( b i d v a l ) then e v e n t bad ( ) e l s e 0 e l s e i f p = one && w = two && m1 <> bidToBit ( b i d v a l ) && m2 = bidToBit ( b i d v a l ) then i f dec ( c1 , pk1 ) = bidToBit ( b i d v a l ) | | dec ( c2 , pk1 ) <> bidToBit ( b i d v a l ) then e v e n t bad ( ) e l s e 0 e l s e i f m1 <> bidToBit ( b i d v a l ) && m2 <> bidToBit ( b i d v a l ) && p <> one then i f dec ( c1 , pk1 ) = bidToBit ( b i d v a l ) | | dec ( c2 , pk1 ) = bidToBit ( b i d v a l ) then e v e n t bad ( ) e l s e 0 e l s e e v e n t KO( ) e l s e e v e n t KO( ) . p r o c e s s i n ( chPk1 , ( pk1 : s k e y ) ) ; i n ( chPk2 , ( pk2 : s k e y ) ) ; t e s t o v (chOV , chW, pk1 , pk2 , chO11 , chO21 ) Listing 4.17 -Proving soundness of ov {l,w,s} .

  win(getPrice(L)) ⇓ winBid = win(getPrice(L)) Hence we have testov 2,m * -→ OK ⇒ winBid = win(getPrice(L)) (4.7) In the next step, we generalize the result to n bids, i.e. we want to show that testov n,m * -→ OK ⇒ winBid = win(getPrice(L))

  l e t b i d d e r = i n ( chBid , b : pkey ) ; new ks : s k e y s e e d ; i n s e r t k e y s ( spkgen ( ks ) ) ; l e t k = s s k g e n ( ks ) i n new s : s e e d ; l e t o f f e r : s b l o c k s i z e = b i t T o S i g n ( enc ( b i d v a l , b , s ) ) i n new s s : s s e e d ; l e t o f f e r s = s i g n ( o f f e r , k , s s ) i n e v e n t send ( o f f e r ) ; out ( chBB1 , ( o f f e r , o f f e r s ) ) . l e t t e s t r v s = i n ( chBB2 , (m: s b l o c k s i z e , s : s i g n a t u r e ) ) ; g e t k e y s ( k ) s u c h t h a t check (m, k , s ) i n e v e n t a c c e p t (m) . p r o c e s s ( ( ! i<=N t e s t r v s ) | ( ! i<=N b i d d e r ) ) Listing 4.18 -The CryptoVerif code for checking soundness of rv s .

4. 4 .

 4 Verifiability in Auctions l e t testcomp = i n ( chAd , b : pkey ) ; new k : s k e y s e e d ; l e t spk = spkgen ( k ) i n l e t s s k = s s k g e n ( k ) i n i n s e r t k e y s ( spk ) ; new s : s e e d ; new s 1 : s s e e d ; l e t o f f e r : s b l o c k s i z e = b i t T o S i g n ( enc ( b i d v a l , b , s ) ) i n i f check ( o f f e r , spk , s i g n ( o f f e r , ssk , s 1 ) ) <> t r u e then e v e n t r e j e c t ( ) . p r o c e s s ! i<=N testcomp Listing 4.19 -The CryptoVerif code for checking completeness of rv s .

  l e t b u l l e t i n b o a r d = i n ( chBB , ( b : s b l o c k s i z e , s : s i g n a t u r e ) ) ; e v e n t onBB( b , s ) ; i n s e r t b i d s ( b , s ) . l e t t e s t r v w = i n (chW, (m: s b l o c k s i z e , s : s i g n a t u r e ) ) ; g e t b i d s (=m,= s ) i n e v e n t a c c e p t (m, s ) . p r o c e s s ( ( t e s t r v w ) | ( ! i<=N b u l l e t i n b o a r d ) ) Listing 4.20 -The CryptoVerif code for checking soundness of rv w . For the output verification tests ov {l,w,s} , again no cryptographic assumptions are needed. For completeness we only require correctness of the encryption scheme, i.e. that dec(enc(m, pkgen(r), r2), r) = m (4.9) l e t b i d d e r = new k1s : s k e y s e e d ; i n s e r t k e y s ( spkgen ( k1s ) ) ; l e t k1 = s s k g e n ( k1s ) i n new s 1 : s e e d ; l e t o f f e r 1 : s b l o c k s i z e = b i t T o S i g n ( enc ( b i d v a l , b1 , s 1 ) ) i n new s s 1 : s s e e d ; l e t o f f e r 1 s = s i g n ( o f f e r 1 , k1 , s s 1 ) i n i n s e r t o f f e r s ( o f f e r 1 ) ; e v e n t send ( o f f e r 1 , o f f e r 1 s ) ; a u t h o r i t y . l e t a u t h o r i t y = g e t k e y s ( k1 ) s u c h t h a t check ( o f f e r 1 , k1 , o f f e r 1 s ) i n l e t dec11 = dec ( s i g n T o B i t ( o f f e r 1 ) , p1 ) i n i f ( dec11 = i n j b o t ( b i d v a l ) ) then l e t m = o f f e r 1 i n t e s t r v w e l s e l e t dec21 = dec ( s i g n T o B i t ( o f f e r 1 ) , p2 ) i n i f ( dec21 = i n j b o t ( b i d v a l ) ) then l e t m = o f f e r 1 i n t e s t r v w . l e t t e s t r v w = g e t o f f e r s (=m) i n y i e l d e l s e e v e n t r e j e c t ( ) . p r o c e s s i n ( s t a r t , ( ) ) ; new p1s : k e y s e e d ; new p2s : k e y s e e d ; l e t p1 = skgen ( p1s ) i n l e t p2 = skgen ( p2s ) i n l e t p1p = pkgen ( p1s ) i n l e t p2p = pkgen ( p2s ) i n l e t b1 = p1p i n b i d d e r Listing 4.21 -The CryptoVerif code for checking completeness of rv w .

§ 4 . 4 . 3 . 2 .

 4432 Protocol by Curtis et al.. Our second case study is the protocol by Curtis et al. [CPS07] from Section 4.3.5.1. l e t t e s t o v = i n (chW, ( ( m, s , w, p ) , ( pk1 , . . . , pkm ) , p1 , ( c1 , m1 ) , . . . , ( cn ,mn ) ) ) ; i f pk1 = pkgen ( p1 ) && dec ( c1 , p1 ) = m1 && . . . && dec ( cn , p1 ) = mn then i f p = one && ( (w = one && m1 = b i d v a l ) | | . . . | | (w = n && m1 <> b i d v a l && . . . && m( n-1) <> b i d v a l && mn = b i d v a l ) ) then out (chOV , OK) e l s e i f m1 <> b i d v a l && . . . && mn <> b i d v a l && p <> one then . . . i n (chW, ( pm, ( c1 , m1 ) , . . . , ( cn ,mn ) ) ; i f pkm = pkgen (pm) && dec ( c1 ,pm) = m1 && . . . && dec ( cn ,pm) = mn then i f p = m && ( (w = one && m1 = b i d v a l ) | | . . . | | (w = n && m1 <> b i d v a l && . . . && m( n-1) <> b i d v a l && mn = b i d v a l ) ) then out (chOV , OK) e l s e i f m1 <> b i d v a l && . . . && mn <> b i d v a l

Listing 4 .

 4 22 -The soundness and completeness code for ov {l,w,s} .

  i f ( p1 = p ) | | . . . | | ( pn = p ) then out (chRVW,OK) e l s e out (chRVW,KO) .

Listing 4 .

 4 23 -The test rv w .

  i n (chW, ( p : b i t s t r i n g ) ) ; i f ( p1 = p ) | | . . . | | ( pn = p ) then out (chRVW,OK) ; e v e n t a c c e p t ( p ) e l s e out (chRVW,KO) ; e v e n t r e j e c t ( ) .

Listing 4 .

 4 24 -The test rv w with events.

  i f ( h1 = ha && c h e c k s i g n ( s1 , k1 ) = h1 ) && . . . && ( hn = ha && c h e c k s i g n ( sn , kn ) = hn ) then out ( chRVS ,OK) e l s e out ( chRVS ,KO) .

Listing 4 .

 4 25 -The test rv s .

  i f ( h1 = h1 ' && c h e c k s i g n ( s1 , k1 ) = h1 ) && . . . && ( hn = hn ' && c h e c k s i g n ( sn , kn ) = hn ) then out ( chRVS ,OK) ; e v e n t a c c e p t ( h1 , s1 , p1 , c1 , . . . , hn , sn , pn , cn ) e l s e out ( chRVS ,KO) ; e v e n t r e j e c t ( ) .

Listing 4 .

 4 26 -The test rv s with events.

Figure 4 . 4 -

 44 Figure 4.4 -Cardako bid for price p m-1 .

Figure 4 . 5 -

 45 Figure 4.5 -Cardako bidding envelope.

  17 ): open(envelope(content, k), k) = content testone(sign(envelope(x, k), sk)) =    true if x = one, false otherwise testtwo(sign(envelope(x, k), sk)) =    true if x = two, false otherwise . . . testm(sign(envelope(x, k), sk)) =    true if x = m, false otherwise checksign(sign(m, k), pk(k)) = m getmessage(sign(m, k)) = m getpubkey(sign(m, k)) = pk(k) l e t b i d d e r ( b : bid , sk : skey , chBox : channel , chBoxOut : channel , chSyncS1 : channel , . . . , chSyncSn : channel , chSyncR : channel , chWon : c h a n n e l ) = new k : key ; l e t o f f e r : l e t t e r = e n v e l o p e ( b , k ) i n l e t sb : s i g n e d l e t t e r = s i g n ( o f f e r , sk ) i n e v e n t b i d ( sb , k ) ; out ( chBox , ( sb , k ) ) ; i n ( chBoxOut , ( env : s i g n e d l e t t e r , s : key ) ) ; i f ( t e s t o n e ( env ) = t r u e ) then l e t sb : b i d = open ( g e t m e s s a g e ( env ) , s ) i n e v e n t won ( env , s ) ; out (chWon , ( sb , getpubkey ( env ) ) ) ; out ( chSyncS1 , t r u e ) ; . . . out ( chSyncSn , t r u e ) e l s e out ( chSyncS1 , f a l s e ) ; . . . out ( chSyncSn , f a l s e ) ; i n ( chSyncR , found1 : b o o l ) ; . . . i n ( chSyncR , foundn : b o o l ) ; i f ( found1 = f a l s e ) && . . . && ( foundn = f a l s e ) then . . . i f ( t e s t n ( env ) = t r u e ) then l e t sb : b i d = open ( g e t m e s s a g e ( env ) , s ) i n e v e n t won ( env , s ) ; out (chWon , ( sb , getpubkey ( env ) ) ) ; out ( chSyncS1 , t r u e ) ; chSyncR , found : b o o l ) .

Listing 4 .

 4 27 -The bidder. l e t processSwap ( chBoxIn1 : channel , . . . , chBoxInN : channel , chBoxOut1 : channel , . . . , chBoxOutN : c h a n n e l ) = i n ( chBoxIn1 , ( b1 : s i g n e d l e t t e r , k1 : key ) ) ; e v e n t r e c B i d ( b1 , k1 ) ; . . . i n ( chBoxInN , ( bn : s i g n e d l e t t e r , kn : key ) ) ; e v e n t r e c B i d ( bn , kn ) ; out ( chBoxOut1 , ( bn , kn ) ) | . . . out ( chBoxOutN , ( b1 , k1 ) ) .

Listing 4 .

 4 28 -The swap process. p r o c e s s new k1 : s k e y ; new k2 : s k e y ; new chBoxIn1 : c h a n n e l ; new chBoxIn2 : c h a n n e l ; l e t pk1 = pk ( k1 ) i n l e t pk2 = pk ( k2 ) i n out ( chPKI , ( pk1 , pk2 ) ) ; processSwap ( chBoxIn1 , chBoxIn2 , chBoxOut1 , chBoxOut2 ) | b i d d e r ( b1 , k1 , chBoxIn1 , chBoxOut1 , chSync1 , chSync2 , chWon) | b i d d e r ( b2 , k2 , chBoxIn2 , chBoxOut2 , chSync2 , chSync1 , chWon) Listing 4.29 -An instance with two bidders.

  The verification tests (Listings 4.30 on the next page, 4.31 on the facing page and 4.32 on page 248) are straightforward: To check the result, one repeats the necessary needle test, and l e t t e s t o v ( chWin : channel , chOV : channel , chBid1 : channel , . . . , chBidn : c h a n n e l ) = i n ( chWin , ( p r i c e : bid , i d : pskey ) ) ; i n ( chBid1 , ( b1 : s i g n e d l e t t e r , s 1 : key ) ) ; . . . i n ( chBidn , ( bn : s i g n e d l e t t e r , sn : key ) ) ; i f ( ( p r i c e = one ) && ( getpubkey ( b1 ) = i d ) && ( t e s t o n e ( b1 ) ) then out (chOV ,OK) . . . e l s e i f ( p r i c e = one ) && ( getpubkey ( bn ) = i d ) && ( t e s t o n e ( bn ) ) then out (chOV ,OK) . . . e l s e i f ( p r i c e = m) && ( getpubkey ( b1 ) = i d ) && ( t e s t t w o ( b1 ) ) && not ( t e s t o n e ( b1 ) ) && . . . && not ( t e s t o n e ( b2 ) ) then out (chOV ,OK) . . . e l s e i f ( p r i c e = m) && ( getpubkey ( bn ) = i d ) && ( t e s t t w o ( b2 ) ) && not ( t e s t o n e ( b1 ) ) && . . . && not ( t e s t o n e ( b2 ) ) then out (chOV ,OK) e l s e out (chOV ,KO) .

Listing 4 .

 4 30 -The verification test for ov {l,w,s} . l e t t e s t r v s (chRVS : channel , pk1 : pskey , . . . , pkn : pskey , chBoxIn1 : channel , . . . , chBoxInN : c h a n n e l ) = i n ( chBoxIn1 , ( b1 : s i g n e d l e t t e r , k1 : key ) ) ; . . . i n ( chBoxInN , ( bn : s i g n e d l e t t e r , kn : key ) ) ; i f c h e c k s i g n ( b1 , pk1 ) = g e t m e s s a g e ( b1 ) && . . . && c h e c k s i g n ( bn , pkn ) = g e t m e s s a g e ( bn ) then out ( chRVS ,OK) e l s e out ( chRVS ,KO) .

Listing 4 .

 4 31 -The verification test for rv s . l e t t e s t r v w (chRVW: channel , chW : channel , chBox1 : channel , . . . , chBoxN : c h a n n e l ) = i n ( chBox1 , ( b1 : s i g n e d l e t t e r , k1 : key ) ) ; . . . i n ( chBoxN , ( bn : s i g n e d l e t t e r , kn : key ) ) ; i n (chW, ( b : bid , i d : pskey ) ) ; i f ( open ( g e t m e s s a g e ( b1 ) , k1 ) = b && getpubkey ( b1 ) = i d ) | | . . . | | ( open ( g e t m e s s a g e ( bn ) , kn ) = b && getpubkey ( bn ) = i d ) then out (chRVW, OK) e l s e out (chRVW, KO) .

Listing 4 .

 4 32 -The test rv w .

Figure 4 . 6 -

 46 Figure 4.6 -The Woodako prototype.

Figure 4 . 7 -

 47 Figure 4.7 -Inside our Woodako prototype, where layers L0 and L1 are removed.

Figure 4 .

 4 Figure 4.8 -The Woodako box after the bid of bidder number two.

Figure 4 .

 4 Figure 4.9 -The Woodako box after two prices have been tested.

Figure 4 .

 4 Figure 4.11: the left bidder won since his column is empty, and the two others lost, as their marbles are still there (highlighted by the yellow circles).

Figure 4 .

 4 Figure 4.10 -Bidder verifiability (i.e. view from top).

Figure 4 .

 4 Figure 4.11 -Seller verifiability (i.e. view from bottom).

  l e t b i d d e r ( chBox : channel , chKey1 : channel , . . . , chKeym : channel , chKeyT : channel , chKeyP : channel , b : b a l l , chKey : channel , chMachine : channel , chBid : channel , chWon : c h a n n e l ) = b i d ( b , one ) ; , keym ) ; out ( chKeyT , keyT ) ; out ( chKeyP , keyP ) ; i n ( chMachine ,m: box ) ; out ( chKey , key1 ) ; i n ( chKey , k1 : key ) ; . . . i n ( chKey , kn : key ) ; l e t m1 = p r i c e _ o n e (m, key1 , k1 , . . . , kn ) i n l e t (w1 : b a l l , . . . , wnm: b a l l ) = check_window (m1) i n i f (w1 = one ) then i f ( ( open_top1 (m1, keyT ) ) = ( empty , empty ) ) then e v e n t won ( one , one ) , keym ) ; i n ( chKey , k1 : key ) ; . . . i n ( chKey , kn : key ) ; l e t mm = price_m (m(m-1) ,keym , k1 , . . . , kn ) i n l e t (w1 : b a l l , . . . , wm: b a l l ) = check_window (mm) i n i f (w( n-1)m = m) then i f ( open_top1 (mm, keyT ) = ( empty , empty ) ) then e v e n t won (m, one )

Listing 4 .

 4 34 -The process for the first bidder. l e t s e l l e r ( chKey1s : channel , . . . , chKeyms : channel , chKeyPs : channel , chKeyBs : channel , chKey : channel , chMachine : c h a n n e l ) = new key1 : key ; , keym ) ; out ( chKeyPs , keyP ) ; out ( chKeyBs , keyB ) ; i n ( chMachine ,m: box ) ; i n ( chKey , k1 : key ) ; . . . i n ( chKey , kn : key ) ; out ( chKey , key1 ) ; l e t m1 = p r i c e _ o n e (m, k1 , . . . , kn , key1 ) i n l e t (w1 : b a l l , . . . , wnm: b a l l ) = check_window (m1) i n i f (w1 = one ) then i f ( ( open_bottom (m1, keyB ) ) = ( empty , something , . . . , something ) ) then e v e n t won ( one , one ) e l s e . . . i f ( ( open_bottom (m1, keyB ) ) = ( something , . . . , something , empty ) ) then e v e n t won ( one , n ) e l s e 0 e l s e i n ( chKey , k1 : key ) ; . . . i n ( chKey , kn : key ) ; out ( chKey , keym ) ; l e t mm = price_m (m(m-1) , k1 , . . . , kn , keym ) i n l e t (w1 : b a l l , . . . , wnm: b a l l ) = check_window (mm) i n i f (w( n-1)m = m) then i f ( open_bottom (mm, keyB ) = ( empty , something , . . . , something ) ) then e v e n t won (m, one ) e l s e i f ( open_bottom (mm, keyB ) = ( something , . . . , something , empty ) ) then e v e n t won (m, n ) e l s e 0 e l s e 0 .

Listing 4 .

 4 35 -The seller process. p r o c e s s new chBox1 : c h a n n e l ; new chKey11 : c h a n n e l ; new chKey21 : c h a n n e l ; new chKey31 : c h a n n e l ; new chKeyT1 : c h a n n e l ; new chKeyP1 : c h a n n e l ; new chMachine1 : c h a n n e l ; new chBox2 : c h a n n e l ; new chKey12 : c h a n n e l ; new chKey22 : c h a n n e l ; new chKey32 : c h a n n e l ; new chKeyT2 : c h a n n e l ; new chKeyP2 : c h a n n e l ; new chMachine2 : c h a n n e l ; new chKey1s : c h a n n e l ; new chKey2s : c h a n n e l ; new chKey3s : c h a n n e l ; new chKeyPs : c h a n n e l ; new chKeyBs : c h a n n e l ; new chMachineS : c h a n n e l ; procMachine ( chBox1 , chBox2 , chKey11 , chKey12 , chKey1s , chKey21 , chKey22 , chKey2s , chKey31 , chKey32 , chKey3s , chKeyT1 , chKeyT2 , chKeyP1 , chKeyP2 , chKeyPs , chKeyBs , chMachine1 , chMachine2 , chMachineS , chMachineP ) | b i d d e r ( chBox1 , chKey11 , chKey21 , chKey31 , chKeyT1 , chKeyP1 , b1 , chKey , chMachine1 ) | b i d d e r 2 ( chBox2 , chKey12 , chKey22 , chKey32 , chKeyT2 , chKeyP2 , b2 , chKey , chMachine2 ) | s e l l e r ( chKey1s , chKey2s , chKey3s , chKeyPs , chKeyBs , chKey , chMachineS ) Listing 4.36 -An instance with two bidders and three possible prices.

  l e t b i d d e r ( chBox : channel , a u t h s e c : s e c r e t , h i d e s e c : s e c r e t , b : b a l l ) = new r : random ; l e t h i d = h i d e ( b , r , h i d e s e c ) i n e v e n t b i d ( h i d ) ; out ( chBox , ( auth ( hid , a u t h s e c ) ) ) . l e t t e s t r v s ( chBox1 : channel , , . . . , chBoxn : channel , authpub1 : p u b l i c , . . . , authpubn : p u b l i c ) = i n ( chBox1 , ( v1 : a u t h e n t i c a t e d ) ) ; . . . i n ( chBoxn , ( vn : a u t h e n t i c a t e d ) ) ; l e t c o n t e n t 1 = openauth ( v1 ) i n . . . l e t c o n t e n t n = openauth ( vn ) i n i f authcheck ( v1 , authpub1 ) = c o n t e n t 1 && . . . && authcheck ( vn , authpubn ) = c o n t e n t n then e v e n t a c c e p t e d ( c o n t e n t 1 , . . . , c o n t e n t c ) e l s e e v e n t r e j e c t e d ( ) .

Listing 4 .

 4 37 -The code used to verify testrvs.

Contents 5 . 1

 51 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 5.2 Limitations and Directions for Future Research . . . . . . 274

  Le « Common Criteria for Information Technology Security Evaluation »[START_REF] Chevallier-Mames | On some incompatible properties of voting schemes[END_REF], un standard international pour la certification des systèmes d'information critiques, exige une évaluation formelle du système pour les deux niveaux de certification les plus hauts, les « Evaluation Assurance Levels (EALs) » 6 et 7 [Com12b]. L'utilisation des méthodes formelles a connu des nombreux succès. Depuis les travaux importants de Dolev et Yao [DY81, DY83] et Millen [Mil84] sur les protocoles à clé publique, le développement de la logique BAN [BAN90], et les résultats bien connus de Lowe [Low96] sur l'analyse automatique du protocole de Needham-Schroeder, beaucoup de faiblesses dans des protocoles et standards existants et déployés ont été identifiées. Par exemple Mitchell, Shmatikov et Stern [MSS98] ont découvert des anomalies dans SSL (« Secure Socket Layer ») 3.0, et Delaune, Kremer et Steel [DKS10] ont constaté plusieurs faiblesses dans le standard PKCS#11 pour les clés USB cryptographiques. Mais les méthodes formelles peuvent aussi non seulement servir à identifier des failles de sécurité, mais aussi à obtenir des preuves de sécurité. Par exemple He et al. [HSD + 05] ont donné une preuve modulaire du standard IEEE 802.11i et du protocole « Transport Layer Security (TLS) », un des protocoles les plus utilisés sur internet. Plus récemment, une implémentation entièrement vérifiée de TLS a été réalisée [BFK + 13].

  , dans plusieurs cantons suisses [Gen13, Reg13] et même pour les français expatriés [Min13]. Vue l'importance du vote dans les démocraties modernes, les exigences de sécurité élevées amènent à des discussions controversées [Par07, UK 07, Min08, Bun09]. La deuxième application, les ventes aux enchères électroniques, a connu un grand succès : par exemple eBay avait plus que 112 millions d'utilisateurs actifs, et plus que 350 millions d'offres en 2012 [Don12]. Comme il s'agit d'un processus compétitif -les participants cherchent à payer le prix le plus bas possibleengageant des sommes d'argent considérables, des fraudes sont courantes [NTJ13] et la sécurité est un enjeu majeur.

  [START_REF] Curtis | An efficient eAuction protocol[END_REF], de Brandt[START_REF] Brandt | How to obtain full privacy in auctions[END_REF] et de Sako[START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. Nous identifions automatiquement grâce à l'outil ProVerif plusieurs problèmes pour les deux premiers, et obtenons des preuves automatiques en ProVerif pour le dernier.Dans la deuxième partie nous analysons la vérifiabilité des protocoles d'enchère. Nous proposons une définition abstraite, qui peut s'instancier aussi bien dans le modèle symbolique que dans le modèle calculatoire. Dans la suite, nous étudions deux exemples : les protocolesde Sako et Curtis et al.. Pour le protocole de Sako, nous proposons une preuve symbolique en utilisant ProVerif (et des généralisations manuelles), et une preuve calculatoire en utilisant CryptoVerif (et une preuve manuelle). Pour le protocole de Curtis et al. nous employons ProVerif et identifions plusieurs faiblesses.

  |P n où P 1 , . . . , P n sont premiers, c'est-à-dire qu'ils ne peuvent pas se décomposer dans des facteurs non-triviaux (Théorèmes 5 et 6). Un processus est « normé » s'il possède au moins une trace complète (c'est-à-dire qui se termine dans un état ou aucune transition n'est possible) finie. De manière similaire, nous prouvons que tout processus « fini » (c'est-à-dire toutes les traces complètes sont finies) P peut se réécrire de manière unique modulo la bisimulation faible sous la forme suivante P ≈ l P 1 | . . . |P n où P 1 , . . . , P n sont premiers (Théorèmes 13 et 14). Dans les deux cas nous obtenons un résultat d'annulation, c'est-à-dire que -P |Q ∼ l P |R implique Q ∼ l R pour P , Q et R normés (Lemme 7) -P |Q ≈ l P |R implique Q ≈ l R pour P , Q et R finis (Lemme 15)

1. 2 .

 2 Communication entre le votant ciblé et l'intrus : Nous considérons trois niveaux différents : (a) Dans le cas le plus simple, l'intrus observe simplement les données publiques. Ce cas s'appelle « Swap-Vote-Privacy », noté « SwV P ». (b) Dans le deuxième cas le votant ciblé essaye de construire un reçu en révélant toutes ces données privées pour convaincre l'intrus qu'il a voté pour un certain candidat. Ce cas s'appelle « Swap-Receipt-Freeness », noté « SwRF ». (c) Dans le cas le plus fort, le votant prétend être complétement sous contrôle de l'intrus, c'est-à-dire qu'il révèle toutes ces données privées et suit les instructions de l'intrus. Ce cas s'appelle « Swap-Coercion-Resistance », noté « SwCR ». Intuitivement « Swap-Coercion-Resistance » est plus fort que « Swap-Receipt-Freeness », qui est plus fort que « Swap-Vote-Privacy » (SwCR > SwRF > SwV P ). Intrus interne ou externe : L'intrus peut contrôler un autre votant légitime (ni le votant ciblé, ni le votant de compensation). Dans ce cas il peut par exemple essayer de copier le vote du votant ciblé. Dans nos définitions, nous distinguons deux cas : (a) L'intrus est externe, noté « O » (b) L'intrus est interne, noté « I » Intuitivement le deuxième cas est plus fort (I > O).

3 .

 3 figures 3.2 et 3.3.

  [START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF], Okamoto[START_REF] Okamoto | An electronic voting scheme[END_REF],Lee et al. [LBD + 03] et Bingo Voting [BMQR07]. Le protocole de Fujioka et al. garantit le secret du vote pour un intrus interne, mais est vulnérable aux attaques d'abstention forcée. Bien qu'il reste vulnérable aux attaques d'abstention forcée, le protocole d'Okaomoto garantit l'absence de reçu. Les deux protocoles peuvent être sécurisés contre les attaques d'abstention forcée avec un canal privé et un administrateur honnête. Le protocole de Lee et al. assure la résistance à la coercition, mais seulement contre un intrus externe, et reste vulnérable aux attaques d'abstention forcée. Finalement Bingo Voting garantit la résistance à la coercition pour un intrus interne et est protégé contre les attaques d'abstention forcée, si la liste des participants n'est pas publiée.

  Consider the following running example, where x and y are variables,

	PAR-0	A|0 ≡ A
	PAR-A	A|(B|C) ≡ (A|B)|C
	PAR-C	A|B ≡ B|A
	NEW-0	νn.0 ≡ 0
	NEW-C	νu.νv.A ≡ νv.νu.A
	NEW-PAR	A|νu.B ≡ νu.(A|B)	if u / ∈ f n(A) ∪ f v(A)
	REPL	!P ≡ P |!P
	REWRITE	{ M /x} ≡ { N /x}	if M = E N
	ALIAS	νx. { M /x} ≡ 0
	SUBST	{ M /x} |A ≡ { M /x} |A { M /x}
		Figure 2.4 -Structural Equivalence

Example 1 and c, d, k, l, m and n are names: P ex = νk.νl.νm.νd. ({ l /y} |out(c, enc(n, k))|out(d, m)|in(d, x).out(c, x)) We have dom(P ex ) = {y}, f v(P ex ) = {y}, bv(P ex ) = {x}, f n(P ex ) = {n, c}, bn(P ex ) = {k, l, m, d} and Φ(P ex ) = νk.νl.νm.νd. ({ l /y} |0|0|0) ≡ νk.νl.νm.νd. ({ l /y}) Internal Reduction ( τ

  2. Suppose P = Q|R. Let w P denote a maximal (with respect to length v ) complete (i.e. no further transitions are possible) sequence of transitions of P , i.e. length v (w P ) = |P | v . By definition of the function length v we only count external transitions in w, which by rule PAR can originate either from Q or R, hence |P | v ≤ |Q| v + |R| v . Similarly, let w Q and w R denote maximal (with respect to length v ) complete sequences of transitions of Q and R respectively, i.e. length v (w Q

  Calculus and Unique Parallel Decomposition of Processes visible transition by Q, giving a trace with more visible transitions than |Q| v , leading to a contradiction. Hence |P | v = |Q| v . 6. Assume P ∼ l Q, but w.l.o.g. |P | t > |Q| t . Let w s be a sequence of transitions of P with maximal number of transitions, i.e. length t (w s ) = |P | t . By the definition of ∼ l each transition of P can be matched by a transition by Q, giving a trace with more transitions than |Q| t , leading to a contradiction. Hence |P | t = |Q| t . Let w i be a sequence of transitions of P with minimal number of transitions, i.e. length n (w i ) = N (P ), and ending in a state P →. By the definition of ∼ l each transition of P can be matched by a transition by Q, giving a trace with less transitions than N (Q) and ending in a state Q → as Q ∼ l P by definition, leading to a contradiction. Hence N

Then there is a complete trace w P with length n (w P ) < length n (w P ). If w P contains no synchronizations of Q and R, each transition originates either from Q or R, hence giving shorter complete traces for Q and/or R, contradicting the minimality of w Q and w R . If w P contains a synchronization of Q and R, this can be rewritten into two external transitions of Q and R, resulting in a complete trace of the same length (by construction of length n ), leading to a contradiction. Hence N (P ) = N (Q) + N (R).

5. Assume

P ≈ l Q, but w.l.o.g. |P | v > |Q| v . Let

w s be a sequence of transitions of P with maximal number of visible transitions, i.e. length v (w s ) = |P | v . By the definition of ≈ l each visible transition of P can be matched by a 2. The Applied π-7. Assume P ∼ l Q but w.l.o.g. N (P ) < N (Q).

Table 2 .

 2

1 -Summary of unique factorization results for the Applied π-Calculus

3.4 Defining Privacy for Weighted Votes . . . . . . . . . . . . .

  Protocol by Okamoto . . . . . . . . . . . . . . . . 3.3.5.3 Bingo Voting . . . . . . . . . . . . . . . . . . . . .

	3. eVoting
	3.3.5.1 Protocol by Fujioka, Okamoto and Ohta (FOO) .
	3.3.5.2 3.3.5.4 Protocol by Lee, Boyd, Dawson, Kim, Yang and Yoo103
	3.3.5.5 Summary . . . . . . . . . . . . . . . . . . . . . . .
	3.4.1 Formal Definition . . . . . . . . . . . . . . . . . . . . . . . .
	3.4.2 Example: A Variant of FOO . . . . . . . . . . . . . . . . .
	3.4.2.1 Adding Vote Weights . . . . . . . . . . . . . . . .
	3.4.2.2 Model and Analysis . . . . . . . . . . . . . . . . .
	3.4.3 Link to Existing Definitions . . . . . . . . . . . . . . . . . .
	3.4.4 Including Corrupted Voters . . . . . . . . . . . . . . . . . .

3.5 Multi-Voter Coercion . . . . . . . . . . . . . . . . . . . . . .

  Multi-Voter Coercion (MCR) . . . . . . . . . . . . . . . . .

	3.5.1 Single-Voter Receipt-Freeness (SRF) . . . . . . . . . . . . .
	3.5.2 Multi-Voter Receipt-Freeness (MRF) . . . . . . . . . . . . .
	3.5.3 Single-Voter Coercion (SCR) . . . . . . . . . . . . . . . . .
	3.5.4

3.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  I,P O , i.e. Coercion-Resistance against an inside attacker in the Participation Only case.

Proof To show that Bingo Voting with voter lists ensures SwCR I,P O , we show that for any C = νc 1 .νc 2 .(_|P ) satisfying ñ ∩ f n(C) = ∅ and

Table 3 .

 3

1 -Results of the case studies publish it on the bulletin board (i.e. send in on channel ch1):

  Consider the following example: Alice owns 50% of the stocks, and Bob and Carol each hold 25%. The cases where Alice and Bob swap votes are now easily distinguishable if for example Carol votes "yes" all the time, as the result of the vote is different: 75% vs. 50% vote for "yes". Note that there are still situations where privacy is ensured in the sense that different situations give the same result. The last outcome (50% yes, 50% no) could -for example -

also be announced if Alice votes "yes" and Bob and Carol vote "no". Protocols supporting vote weights have been proposed, for example Eliasson and Zúquete [EZ06] developed a voting system supporting vote weights based on REVS

[START_REF] Joaquim | Revs -a robust electronic voting system[END_REF]

, which itself is based on the protocol by Fujioka et al.

[START_REF] Fujioka | A practical secret voting scheme for large scale elections[END_REF]

.

  O,P O ) implies (SwV P O,P O ) (cf. Lemma 18 on page 65), however we cannot swap the other voter's votes directly: As one voter is under attack, we cannot apply the equation. If however the protocol is modular, we can decompose the protocol into two instances where one contains only honest voters, and where we can then swap if necessary. By composability, we can then compose both instances and obtain the desired result.To see why Modularity is important in the proof, consider the following example.Example 19 Imagine a voting protocol where each voter publishes a signed commitment to his vote, and reveals the randomness to open it to all other voters and the election authority using private channels. The election authority opens the commitments and announces the result, but does not publish the values needed to open the commitments. To obtain Receipt-Freeness, we allow a coerced voter to ask the other voters (before the voting starts, and using private channels) ) as the values necessary to open the commitments remain private for an outside attacker, yet still all voters can compute and verify the outcome. The protocol also ensures (SwRF O,P O ): the coerced voter can successfully produce a false receipt by swapping commitments. At the same time his receipt includes the values to open the commitments of allvoters, hence violating privacy of all other voters. The protocol also ensures (EQ) if votes are not weighted, however it does not ensure (SRF) as the voter under attack breaks privacy for all other voters. For the same reason the protocol is not modular: we cannot add a corrupted voter, since he can break privacy.

if somebody is voting for the candidate the coercer wants him to vote for. If somebody does, both voters swap commitments, and the coerced voter can sign and publish the other voter's commitment to claim that this is his own commitment.

We can see that such a protocol ensures (SwV P

O,P O

c 2j Definition 32 (SRF with a single corrupted voter (SRF SC

  )) A voting protocol ensures Single-Voter Receipt Freeness with a single corrupted voter (SRF SC ) if it ensures Single-Voter Receipt Freeness with multiple corrupted voters (SRF M C ) for any |J| ≤ 1.Similarly to swap-based definitions, (SRF) is stronger than (VP). The proof is analogous to the proof in the swap-based model (SwRF Attacker,Abs implies SwV P Attacker,Abs in Lemma 18 on page 65).

  2j . Multi-Voter Receipt Freeness with a single corrupted voter (MRF SC ) if it ensures Multi-Voter Receipt Freeness with multiple corrupted voters (MRF M C ) for any |J| ≤ 1.

	Definition 35 (MRF with a single corrupted voter (MRF SC )) A voting
	protocol ensures

  2, we discuss related work. Then we model auction protocols in the Applied π-Calculus to formally define the security properties in Section 4.3.1. In the following Sections 4.3.2, 4.3.3 and 4.3.4 we model fairness, authentication and privacy properties respectively. In Section 4.3.5, we analyze our three case studies.

In the following part (Section 4.4) we propose our abstract model of auction protocols for verifiability (Section 4.4.1) as well as the definition of verifiability (Section 4.4.2) and the case studies (Section 4.4.3

  hence by (FPSBA) we obtain that AP A H | res ≈ l AP B H | res , which allows to conclude using (CR).Suppose that we have (CR-SA) and we want to show (CR). By (FPSBA) if we have AP A H | res ≈ l AP B H | res , we have max i

  and any subset I ⊆ {1, . . . , k}, there exists processes B

i such that for any subset H ⊆ {1, . . . , n} with ∀h ∈ H : σ b h,A = σ b h,B and H ∩ I = ∅ we have that for any contexts C i , i ∈ I with

Definition 73 (Verifiability -First-Price Auctions)

  An auction protocol (B, S, L, getPrice, isReg, win, winBid) ensures Verifiability if we have Verification Tests rv s , rv w , ov l , ov w , ov s respecting the following soundness conditions:

	1. Registration and Integrity Verifiability (RV):
	-Anyone can verify that all bids on the list were submitted by registered
	bidders:
	rv s = true =⇒ ∀b ∈ L : isReg(b) = true
	-Anyone can verify that the winning bid is one of the submitted bids:
	rv w = true =⇒ winBid ∈ Indices(L)
	2. Outcome Verifiability (OV):
	-A losing bidder can verify that his bid was not the winning bid:
	ov l = true =⇒ myBid = win(getPrice(L))
	-A winning bidder can verify that his bid was the winning bid:
	ov w = true =⇒ myBid = win(getPrice(L))
	-The seller can verify that the winning bid is actually the highest submitted
	bid:
	ov

s = true =⇒ winBid = win(getPrice(L))

Definition 74 (Verifiability -Other Types of Auctions)

  An generalized auction protocol (B, S, L, getPrice, isReg, win, winBid, winPrice) ensures Verifiability if we have Verification Tests rv s , rv w , ov l , ov w , ov s respecting the following conditions:

  Sako and Curtis et al.. § 4.4.3.1. Protocol by Sako. We use the protocol by Sako [Sak00] already described in Section 4.3.5.3.In our high-level model, we formalize this protocol using a set of bidders B and a seller S. The list of all submitted bids L is published on the bulletin board. The function getPrice(C) decrypts the bid by trying all possible prices until the correct value is found, i.e. until D t (C) = c (as the authorities would), and then returns t. The function isReg returns if a bid was submitted by one of the registered bidders. The function win returns the index of the highest bid, and winBid will point to the index of the winning bid at the end of the auction as announced by the authorities on the bulletin board.

  .e. that if testov n,m holds on for the winner input from channel chW, prices (i.e. public keys) pk1 to pkm, decryptions and proofs from channels chO11 to chOnm, then for any i < winBid testov 2,m { chOi1 /chO11, chOk1 /chO21, . . . , chOim /chO1m, chOkm /chO2m, two /w} holds for winner two and considering only the decryptions and proofs from channels chOi1 and chOk1 to chOim and chOkm, and analogously for i > winBid.

	Let k = winBid. We can see from the code that
	testov n,m	* -→ OK
	⇓
	(∀i < winBid : testov 2,m { chOi1 /chO11, chOk1 /chO21, . . . ,
	chOim /chO1m, chOkm /chO2m, two /w}	* -→ OK ) ∧
	(∀i > winBid : testov 2,m { chOk1 /chO11, chOi1 /chO21, . . . ,
	chOkm /chO1m, chOim /chO2m, one /w}	* -→ OK )
			Using
	the intermediate result (4.7) we have
	(∀i < winBid : win(getPrice(L[i], L[winBid])) = 2) ∧
	(∀i > winBid : win(getPrice(L[winBid], L[i])) = 1)
	and using (4.8) we can conclude
	winBid = win(getPrice(L))
			(4.8)
	< winBid : win(getPrice(L[i], L[winBid])) = 2) ∧
	(∀i > winBid : win(getPrice(L[winBid], L[i])) = 1)

i

  . The registration is done at the beginning of the protocol by the seller, and all participants can check if only the registered bidders participate by inserting a marble into the box. Hence the protocol ensures registration verifiability. Outcome verifiability is achieved by the fact that each participant can check the box and the mechanism at the beginning of the protocol, and that each bidder can check at the end whether he lost or won by opening his top layer T i. The seller can also verify the outcome by opening the bottom of the box. § 4.5.2.3. Formal Analysis. To formally verify the security properties of this protocol we need to model the properties of the box. Again, we represent the current state of the box (Figure4.7 on page 250) by an object denoted machine(•).

  Any party can apply check_window on m 1 to obtain (one, empty, empty, empty) and hence observe that a bidder won at price one. The seller can determine that bidder one is the winner by computing open_bottom(m 1 , b s ) = (empty, something). Similarly bidder one can check he is the winner by doing open_top_1(m 1 , t 1 ) = (empty, empty), and bidder two can verify his marble is still in the box with open_top_2(m 1 , t 2 ) = (empty, two).

one, two, empty, empty, l 11 , l 12 , l 1s , l 21 , l 22 , l 2s , t 1 , t 2 , p 1 , p 2 , p s , b s , empty, empty, empty, empty) If we compute m 1 = price_one(m, l 11 , l 12 , l 1s ) we obtain m 1 = machine(empty, empty, empty, two, l 11 , l 12 , l 1s , l 21 , l 22 , l 2s , t 1 , t 2 , p 1 , p 2 , p s , b s , one, empty, empty, empty)

  vente aux enchères scellées ne devrait divulguer aucune information sur les autres enchérisseurs et leurs offres jusqu'à la fin de la phase de soumission des offres, pour empêcher des tactiques non équitables. Nous appelons cette propriété « Weak » ou « Strong Noninterference », selon que le nombre de participants est divulgué ou pas. De plus, un protocole ne devrait pas permettre à un participant malhonnête de gagner la compétition même qu'il n'a pas soumis l'offre la plus élevée. Cette propriété s'appelle « Highest Price Wins ». -Authentification : Du point de vue du vendeur il est important d'assurer la non-répudiation, c'est-à-dire qu'une fois le gagnant annoncé, l'enchérisseur ne peut pas nier qu'il a soumis l'offre gagnante. De plus, dans certains systèmes d'enchère, il est interdit d'annuler une offre -il faut donc exiger la nonannulation. Dans une vente aux enchères scellées le secret des offres est une propriété bien connue, et l'anonymat des acheteurs est souvent souhaité également. Nous distinguons plusieurs notions : « Secrecy of Bids », « Bidding-Price Unlinkability », « Weak Anonymity » et « Strong Anonymity », « Receipt-Freeness » et « Coercion-Resistance ». « Secrecy of Bids » garantit que les offres perdantes restent secrètes. Dans le cas de « Bidding-Price Unlinkability » une liste des offres peut être publique, mais le lien entre la liste et les enchérisseurs perdants doit rester secret. « Strong Anonymity » implique que tous les participants (y compris le gagnant) restent anonymes, et que les offres perdantes restent secrètes. Dans le cas de « Weak Anonymity » la liste des offres peut également être publique, mais le lien avec les enchérisseurs (anonymes) reste secret. « Receipt-Freeness » assure qu'un enchérisseur peut créer des faux reçus pour prouver qu'il a enchérit une offre particulière, et « Coercion-Resistance » implique que les enchérisseurs peuvent résister à la coercition. -Vérifiabilité : Un protocole vérifiable permet aux enchérisseurs et au vendeur de vérifier que le gagnant et le prix ont été correctement calculés, et qu'il n'y avait pas d'offre illégitime soumise par un extérieur. Nous proposons des définitions formelles de toutes les propriétés d'équité, d'authentification et de respect de la vie privée dans le π-calcul appliqué. Pour les notions de respect de la vie privée nous obtenons une hiérarchie, qui est résumée dans la figure 4.3. Pour la définition de la vérifiabilité nous utilisons une approche différente : dans un modèle abstrait nous définissons les tests nécessaires pour vérifier le bon déroulement du protocole et les conditions que ces tests doivent satisfaire. Un protocole est donc vérifiable s'il possède tous les tests, et si les tests satisfont les conditions. Ce modèle peut -par exemple -s'instancier dans le π-calcul appliqué.

-Respect de la vie privée :

An attacker with similar capabilities was previously discussed informally, e.g. in[START_REF] Roger | Using encryption for authentication in large networks of computers[END_REF].

Satisfiability Modulo Theories

Originally this bisimilarity notion was only called "Labeled Bisimilarity" by Abadi and Fournet[START_REF] Abadi | Mobile values, new names, and secure communication[END_REF], however we also call it "Weak Labeled Bisimilarity" to distinguish it from "Strong Labeled Bisimilarity".

Here = does not designate syntactical identity, but rather some behavioral equivalence or bisimilarity relation.

This notation only makes sense if we know that R has a unique decomposition, which however holds in the cases where we employ it during the proof and later on.

Being able to copy votes can compromise privacy if the number of participants is small or a noticeable fraction of voters can be corrupted. Consider a case with three voters: the third voter can copy the first voter's vote and submit it as his vote. This results in (at least) two votes for

We include "swap" in the name to distinguish these notions based on swapping votes from the generalized notions in Section

3.4.3 Here we only consider a single corrupted voter, the generalization to multiple corrupted voters is discussed in Section 3.4.4.

This condition is needed to ensure that in the case P O no voter can abstain.

In our proofs we usually only consider the case of two or three voters, respectively, as this is the base case. These proofs do however generalize in a straightforward way to any number of participants. Additionally, if the protocol is modular, i.e. if instances can be composed (cf. Definition 29 on page 128 in Section 3.4.4), then the problem of many honest voters automatically reduces to the base case of two or three voters.

Note that the calculus used by ProVerif differs in some technical details from the original Applied π-Calculus. This is mainly due to the different extensions included in ProVerif, but also the semantics have been slightly simplified as the original semantics are often non-deterministic and hence difficult to reason about. Although the simplified semantics appear to be sound, there is no formal proof[START_REF] Blanchet | Re: Lien exact entre proverif et le pi-calcul applique [e-mail[END_REF], thus technically we cannot claim that the result also holds in the Applied π-Calculus. Yet we argue that ultimately our model and definitions remain as meaningful in the ProVerif-calculus as in the Applied π-Calculus.

Technically the attacker copies the vote from the bulletin board, and sends it to his corrupted voter using the channel c2. The corrupted voter then submits the signed vote to the bulletin board. Since in our modeling everybody can post on the bulletin board, the attacker can also copy the vote, sign it using the key of his corrupted voter (which he received on channel c1) and then submit it directly.

Note that although -to the best of our knowledge -there exists no formal soundness proof for the transformations performed by ProSwapper [Smy11], in this case the result is effectively confirmed by our manual proof.

This is for example a legal requirement for public elections in France [Fra69].

If we have a different number of abstaining voters, this also implies that we have a candidate which has a different number of votes on both sides.

Here we consider generalized voting processes, however due to the condition on the Vi's we know that there is exactly one message on this channel.

Here denotes the empty string.

See Section 4.2 for a detailed discussion of the properties proposed in the literature.

Note however that although in many cases the outcome computation in voting is relatively simple, there are more complex voting systems such as Single Transferable Vote (STV) used e.g. in Ireland [Cit13].

Note however that our definition also allows to have trusted parties. It is hence not as strong as other definitions in the literature, which require sufficient evidence to convince an impartial judge, and thus usually exclude any trust on parties participating in the protocol execution.

We observed a similar problem for voting protocols in Example 19 on page 135.

Note that in this model the asymmetric encryption is not probabilistic (following the original equation by Curtis et al.), however the use of a probabilistic encryption scheme does not change our results.

Note that most auction protocols assume a finite number of possible prices anyway, which we can model using a list of constants.

Note that this only works if he is allowed to submit several bids in the same auction, which is however not forbidden in the original protocol description.

Note that this attack also works is he is only allowed to submit one single bid per auction, since he is submitting to different auctions.

In the definition we did not require A to submit the highest possible bid, but only a higher bid than anybody else. We could model the existence of higher prices by defining additional private constants, but this would not change the verification task since they are never used by any honest participants and are not accessible to the attacker.

Note that in the original paper the authors suppose a "reliable broadcast channel, i.e. the adversary has no control of communication"[START_REF] Brandt | How to obtain full privacy in auctions[END_REF]. Yet even under this very strong assumption dishonest participants can impersonate other participants by submitting messages on their behalf, as the protocol does not include any authentication of the messages. In the following we consider an attacker in control of the network, however many attacks can also be executed analogously by dishonest parties -which are considered in the original paper -in the reliable broadcast setting.

This is a simplification w.r.t. the original protocol, where the partial decryptions are not published directly, but sent to the seller. He can combine them to obtain the result and learn the winner and winning price. He then publishes part of the partial decryptions on the bulletin board so that each bidder i can compute his fi using his partial decryptions. Yet the published values are insufficient to obtain fj for any other bidder j = i, i.e. each bidder only learns if he won or lost, but neither the winner nor the winning price if he is not the winner himself. In our simplified version everybody learns the winner and winning price, as it would be the case with a dishonest seller revealing the winner to everybody. As it turns out, even this simplified version is flawed.

eAuctions

This is necessary, since otherwise the attacker might send a bogus bid instead leading to a false "attack". Another solution would be to use the "passive" attacker in ProVerif, which cannot modify messages. As we are only interested in the reachability of the event reject, both approaches should be equivalent: the passive attacker might learn more since he has access to the messages, but he cannot exploit this as he is not allowed to create or modify messages.

Similar to the symbolic proof we can show that this extends to the general case using an analog proof.

As we consider only one bidder, we do not need to know how the winner is determined, we simply assume that the one participating bidder will be declared the winner.

A Cardboard version of Sako's protocol.

Wooden box based implementation of Sako's protocol.

Note that technically the needle tests cannot be modeled like this in a normal equational theory due to the case distinction, however we can implement this in ProVerif using extended destructors. A variant for a normal equational theory would be testone(sign(envelope(one, k), sk)) = true.

As in the case of Sako's protocol, we only check the base case using ProVerif, however we can show that this generalizes to any number of bidders using similar proofs.

Note that with two layers as shown in Figure4.7 on page 250 there is a side-channel attack: If the marble falls down in the rightmost column, one can hear the sound of a falling marble only once, whereas in the case of the other two columns the marble falls down twice. However there are some simple solutions: one can extend both layers further to the right so that the marbles fall down twice independently of their original column, or one can use something similar to a "bean machine", i.e. several rows of pins, arranged so that the falling marble hits a pin in each row. The idea is that the marble has a 50% chance of falling down on either side of the pin, hence arrives at a random location on the bottom.

In the case of Cardako misbehaving parties could break some properties, however any such breach is immediately detected.

La possibilité de copier des votes peut compromettre le secret des votes si le nombre de votants est faible, ou si un grand nombre de votants est corrompu. Supposons une instance avec trois votants : le troisième votant peut copier le vote du premier et le soumettre comme son vote. Cela résulte en au moins deux votes pour le candidat choisi par le premier votant ; ce dernier peut donc être déduit du résultat du vote.

Cardboard Sako

Wooden Box Sako

Acknowledgments

3. eVoting φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { n 1,1/x 7 } | { r 1/x 8 } | { n 1,1/x 9 } | { p 1/x 10 } | { p 2/x 11 } | { n 1,1/x 12 } | { r 1/x 13 } | { r 2/x 14 } | { n 2,2/x 15 } | { ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 16 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 17 )} | { ((n 1,2 ,p 2 ),commit((n 1,2 ,p 2 ),r 1,2 ),r 1,2 ) /x 18 )} | { ((n 3,2 ,p 2 ),commit((n 3,2 ,p 2 ),r 3,2 ),r 3,2 ) /x 19 )})

It is easy to see that these frames are statically equivalent.

-If the corrupted voter votes, he cannot relate his vote in any way to V A 's vote, as the receipts are meaningless to him and he has to submit his vote in clear. Suppose that he votes for p 1 (the other case is similar). We obtain the following final frames.

φ l = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2 ) /x 6 } | { r 1/x 7 } | { n 1,2/x 8 } | { r 1/x 9 } | { r 3/x 10 } | { n 3,2/x 11 } | { r 3/x 12 } | { p 1/x 13 } | { p 1/x 14 } | { p 2/x 15 } | { r 1/x 16 } | { n 1,2/x 17 } | { n 2,1/x 18 } | { r 2/x 19 } | { r 3/x 20 } | { n 3,2/x 21 } | { ((n 1,1 ,p 1 ),commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 22 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 23 } | { ((n 2,2 ,p 2 ),commit((n 2,2 ,p 2 ),r 2,2 ),r 2,2 ) /x 24 }) φ r = ν x.r.ñ.({ commit((n 1,1 ,p 1 ),r 1,1 ) /x 1 } | { commit((n 2,1 ,p 1 ),r 2,1 ) /x 2 } | { commit((n 3,1 ,p 1 ),r 3,1 ) /x 3 } | { commit((n 1,2 ,p 2 ),r 1,2 ) /x 4 } | { commit((n 2,2 ,p 2 ),r 2,2 ) /x 5 } | { commit((n 3,2 ,p 2 ),r 3,2

{ ((n 2,1 ,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 22 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 23 )} | { ((n 1,2 ,p 2 ),commit((n 1,2 ,p 2 ),r 1,2 ),r 1,2 ) /x 24 )})

The election outcome and the data published by the voting machine do not help the attacker in distinguishing both cases. He can verify if the receipt

eVoting

,p 1 ),commit((n 2,1 ,p 1 ),r 2,1 ),r 2,1 ) /x 18 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 19 )} | { ((n 1,2 ,p 2 ),commit((n 1,2 ,p 2 ),r 1,2 ),r 1,2 ) /x 20 )} | { ((n 3,2 ,p 2 ),commit((n 3,2 ,p 2 ),r 3,2 ),r 3,2 ) /x )})

It is easy to see that these frames are statically equivalent.

-If the corrupted voter votes, he cannot relate his vote in any way to V A 's vote, as the receipts are meaningless to him and he has to submit his vote in clear. Suppose that he votes for p 1 (the other case is similar). We obtain the following final frames.

{ ((n 1,1 ,p 1 ),commit((n 1,1 ,p 1 ),r 1,1 ),r 1,1 ) /x 25 } | { ((n 3,1 ,p 1 ),commit((n 3,1 ,p 1 ),r 3,1 ),r 3,1 ) /x 26 } | { ((n 2,2 ,p 2 ),commit((n 2,2 ,p 2 ),r 2,2 ),r

Obviously the votes on the right hand side are a permutation of the votes of the left hand side and as the protocol ensures Equality of Votes we have

As the protocol respects Vote-Privacy, we conclude

-Suppose the protocol respects SwV P O,P O and we want to show that it respects (VP), i.e. for any voting process

As the protocol respects (EQ), we know that there exists a permutation π such that ∀i :

. Using the fact that SwV P O,P O allows us to permute any two votes and that any permutation can be expressed as a sequence of simple permutations, we obtain V P A ≈ l V P B.

Note that if we only have one voter, he has to vote the same on both sides and the equivalence is trivially true.

It is easy to see that for protocols violation (EQ) the equivalence does not necessary hold: If a protocol uses weighted votes (e.g. Alice 66%, Bob 34%), it may satisfy (VP), but not (SwV P O,P O ).

Similarly, assume a simple yes/no referendum, where the proposition is accepted if at least half of the voters are in favor of the proposition. If however at the same time the ballots on the bulletin board allow to compute the number of "yes" and "no" votes, such a protocol may ensure (SwV P O,P O ) -if the ballots cannot be linked to the voters -, but not (VP) because two instances with a different outcome based on the ballots will have the same "result" on res: for example the instances where Alice votes "no" and Bob votes "yes" gives the same result as the instance where both vote "yes". Note that such a protocol would contradict (EQ) because we have instances where the votes are not a permutation of each other, but still give the same result.

Proof We only prove the first statement, the second is analogous.

-Suppose a protocol ensuring (SRF). We will now show that the protocol ensures (SwRF O,P O ), i.e. for any voting process V P and for all votes σ v A and σ v B that do not make a voter abstain there exists a process V i such that

Obviously the votes on both sides are a permutation of each other, thus we we have V P A H | res ≈ l V P B H | res (by (EQ)). We can apply (SRF) to obtain for any i the existence of a process V i such that

We choose i = A and obtain the desired property. Note that we have to rename the channel chc i to chc, which is possible as labeled bisimilarity is closed under α-renaming.

-Suppose a protocol ensuring (SwRF O,P O ) and we want to show (SRF), i.e.

for any voting processes

) and any number i ∈ {1, . . . , n} there exists a process V i such that we have

Then, as we suppose (EQ), the votes on the left are a permutation of the votes on the right. (SwRF O,P O ) allows us Chapter 4 eAuctions A uctions provide sellers and buyers with a way to exchange goods or services for a mutually acceptable price. Commonly the bidders strive for the least possible price, and the seller aims for the highest possible price. Due to the competitive nature of the process, security is important to ensure fairness.

In this chapter we propose a formal model for different security properties. We start by analyzing Authentication, Fairness and Privacy properties with the help of ProVerif. We discuss the protocols due to Curtis et al. [START_REF] Curtis | An efficient eAuction protocol[END_REF], Brandt [START_REF] Brandt | How to obtain full privacy in auctions[END_REF] and Sako [START_REF] Sako | An auction protocol which hides bids of losers[END_REF]. Then we propose an abstract model of Verifiability for different types of auctions, and provide case studies in the symbolic as well as in the computational model using ProVerif and CryptoVerif respectively.

Finally we discuss the idea of "true bidder-verifiable auctions", i.e. protocols that can be verified by a non-expert. This precludes relying on complex cryptography, hence we discuss two protocols achieving verifiability based only on the physical properties of the manipulated objects. Moreover, we propose a first approach to model these physical objects and their properties, and use it to provide a formal analysis of the protocols using ProVerif. Finally, the complete model for an instance with two bidders and one possible price is shown in Listing 4.10: the private key corresponding to the price is created and the public key is published. Similarly the private keys of the bidders are created and the public keys are published. Then we have three processes in parallel: The authority and two bidders.

Analysis. Similarly to the above examples, we test Non-Repudiation using the following query query offer:bitstring,id:pkey; event(won(offer,id)) ==> event(bid(offer,id)).

To also account for dishonest bidders, we give all data of the bidder except for his secret key to the intruder, and let him compose the message which is signed and sent to the bulletin board (see Listing 4.11 for the modified bidder's process). ProVerif proves that the property still holds.

Non-Cancellation is again tested using a process that tests if the conjunction of events recBid and won for a lower bid occurs, and then executes an event bad. However instead of using channels to forward the event parameters to the process we "inline" it into the authority process (i.e. include it as a macro at the end of the authority process). This is possible since anyway both events are executed inside this process, and necessary since otherwise ProVerif comes up with false attacks which essentially correspond to changing a bid inside the authority process during its computation of the winner. This is however not possible as the authority is assumed to be honest. With this modification ProVerif can conclude that a "bad" situation is unreachable using the query query event(bad()).

Similarly for Highest Price Wins we also use a process that executes an event bad if a situation violating the property (i.e. an event won for bidder two) is detected, although here no inlining is necessary. ProVerif can again conclude that such an event is unreachable.

For Weak Non-Interference we use the choice operator, as the noninterf command leads to false attacks. We use a small python script to generate all the cases for two bidders and two prices, which can then successfully be checked using ProVerif.

Privacy is also tested using the choice operator. As the protocol reveals the winner and the winning price, the highest achievable privacy notion is Strong Bidding-Price Secrecy. Hence we test two situations, where in both situations horizontal layers L1 -L5 are used to determine the winning price in a private way. Finally, the two inclined layers are intended to make it impossible to know from which column a marble fell by guiding all of them to the same spot in the bottom left part of the box.

The general idea is as follows: Each bidder will place his bid, modeled by a marble of a certain size, in the top part of the box. We use five different sizes, the smallest one representing the highest possible price, and the biggest one representing the lowest possible price. In the bidding phase, all marbles are inserted into the box onto solid layer L0. In the opening phase, layer L0 is removed. Below there is layer L1 with holes big enough to only let the smallest marbles pass through. Below layer L1, there is layer L2 with bigger holes (the size of the next biggest marble), and so on. If a bidder inputs the highest possible price, i.e. the smallest marble, this marble will fall through all layers once the solid layer is removed, hence revealing the winning price -but not the winning bidder, thanks to the inclined layers. If nobody inserted the smallest marble, no marble will fall through and the participants can then remove the next layer to check for the second highest price, and so on.

All layers L0 -L5 are equipped with four locks, one for each of the three bidders, plus one for the seller. This ensures that a layer can only be removed if all parties agree to do so. Similarly, the removable front side of the box is attached using four locks in the four corners (cf. Figure 4.8 on page 253), one for each bidder plus one for the seller. This allows the parties to inspect the interior of the box before starting the protocol.

The topmost layer consists of three independent parts T 1, T 2 and T 3 that each bidder can use to secure his bid (i.e. his marble inside the box, cf. Figure 4.8 on page 253) from the other participants. Once all bids are inserted, the transparent layer L0 is inserted just below and locked by all four parties to ensure noncancellation (cf. Figure 4.7 on the facing page). Once the winning price is determined, the bidders can open their column by removing their lock on T i and check through the transparent layer if their part of the box is empty or not, i.e. if they won or not (cf. Figure 4.10 on page 255).

Similarly the seller can remove the two inclined layers at the bottom to check if a marble is present inside a column or not (cf. Figure 4.11 on page 255). The first solid layer L1 of the price determination part is transparent to allow the participants to check at the start of the protocol if each bidder inserted exactly one marble. Note also that all participants are always in presence of the box to be able to detect misbehavior of somebody.

The protocol is then broken down into 4 phases: 1) Initialization: Each participant can check all the material and see the inside of the box as in Figure 4.7 on the preceding page to convince himself of the l e t procMachine ( chBox1 : channel , . . . , chBoxN : channel , chKey11 : channel , . . . , chKey1n : channel , chKey1s : channel , . . . , chKeym1 : channel , . . . , chKeymn : channel , chKeyms : channel , chKeyT1 : channel , . . . , chKeyTn : channel , chKeyP1 : channel , . . . , chKeyPn : channel , chKeyPS : channel , chKeyBS : channel , chMachine1 : channel , . . . , chMachineN : channel , chMachineS : channel , chMachineP : c h a n n e l )= The script also generates a process procMachine (Listing 4.33 on page 259) that receives the marbles and all the keys from the bidders and the seller, and sends the resulting machine to all participants. They can then execute the "computation" on their copy of the machine, and only need to exchange the keys necessary. Note that after each bidder inserted his marble and added his locks, an intermediate state of the machine is published on channel chMachineP. Note also that this is an over-approximation since we create many copies of the same machine, which can even evolve differently, although this is not possible in the real world.

The ProVerif code for the first bidder is shown in Listing 4.34 on page 260. He sets up his keys and sends them together with his bid/marble to the process procMachine over private channels. Once he receives the machine object, publishes his first key and waits for the other bidders keys for the first layer, and the applies the function price_one to remove the first layer. Then he checks using check_window if somebody won, and if this is the case, he checks using open_top1 if he himself won.

The seller is described by the code in Listing 4.35 on page 261. Similarly to the bidder he sets up his keys and sends them to the process procMachine over private channels. He then receives the machine and waits for the keys to remove the first layer. He published his key and applies the function price_one. If somebody won, he can determine the winner using open_bottom.

Note that in our model a bidder may insert at most one marble into the box, whereas in the real world he could try to insert several. This may lead to attacks on e.g. non-repudiation or non-cancellation: a bidder could insert two prices (marbles). The seller will observe one marble falling down when the first layer is removed. However, when he opens the bottom of the box to check for the winner, each column still contains a marble. To prevent this, the bidders and the seller check at the beginning if there is exactly one marble per column. Hence we argue that the approximation in our model is correct.

The above model allows us to prove using ProVerif that Woodako ensures Non-Repudiation, Non-Cancellation, Weak Non-Interference, Highest Price Wins and Verifiability.

For Non-Repudiation we consider two situations: In the first situation, we only assume an honest seller, and the event bid is executed by the process procMachine when he receives the marble. This corresponds to the seller observing the bidder inserting his marble into the box. In the second situation we only assume one honest bidder, he also executes the won events as in Listing 4.34 on page 260. In both situations ProVerif concludes successfully.

In the case of Non-Cancellation we removed the events won from the bidder process, they are only executed by the seller as we consider a dishonest bidder trying to cancel its bid.

We prove Weak Non-Interference using the noninterf command of ProVerif.

When verifying Privacy we consider two cases: If the seller is dishonest, the protocol only ensures secrecy of the losing bids, but the winner and winning price are revealed. If the seller is honest, the winner stays anonymous, and only the winning price is revealed. We can prove both results in ProVerif, but the verification takes approximately 24 hours for the dishonest seller and 36 hours for the honest seller case. This is due to the complexity of the equational theory and the equivalence proof. All other properties can be proved within a few seconds. Note that -as above -we only consider the base case (i.e. two bidders) due to the complexity of the equational theory for higher number of bidders and possible prices. Note also that we have to remove the publication of the intermediate states of the machine from process procMachine to avoid false attacks. Otherwise ProVerif finds an attack, where the functions price_j are applied for example on the first intermediate state using the published keys from bidder one, allowing to test only his bid for this price. This is obviously not possible in reality, as this intermediate state does not exist any more. Moreover we proved above that we have Weak-Noninterference, which means that the published intermediate states do not leak any information until the end of the bidding phase. Hence, as they are not existent any more after the end of the bidding phase, we can safely remove them in the analysis of Privacy.

For Highest Price Wins we consider an instance with two bidders, where one is honest and the other is corrupted. Since events can only be executed by honest bidders, he executes all won events, even if the other bidder wins (slightly differing from Listing 4.34 on page 260). This is possible since in the case he observes a marble falling down with his column still not empty, he can conclude that the other bidder won.

Concerning Verifiability we note that there is no need to design a test for rv w : If a marble falls down, it must have been inside the box before, hence the winner is one of the participants, and there is nothing to verify.

For rv s the test is obvious, but difficult to model: Anybody sees and verifies that the marbles and locks were added by eligible bidders, and for the rest of the process the locks on the transparent layer ensure that the bids cannot be tampered with. To model this, we use functions hide, unhide , auth, authcheck and openauth. The first two functions model the hiding of the marbles in the hand of the bidder, the remaining function model the implicit authentication using a secret (corresponding to the physical identity of the bidder), similar to a signature. We have the following equations: unhide(hide(object, rand, hidesec), hidesec) = object authcheck(auth(object, authsec), genPublic(authsec)) = object openauth(auth(object, authsec)) = object Chapter 6

Résumé en Français C ette partie contient des résumés de tous les chapitres précédents en français. Finalement nous avons exploré le concept des « enchères vraiment vérifiables par les enchérisseurs », c'est-à-dire des protocoles qui peuvent être vérifiés sans connaissances spéciales. Pour cela nous avons proposé deux protocoles inspirés du protocole de Sako : « Cardako » et « Woodako ». Cardako n'utilise que du matériel de bureau, c'est-à-dire du carton et des enveloppes. Woodako est basé sur une boîte en bois qui permet de déterminer le gagnant de manière privée et vérifiable. Nous analysons les deux en ProVerif en utilisant des théories équationnelles particulières pour modéliser le comportement des objets physiques (les enveloppes, la boîte en bois). Cela permet d'appliquer les mêmes définitions que celles appliquées aux protocoles cryptographiques.

-Perspectives

Par rapport aux résultats de décomposition unique, nous avons identifié deux pistes principales. La première consiste à étendre l'approche aux processus infinis. Un premier résultat dans cette direction a été obtenu par Hirschkoff et Pous [START_REF] Hirschkoff | On bisimilarity and substitution in presence of replication[END_REF] pour un sous-ensemble de CCS avec de la réplication uniquement niveau le plus haut. Ils ont introduit le concept de seed, c'est-à-dire le processus bisimilaire au processus initial de taille minimale, mais avec un nombre maximal de processus List of Tables