METHODS AND SYSTEMS FOR ELECTRONIC VOTING

Description

Technique antérieure

[0001] The invention is situated in the context of electronic voting.

[0002] Electronic voting can be considered, in particular, to curb abstention, automate vote counting and reduce the cost of organizing elections. However, electronic voting can only develop if the proposed voting systems offer solid security guarantees and are open to independent verification and easily accessible to voters.

[0003] Implementing a secure electronic voting system poses numerous difficulties inherent in the multiplicity of often conflicting security requirements. For example, the voter must be authenticated, to verify that they are registered on the electoral roll, but their vote must remain secret (for eternity). They must be able to ensure not only that their ballot, as well as those of other voters, is actually present in the ballot box; this is individual verifiability. They must also be able to ensure that the election result corresponds to the votes cast by legitimate voters; this is universal verifiability. They must also be unable to prove to others who they voted for, so as to discourage any attempt at corruption or extortion under threat; this is the "receipt-freeness" requirement in English, or "sans reçu" in French.

[0004] An article by Benoît Chevallier-Mames, Pierre-Alain Fouque, David Pointcheval, Julien Stern, Jacques Traoré: "On Some Incompatible Properties of Voting Schemes", Towards Trustworthy Elections - New Directions in Electronic Voting. Lecture Notes in Computer Science 6000, Springer 2010, ISBN 978-3-642-12979-7, pages 191-199. » demonstrated that it is impossible for an online voting protocol to reconcile the verifiability of the vote count, or universal verifiability, and the absolute secrecy of the vote: a protocol that guaranteed one of these properties would necessarily do so to the detriment of the other.

[0005] At the academic level, several online voting protocols have been developed in recent years. They most often make significant use of cryptography to guarantee both the often computational secrecy of the vote and / or the individual or even universal verifiability of the results.

[0006] We are particularly familiar with the Helios protocol developed by researchers from Harvard University and the Catholic University of Louvain and the Belenios protocol proposed by researchers from INRIA and CNRS.

[0007] Both ensure the universal verifiability of results and the secrecy of the vote calculation. But these protocols make the voting list public and indirectly allow the voter's identity to be linked to the expression of their vote.

[0008] The present invention aims at an electronic voting solution which does not have this drawback. Objet et résumé de l'invention

[0009] According to a first aspect, the invention relates to a method for preparing a ballot in an electronic voting system, this method comprising: a step of generating, by each module of a plurality of assessor modules of a virtual polling station, a partial decryption private key for at least one threshold encryption algorithm; a step of generating a public key for each encryption algorithm and the corresponding private key;a step of calculating, for at least one voter entity authorized to participate in the vote, a public value from a pair of keys of a traceable anonymous signature algorithm, said public value being intended to be used by said voter entity in association with a private key of said voter entity to generate an anonymous public key, said private key being intended to be used by said voter entity to calculate at least one signature in the context of the vote, the anonymity of a signature thus obtained can only be revoked by a trusted entity, said voter entity being configured to obtain its said anonymous public key blindly.;

[0010] Correlatively, the invention relates to a system for preparing a ballot in an electronic voting system, this system comprising: a module for generating, by each assessor module of a virtual polling station, a private partial decryption key for at least one threshold encryption algorithm; a module for generating a public key for each encryption algorithm and the corresponding private key;a calculation module, for at least one voter entity authorized to participate in the vote, of a public value from a pair of keys of a traceable anonymous signature algorithm, said public value being intended to be used by said voter entity in association with a private key of said voter entity to generate an anonymous public key, said private key being intended to be used by said voter entity to calculate at least one signature in the context of the vote, the anonymity of a signature thus obtained can only be revoked by a trusted entity, said voter entity being configured to obtain its said anonymous public key blindly.;

[0011] The invention thus proposes to use a scheme, or algorithm, of traceable anonymous signatures in an electronic voting context. It thus guarantees, to a user of a voting entity, the absolute secrecy of his vote except for the administrators of the trusted entity, the only ones able to revoke or lift the anonymity of the voter, for example in the case of an appeal procedure.

[0012] In particular, the voting entity obtains its anonymous public key blindly. This implies, in particular, that the trusted authorities that produce these keys are not aware of them. A voter therefore cannot suspect that a trusted authority has used its key to vote in its place.

[0013] To blindly obtain its anonymous public key, a voting entity can, for example: in a first embodiment, obtaining a generator published by a trusted authority, and calculating its anonymous public key from this generator and a private key of this voter entity, for example by raising the generator to a power obtained from this private key; and in a second embodiment, receiving data from a trusted authority, and calculating its anonymous public key from this data and a private key of this voter entity.

[0014] It is recalled that an anonymous signature scheme is a variant of a group signature scheme. The traceable anonymous signature used in the invention can allow a voter entity to prove its membership in a group, for example to the groups of legitimate voter entities without having to reveal its identity.

[0015] The anonymous signature used in the invention is traceable; therefore, it is possible, in the context of the invention, to determine whether two signatures were issued by the same voter entity or by two distinct voter entities. The validity of a signature can be verified by anyone using a public key characterizing the group. In a first exemplary embodiment, the public key characterizing the group is a set of anonymous public keys. In a second exemplary embodiment, this key is common to all voter entities and is called the "group public key". This traceability can be used to ensure that a voter entity only votes once in a ballot.

[0016] In a particular embodiment, the traceable anonymous signature algorithm used in the invention is the ECDSA signature algorithm (for "Elliptic Curve Digital Signature Algorithm") or the elliptic curve variant of the Schnorr signature algorithm.

[0017] The invention uses a threshold encryption algorithm to encrypt electronic votes, so that the private decryption key is a secret distributed among several assessor modules, the private keys of each of the assessor modules only allowing it to perform partial decryptions of a vote. To decrypt a vote, the cooperation of a predefined number, or threshold, of these assessor modules is therefore required. Noting s the threshold and n the number of assessor modules between which the secret is distributed, a vote can only be deciphered if at least s assessor modules on the ncooperate, without the need to reconstruct the private decryption key.

[0018] In a particular embodiment, the virtual polling station comprises at least three independent virtual assessors. In one embodiment, only these assessor modules can count the votes. In a particular embodiment, each assessor module of the station has a partial decryption key and at least two of the three must be collected to count a ballot.

[0019] In a particular embodiment of the method for preparing a ballot according to the invention, the anonymous public keys are obtained by at least one permutation and at least one anonymization of public keys specific to the voter entities, the anonymization being obtained by using a secret key of a pair of keys, for the traceable anonymous signature algorithm, of at least one trusted entity.

[0020] In one embodiment, this method comprises a publication step: an electoral list containing the identifiers of the voter entities and their own public keys; and a list of anonymous public keys.

[0021] In a particular embodiment, two trusted entities are used, namely: an organizing entity whose main role is to prepare and provide the electoral roll and receive the results; and a registration entity, which may be responsible for providing voting materials and sending them to the voter entities. This entity may also be responsible, in collaboration with the organizing entity, for anonymizing the electoral roll and / or providing group private keys to voters duly registered on the electoral roll. It may produce, in collaboration with the organizing entity, and for example at the request of a judge, the voting list. This registration role may be carried out, for greater security, by several entities and not just one.

[0022] In a particular embodiment of the invention, the threshold encryption algorithm used is an additive homomorphic threshold encryption algorithm. It is recalled that such a mechanism makes it possible, from a ciphertext of a message m 1 and a ciphertext of a message m 2 , to obtain a ciphertext of the message m 1 + m 2 .

[0023] More specifically, in one embodiment of the invention, the threshold additive homomorphic encryption scheme used in the invention is a variant of the El Gamal encryption scheme.

[0024] We recall that the operating principle of the El Gamal encryption scheme is as follows. Let G a cyclic group of prime order p And g T a generator of G . This scheme uses keys in which the private key is an element x T ∈ Z p ∗ and the public key is the pair ( g T , h T = g T x T ). To encrypt a message m ∈ G, we randomly choose an element r ∈ Z p ∗ then we calculate ( C 1 = g T r , C 2 = m × h T r ). The ciphertext of the message m is the pair (C 1 , C 2 ). The decryption is carried out by calculating: m = C 2 C 1 x .

[0025] In one embodiment, the invention uses a scheme in which to encrypt a message m ∈ Z p ∗ : we randomly choose an element r ∈ Z p ∗ then we calculate ( C 1 = g T r , C 2 = g m × h T r ) where g is an additional generator, chosen randomly, of G, which is part of the public parameters of the system. We will assume in particular that the discrete logarithm of g in base h T is unknown to all. The ciphertext of the message m is the pair (C 1 ,C 2 ). The decryption of the message is carried out by calculating g m = C 2 C 1 x T , then by exhaustive search, we find m from gm< . If m is "small", which is the case in the context of the voting protocol because the value of m will in fact be bounded by the number of voters, the message can be found almost instantly using the Shanks algorithm.

[0026] The invention does not require the use of a homomorphic encryption scheme. Alternatively, a mixer network can be used to shuffle the ballots. It is recalled that the concept of mixer networks, or "mix-networks" in English, makes it possible to guarantee the confidentiality of votes in an electronic voting system. A mixer is a server that takes an arbitrary number of data as input and whose purpose is to hide the correspondence between this data and the data it will produce as output. The use of several mixers in series (in this case we speak of mixer networks) makes it possible to be sure of the final result as soon as one of the mixers has actually shuffled the data. In practice, the data received at the input of the mixer network can be encrypted data, in this case the votes of the voters, and the shuffling carried out by the network makes it no longer possible to trace who encrypted what.Mixers are generally required to prove that they have done their job properly, i.e., that the mixing was performed and that no ciphers were changed, added, or deleted. The technique proposed by Jakobsson, Juels, and Rivest, known as RPC (Random Partial Checking), can be used to perform this type of zero-knowledge proof.

[0027] In this regard, it is recalled that a so-called zero-knowledge proof of knowledge allows a verifier to convince himself that a certain prover knows a secret satisfying a given predicate. The proof does not reveal any information to the verifier about the secret in question.

[0028] According to a second aspect, the invention relates to an electronic voting method implemented by a voting entity in the context of a ballot, this method comprising: a step of obtaining a public key for at least one threshold encryption algorithm; a step of obtaining a key pair of a traceable anonymous signature algorithm, this key pair comprising an anonymous public key obtained blindly and a private key intended to be used by said voter entity to calculate at least one signature in the context of the vote, the anonymity of an anonymous signature thus obtained being able to be revoked only by at least one trusted entity; a step of choosing a vote; a step of calculating a commitment on this vote; a step of calculating an encrypted version of this vote, this encrypted version being calculated using said threshold encryption algorithm; a step of calculating a traceable anonymous signature of said commitment using the private key of the traceable anonymous signature algorithm;a step of sending a ballot paper containing at least this commitment, the encrypted form, and the traceable anonymous signature of the voting entity to a virtual private ballot box.;

[0029] Correlatively, the invention also relates to a voter entity which can be used in the context of a ballot comprising: a module for obtaining a public key for at least one threshold encryption algorithm; a module for obtaining a key pair of a traceable anonymous signature algorithm, this key pair comprising an anonymous public key obtained blindly and a private key intended to be used by this voter entity to calculate at least one signature in the context of the vote, the anonymity of an anonymous signature thus obtained being able to be revoked only by at least one trusted entity; a module for obtaining a choice of a vote; a module for calculating a commitment on the vote; a module for calculating a cipher of the vote using said threshold encryption algorithm; a module for calculating a traceable anonymous signature of this commitment using the private key of the traceable anonymous signature algorithm;a module for sending a ballot paper containing this commitment, the encrypted form, and the traceable anonymous signature of the voter entity to a virtual private ballot box.;

[0030] In the embodiment described herein, the virtual private ballot box may be a server administered by the polling station. Its role may be to collect the ballots issued by the voting entities, to verify them and to retain only valid ballots.

[0031] In one embodiment, each valid ballot may include three elements: a commitment to the vote, a cipher of that vote, and an anonymous signature of the voting entity on the commitment.

[0032] In one embodiment, each valid ballot may include four elements: a commitment to the vote and a random value, a ciphertext of the vote, a ciphertext of the random value, and an anonymous signature of the voter entity on the commitment. This embodiment may in particular be implemented when the commitment uses a hash function, the digest being calculated on the vote and a random variable.

[0033] In one embodiment, each valid ballot may include five elements: a commitment to the vote and a random value, a cipher of the vote, a cipher of the random value, proof that the vote corresponds to a vote for one of the candidates in the running, and an anonymous signature of the voting entity on the commitment and the proof.

[0034] In one embodiment, each valid ballot may include six elements: a pledge on the vote as well as on a random value, a cipher of the vote, a cipher of the random value, a first proof that the vote corresponds to a vote for one of the candidates in the running, a second proof that the plaintexts associated with the ciphers, namely the vote and the random variable, are those that were pledged in the pledge, and an anonymous signature of the voting entity on the pledge and on the first proof.

[0035] In a particular embodiment of the invention, the virtual private ballot box is administered in a decentralized manner, for example according to the principle of a private blockchain.

[0036] In a particular embodiment, the virtual private ballot box can transmit, for each valid ballot: the commitment to the vote or to the vote and to the random value; the anonymous signature; and possibly proof that the vote corresponds to a vote for one of the candidates in the running.

[0037] The commitment, or pledge, on the vote allows the voting entity to commit to the vote without revealing it a priori and that this commitment can no longer be modified a posteriori. Thus, the virtual private ballot box entity has the assurance that the voting entity can no longer change its vote.

[0038] In one embodiment of the invention, the commitment is performed using a hash function. Such a function is difficult to reverse so that no one is able to obtain the vote themselves.

[0039] In one embodiment, the invention uses Pedersen's proposed pledging scheme. This scheme has the particularity of producing perfectly indistinguishable commitments ("perfectly hiding" in English), of being collision resistant and of being homomorphic for addition.

[0040] In a particular embodiment, the voting method according to the invention comprises: a step of generating a random value, the commitment relating to the vote and to the random value; a step of calculating an encrypted version of the random value, using said threshold encryption algorithm; and in which said ballot paper further comprises this encrypted version.

[0041] In a particular embodiment, the voting method according to the invention comprises: a step of generating a first zero-knowledge proof proving that the vote pledged through the commitment relates to candidates in the running; and / or a step of generating a second zero-knowledge proof proving that the plaintexts associated with said ciphertexts are those which were pledged in the commitment; and wherein said ballot paper further comprises at least one of these proofs.

[0042] In a particular embodiment, the invention uses a first threshold encryption algorithm to calculate a cipher on a vote and a second threshold encryption algorithm to calculate a cipher on a random value used in a commitment on said vote, a partial decryption private key being generated for each assessor module and for each of the algorithms.

[0043] The invention also relates to a method for validating and archiving an electronic vote in the context of a poll, this method being implemented by a virtual private ballot box and comprising: a step of receiving a ballot paper comprising at least one commitment to a vote, a cipher of the vote, a cipher of a random value used in the commitment to the vote and a traceable anonymous signature of a voter entity; a step of verifying the traceable anonymous signature; a step of verifying the absence in the virtual private ballot box of at least two ballot papers comprising traceable anonymous signatures associated with the same anonymous public key; if the result of said verifications is positive, a step of sending to a virtual public ballot box a truncated ballot paper comprising the commitment and the traceable anonymous signature; a step of storing the ballot papers until the expiry of an appeal period.

[0044] Correlatively, the invention relates to a device for validating and archiving an electronic vote in the context of a poll, this device being associated with a virtual private ballot box and comprising: a module for receiving a ballot paper comprising at least one commitment to a vote, a cipher of the vote, a cipher of a random value used in the commitment to the vote and a traceable anonymous signature of a voter entity; a module for verifying said traceable anonymous signature; a module for verifying the absence in the virtual private ballot box of at least two ballot papers comprising traceable anonymous signatures associated with the same anonymous public key; a module configured to send, if the result of said verifications is positive, to a virtual public ballot box, a truncated ballot paper comprising this commitment and said traceable anonymous signature; a module for storing the ballot papers until the expiry of an appeal period.

[0045] In one embodiment, the ballots are destroyed upon expiration of this appeal period.

[0046] As mentioned previously, ballots may also include a first zero-knowledge proof proving that the vote pledged through the pledge is for candidates in the running and / or a second zero-knowledge proof proving that the plaintexts associated with the ciphertexts are those pledged in the pledge.

[0047] In a particular embodiment, the invention uses a first threshold encryption algorithm to calculate a cipher on a vote and a second threshold encryption algorithm to calculate a cipher on a random value used in a commitment on said vote, a partial decryption private key being generated for each assessor module and for each of the algorithms.

[0048] The invention also relates to a method for validating and archiving an electronic vote in the context of a poll, this method being implemented by a virtual private ballot box and comprising: a step of receiving a ballot paper comprising at least one commitment to a vote, a cipher of the vote, a cipher of a random value used in the commitment to the vote and a traceable anonymous signature of a voter entity; a step of verifying the traceable anonymous signature; a step of verifying the absence in the virtual private ballot box of at least two ballot papers comprising traceable anonymous signatures associated with the same anonymous public key; if the result of said verifications is positive, a step of sending to a virtual public ballot box a truncated ballot paper comprising the commitment and the traceable anonymous signature; a step of storing the ballot papers until the expiry of an appeal period.

[0049] Correlatively, the invention relates to a device for validating and archiving an electronic vote in the context of a poll, this device being associated with a virtual private ballot box and comprising: a module for receiving a ballot paper comprising at least one commitment to a vote, a cipher of the vote, a cipher of a random value used in the commitment to the vote and a traceable anonymous signature of a voter entity; a module for verifying said traceable anonymous signature; a module for verifying the absence in the virtual private ballot box of at least two ballot papers comprising traceable anonymous signatures associated with the same anonymous public key; a module configured to send, if the result of said verifications is positive, to a virtual public ballot box, a truncated ballot paper comprising this commitment and said traceable anonymous signature; a module for storing the ballot papers until the expiry of an appeal period.

[0050] In one embodiment, the ballots are destroyed upon expiration of this appeal period.

[0051] In one embodiment, the ballot further comprises a first zero-knowledge proof proving that the vote pledged through the pledge is for candidates in the running and / or a second zero-knowledge proof proving that the plaintexts associated with the ciphertexts are those pledged in the pledge; said validation and archiving method further comprising a step of verifying these zero-knowledge disclosure proofs; the truncated ballot sent to the virtual public ballot box if the result of the verifications is positive, comprising the first proof.

[0052] In one embodiment of the invention, the role of the virtual public ballot box is to store the "evidence", i.e. the commitments and signatures transmitted by the private ballot box, which will allow the election to be audited.

[0053] This virtual public ballot box allows each voting entity to check at any time, as in a traditional election, that their electronic ballot is in the virtual public ballot box, that it has not been modified and that only legitimate voting entities have voted. However, the public ballot box does not allow the identity of the voting entities that participated in the vote to be known.

[0054] In one embodiment, a public blockchain could act as a public ballot box to provide greater transparency to voters and ensure the fairness of the vote.

[0055] Indeed, in accordance with the invention, the result of the election is verifiable by all, within the framework of an audit procedure. In particular, in accordance with this procedure, an observer can verify by means of signatures and commitments that all the truncated ballots published on the public virtual ballot box come from legitimate voters and that they have voted only once.

[0056] Therefore, the invention also relates to a method of auditing a ballot in which: the ballots are stored in a virtual private ballot box, each ballot box comprising a commitment to a vote and to a random value, a cipher of the vote, a cipher of said random value and a traceable anonymous signature of a voter entity; truncated ballots obtained from these ballots are stored in a virtual public ballot box, each truncated ballot box comprising said commitment and the traceable anonymous signature, said method comprising: a step of obtaining, at the end of a counting of the ballot papers, a result of the vote and a value corresponding to the sum of the random values; a step of obtaining the truncated ballot papers stored in the virtual public ballot box; a step of verifying the traceable anonymous signatures, the truncated ballot papers and verifying that the public ballot box does not contain at least two truncated ballot papers containing traceable anonymous signatures associated with the same anonymous public key; a step of calculating an audit commitment from the commitments of all the truncated ballot papers, a step of determining an audit result by comparing the audit commitment with a commitment calculated on the result and on the value.

[0057] Correlatively, the invention relates to a device for auditing a ballot in which: the ballots are stored in a virtual private ballot box, each ballot box including a commitment to a vote and a random value, a cipher of the vote, a cipher of the random value and a traceable anonymous signature of a voter entity; truncated ballots obtained from the ballots are stored in a virtual public ballot box, each truncated ballot box including the commitment and the traceable anonymous signature, this device comprising: a module for obtaining, at the end of a counting of the ballot papers, a result of the vote and a value corresponding to the sum of the random values; a module for obtaining the truncated ballot papers stored in the virtual public ballot box; a module for verifying the traceable anonymous signatures of said truncated ballot papers and for verifying the absence in said public ballot box of at least two truncated ballot papers comprising traceable anonymous signatures associated with the same anonymous public key; a module for calculating an audit commitment from the commitments of all the truncated ballot papers, a module for determining an audit result by comparing the audit commitment with a commitment calculated on said result and on said value.

[0058] In one embodiment, the ballots further comprise a first zero-knowledge proof proving that the vote pledged through the commitment is for candidates in the running and / or a second zero-knowledge proof proving that the plaintexts associated with the ciphertexts are those pledged in the commitment and the truncated ballots further comprise this first proof.

[0059] The invention guarantees a user the absolute secrecy of his vote except for the assessor entities which, if they act jointly, are the only ones able to lift the anonymity of a vote, for example in the case of an appeal procedure.

[0060] Furthermore, the invention also relates to an appeal method implemented by an appeal system following a vote in which voter entities participated, identifiers and respective own public keys of these voter entities being recorded in an electoral list, the own public keys being in accordance with a traceable anonymous signature scheme, the method comprising: a step of obtaining a list of anonymous public keys used by the voter entities, to produce signatures conforming to said scheme and included in ballot papers; a step of generating, by at least one trusted entity, a list of appeals whose elements are re-identified public keys obtained by lifting the anonymity of the public keys of this list; and a step of verifying that the re-identified public keys of the list of appeals are all included in the electoral list.

[0061] Correlatively, the invention relates to an appeal system configured to carry out an appeal following a vote in which voter entities participated, identifiers and respective public keys of the voter entities being recorded in an electoral list, the public keys being in accordance with a traceable anonymous signature scheme, in which: at least one trusted entity is configured to generate a list of appeals whose elements are re-identified public keys obtained by lifting the anonymity of public keys contained in a list of anonymous public keys used by the voter entities to produce signatures conforming to said scheme and included in ballot papers; said system comprising a control module configured to verify that the re-identified public keys of the list of appeals are all included in said electoral list.

[0062] In a particular embodiment, the appeal method according to the invention comprises a step of establishing a voting list establishing the identity of the voter entities having participated in the ballot, by comparing the appeal list and the electoral list.

[0063] The invention also relates to an electronic voting method comprising: the implementation of a method for preparing a ballot as mentioned above; the implementation of a voting method as mentioned above; the implementation of a counting method comprising: a step of obtaining, by each of a plurality of assessor modules of a virtual polling station, a private partial decryption key for at least one threshold encryption algorithm; a step of obtaining, after the closing of the ballot, and by each of the plurality of assessor modules, at least one ballot paper collected by a virtual private ballot box, each ballot paper comprising at least one commitment on a vote, an encrypted version of said vote, and a traceable anonymous signature of a voter entity; a step of obtaining by each of said assessor modules, an encrypted version of the result of the ballot;a step, implemented by each of said assessor modules, of partial decryption of said encrypted ballot result using its partial decryption private key; when a predetermined number of assessor modules corresponding to said threshold have carried out said partial decryption of said encrypted ballot result, a step of jointly obtaining a result of said ballot; and a step of publishing said result; the implementation of a validation and archiving process as mentioned above; possibly the implementation of an audit process as mentioned above; and possibly the implementation of an appeal process as mentioned above. ;

[0064] The invention also relates to an electronic voting system comprising at least one device for preparing a ballot, a voter entity, an electronic counting system, a validation and archiving device, an audit device and an appeal system as mentioned above.

[0065] In a particular embodiment, the different steps of the methods according to the invention are determined by computer program instructions.

[0066] Consequently, the invention also relates to a computer program, on an information medium, this program comprising instructions adapted to the implementation of at least one method as mentioned above.

[0067] This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0068] The invention also relates to an information medium readable by a computer, and comprising instructions of a computer program as mentioned above.

[0069] The information carrier may be any entity or device capable of storing the program. For example, the carrier may include a storage medium, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a hard disk.

[0070] On the other hand, the information carrier may be a transmissible carrier such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from a network such as the Internet.

[0071] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to perform or to be used in the performance of the method in question.

[0072] According to another aspect, this document also discloses a second method of generating keys for an anonymous signature scheme SigA 2 , this method comprising: a step of calculating, by at least one revocation entity, a pair of revocation keys comprising a public key and a private key, this private key being able to be used by this revocation entity to revoke the anonymity of an anonymous signature conforming to said SigA 2 scheme; a step of registering, by an administration entity of a group, at least one member entity with the group; a step of calculating, from the public key of the revocation key pair, a trace generator, said trace generator being intended to be used by each member entity registered in the group to generate a trace representative of this member entity and invariant with respect to the anonymous signatures generated by this member entity conforming to the SigA 2 scheme;each member entity being configured to blindly obtain a group private key, this private key being used by this member entity to generate anonymous signatures conforming to the SigA 2 scheme, these anonymous signatures comprising the trace.;

[0073] Correlatively, this document discloses a key generation system for the SigA 2 anonymous signature scheme, this system comprising: at least one revocation entity configured to calculate a revocation key pair comprising a public key and a private key, this private key being usable by the revocation entity to revoke the anonymity of an anonymous signature conforming to said SigA 2 scheme; a group administration entity configured to register at least one member entity with said group; the revocation entity being configured to calculate, from a public key of the revocation key pair, a trace generator, this trace generator being intended to be used by each member entity to generate a trace representative of this member entity, this trace being invariant with respect to the anonymous signatures generated by this member entity conforming to said SigA 2 scheme;each member entity being configured to blindly obtain a group private key, this private key being used by the member entity to generate anonymous signatures conforming to the SigA 2 scheme, these anonymous signatures comprising the trace. ;

[0074] The SigA 2 scheme is an anonymous signature scheme in which group signatures are traceable.

[0075] Advantageously, and unlike direct anonymous attestations, the anonymity of an anonymous signature generated by group members in accordance with the SigA 2 scheme can be lifted by the revocation entities.

[0076] This SigA 2 scheme also proves to be more efficient, particularly in terms of computation time, than the direct anonymous attestation schemes DAA or group signatures of the state of the art. The security of this anonymous signature scheme is also based on a so-called "non-interactive" security assumption considered more "standard" by the cryptographic community than a so-called "interactive" security assumption (for example using an oracle) on which the most efficient direct anonymous attestation schemes of the state of the art are based. Such an anonymous signature scheme thus offers better security.

[0077] In a particular embodiment, this second proposed key generation method comprises: a step of generating a key pair of the SigA 2 scheme for the group administration entity; the public key of the revocation key pair being calculated from a public key of this key pair.

[0078] In a particular embodiment of this second key generation method, the trace generator is renewed periodically.

[0079] In a particular embodiment of this second key generation method, the trace generator is specific to a given service. The service corresponds, for example, to a specific ballot.

[0080] Indeed, due to these features, the second proposed key generation method can be applied to electronic voting. It offers a signature scheme: anonymous, which ensures the secrecy of the vote; traceable, which ensures that a voter does not vote twice; in which the anonymity of the signatures is revocable, thus allowing revocation entities, in the event of an appeal for example, to establish a list of voters signing the ballot.

[0081] The invention also relates to a second method of anonymously signing a message, this method being implemented by an entity which is a member of a group and comprising: a step of registering this member with an administration entity of the group; a step of generating a trace from a trace generator calculated by at least one revocation entity and included in a public key of the group, this trace being invariant with respect to the anonymous signatures generated by this member entity in accordance with the scheme; a step of obtaining, in a blind manner, a group private key; a step of generating at least one signature in accordance with the SigA 2 anonymous signature scheme using the group private key, the signature comprising the trace.

[0082] Correlatively, the invention relates to a device for anonymously signing a message implemented by an entity which is a member of a group and comprising: a module for registering this member entity with an administration entity of the group; a module for generating a trace from a trace generator calculated by at least one revocation entity and included in a public key of the group, this trace being invariant with respect to the anonymous signatures generated by this member entity in accordance with the SigA 2 scheme; a module for obtaining, in a blind manner, a group private key; a step of generating at least one signature using this group private key, this signature comprising the trace.

[0083] In a particular embodiment, the different steps of the second key generation method and of the voting method according to the invention are determined by computer program instructions.

[0084] Consequently, the invention also relates to a computer program, on an information medium, this program comprising instructions adapted to the implementation of at least one method as mentioned above.

[0085] This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0086] The instructions for this program may be included in a computer-readable medium as mentioned above. Brève description des dessins

[0087] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended drawings which illustrate an exemplary embodiment thereof without any limiting character. In the figures: there figure 1 represents an electronic voting system according to one embodiment of the invention; the figure 2 represents in the form of a flowchart the main stages of a ballot preparation method in accordance with the invention; figure 3 represents in the form of a flowchart the main stages of a voting process in accordance with the invention; the figure 4 represents in the form of a flowchart the main stages of a validation and archiving process in accordance with the invention. figure 5 represents, in the form of a flowchart, the main steps of a counting method in accordance with a particular embodiment of the invention. figure 6 represents the main steps of an audit method in accordance with a particular embodiment of the invention; the figure 7 represents in the form of a flowchart, the main steps of a method of recourse in accordance with an embodiment of the invention; and the figure 8 represents the hardware architecture of the devices used in the invention, in a particular embodiment; the figure 9 represents a key generation system and an anonymous signature device conforming to the SigA 2 traceable anonymous signature scheme; figure 10 represents in the form of a flowchart the main steps of a second key generation method in accordance with the invention; figure 11 represents in the form of a flowchart the main stages of a process for signing a message in accordance with the SigA 2 scheme; figure 12 represents in the form of a flowchart the main stages of a signature verification process conforming to the SigA 2 scheme; the figure 13 represents, in the form of a flowchart, the main stages of an anonymity lifting process that can be used in the context of the SigA 2 scheme; the figure 14 represents an electronic voting system using the SigA 2 anonymous signature scheme; the figure 15 represents in the form of a flowchart the main stages of a key generation process in the voting system of the figure 14 ; there figure 16 represents in the form of a flowchart the main stages of a voting process using the SigA 2 anonymous signature scheme; the figure 17 represents in the form of a flowchart the main steps of a signature verification process that can be used in the voting system of the figure 14 ; there figure 18 represents, in the form of a flowchart, the main stages of an anonymity lifting process that can be used in the voting system of the figure 14 ; there figure 19 represents the hardware architecture of the devices used in a particular embodiment of the system of the figure 9 . Detailed description of the embodiments Notations et hypothèses :

[0088] In the embodiments presented below, the invention implements, in at least some of these aspects: Voter entities: Voter entities authorized to participate in the election are said to be legitimate; these entities express their vote through their ballot and sign anonymously when voting. They can ensure that their ballot will be taken into account by verifying that a commitment to their vote appears on a virtual public ballot box. They also have the possibility of auditing the count after the fact using data published on a virtual public ballot box; candidates who have presented their candidacy, called candidates in the running; a virtual polling station comprising assessor entities, only they can proceed with the count of the vote.A predetermined number (threshold) of assessor entities must be assembled to carry out the counting; an organizing entity that provides the electoral list and receives the results of the vote; a registration entity responsible, in collaboration with the organizing entity, for anonymizing the electoral list and / or providing group private keys to voters duly registered on the electoral list; it can produce, in collaboration with the organizing entity, and in particular at the request of a judge, the voting list; a virtual private ballot box. This may be a server administered by the polling station. Its role may be to collect the ballots issued by the voter entities, to verify them and to keep only valid ballots.The virtual private ballot box can transmit, for each valid ballot, public data to a virtual public ballot box; a virtual public ballot box: its role can be to store public data constituting elements of evidence allowing the election to be audited.

[0089] In the remainder of this document, we will use the PoK notation( α 1 , α 2 ,..., α n : ( α 1 , α 2 ,..., α n )) to denote a zero-disclosure proof of knowledge of elements α 1 , α 2 ,..., α n satisfying the relationship . Thus a proof of knowledge of the two prime factors of a public RSA module (named after the inventors, "Rivest-Shamir-Adleman") N would be noted: PoK( α 1 , α 2: N = α 1 · α 2 ∧ ( α 1 ≠ 1) ∧ ( α 2 ≠ 1)).

[0090] For the record, a proof of knowledge known as zero-knowledge disclosure allows a verifier to convince himself that a certain prover knows a secret S satisfying a predicate P given, for example the factorization of a given number N. The proof does not reveal to the verifier any information about the secret S in question, here the factorization of N, except that it verifies the given predicate P.

[0091] In the upcoming description: p is a prime number; the group G 1 is a cyclic group of order p used by the voting entities V i to calculate commitments on their vote v i using a first engagement scheme; , g , And g T are randomly chosen generators of this group; the group G 2 is a cyclic group of order p used to encrypt random valuesr i used in these commitments; g̃ , g T ˜ are randomly chosen generators from this group; is a hash function of {0,1} → Z p ; e is a bilinear coupling of type 2 or 3, defined on the set G 1 × G 2 to the whole G T .

[0092] We recall that a bilinear coupling, noted e, is an application defined on a set G 1 × G 2 to a set G T , Or G 1 , G 2 and G T denote cyclic groups of order p , p being a prime number. This application verifies the following properties: Bilinearity: ∀ g 1 ∈ G 1 , ∀ g 2 ∈ G 2 and ∀ ( a, b ) ∈ Z p , e g 1 a g 2 b = e g 1 g 2 ab Non-degenerate: For g 1 ≠ 1 G 1 and g 2 ≠ 1 G 2 , e ( g 1 ,g 2 ) ≠ 1 GT , where g 1 (respectively g 2 ) denotes the neutral element of the group G 1 (respectively G 2 ); Computable: ∀ g 1 ∈ G 1 , ∀ g 2 ∈ G 2, there is an efficient algorithm to calculate e ( g 1 , g 2).

[0093] In practice, the groups G 1 , G 2 and G T will be chosen such that there is no efficiently computable isomorphism between G 1 and G 2 .

[0094] There figure 1 represents an electronic voting SVE system according to one embodiment of the invention. This system comprises: a plurality of assessor modules M i of a BVV virtual polling station. In the embodiment described here, the BVV virtual polling station comprises three assessor modules M i ; an SPS system for preparing a ballot comprising these three assessor modules Mi, an organizing entity and a registration entity and an MCR cryptographic module; a plurality of voter entities V i of which only one is represented; an electronic counting system SDE comprising the three assessor modules Mi and a compilation module MC; a DVA validation and archiving device; an audit device DA of a third-party entity ET; an appeal system SR comprising a communication module COM, the organizing entity , the registration entity and an MCT control module; a private virtual ballot box UVP; and a public virtual ballot box UPB, all these entities being in accordance with a particular embodiment of the invention. These entities communicate with each other via a communication network not shown.

[0095] In the embodiment described herein, the organizing entity and the registration entity include: a COM communication module; an MCR cryptographic module configured to generate for each voter entity authorized to participate in the vote, an anonymous public key of a traceable anonymous signature algorithm, such a public key being associated with a private key intended to be used by this voter entity to anonymously sign messages within the framework of the vote; the organizing entities and recording being configured, as part of an appeal, to generate a list of appeals whose elements are re-identified public keys obtained by lifting the anonymity of the anonymous public keys used by the voter entities in the context of the vote.

[0096] It is recalled that an anonymous signature scheme is a variant of a group signature scheme. The traceable anonymous signature used in the invention can allow a voter entity to prove its membership in a group, for example to the groups of legitimate voter entities without having to reveal its identity.

[0097] In the embodiment described herein, an assessor module M i includes: an MCR cryptographic module configured to generate a partial decryption private key ( SK M i = x T i ) for at least one threshold public key encryption algorithm and for communicating this key to a compilation MC module included in said cryptographic module.

[0098] For the record, in a threshold encryption algorithm, the private key x T = ∑ i = 1 n x T i is a secret distributed among the different assessor modules. To decrypt any message, the cooperation of a predefined number ("the threshold") of these assessor modules is required. Denoting s as the threshold and n the number of assessor modules between which the secret is distributed, a message can only be decrypted if at least s assessor modules on the n cooperate, without the need to reconstitute the private key.

[0099] Each assessor module M i further includes: a COM communication module configured to obtain the valid ballots collected by the virtual private ballot box at the end of the vote, each ballot B i including at least one commitment C 1 i on a vote v i , a cipher ( C 1 i , C 2 i ) of the vote v i , and a traceable anonymous signature S i of an elector entity V i ; said cryptographic module being configured to, during the counting at the end of the vote: obtain an encrypted ( C̈ = ( R 1 , R 2)) of the result of the vote; partially decipher this code C̈ = ( R 1 , R 2) using the partial decryption private key ( SK Mi ) of the threshold encryption algorithm; send the result of this partial decryption to the MC compilation module of the SDE electronic counting system.

[0100] In the embodiment described herein, the commitments C 1 i relate to a vote v i and on a random value r i and the ballot papers also include a number C 3 i of this random value r i .

[0101] It is recalled that the invention uses a threshold encryption algorithm to encrypt electronic votes, so that the private decryption key is a secret distributed among several assessor modules, the private keys of each of the assessor modules only allowing it to perform partial decryptions of a vote. To decrypt a vote, the cooperation of a predefined number, or threshold, of these assessor modules is therefore required.

[0102] In the embodiment described here, the SPS system for preparing the vote includes, in addition to the assessor modules M i , of the organizing entity and the registration entity , an MCR cryptographic module configured to generate and securely store the public key ( g T , h T = ∏ i = 1 n g T x T i = g T ∑ i = 1 n x T i ) of each threshold encryption algorithm and the corresponding private key x T = ∑ i = 1 n x T i , these keys being obtained from the private keys SK M i = x T i partial decryption of assessor modules.

[0103] In the embodiment described here, the electronic counting system SDE comprises, in addition to the assessor modules M i : an MC compilation module configured to: obtain the result of partial decryptions of the ciphertext ( C̈ = ( R 1 , R 2) ) of the result of the vote calculated by the assessor members M i and; as soon as s assessor modules have communicated their result to it, s corresponding to the threshold of the threshold encryption algorithm, obtain the result ( Res = ∑ i = 1 l v i ) of the ballot. a COM communication module configured in particular to publish the result Res of the ballot.

[0104] In the embodiment described herein, a voter entity V i includes: an MCR cryptographic module configured to generate a pair of keys comprising a private key and a specific public key for a traceable anonymous signature algorithm, a COM communication module adapted to send an identifier of this entity and the specific public key to a trusted entity to register on an electoral list; the cryptographic module being configured to anonymously obtain an anonymous public key for a traceable anonymous signature algorithm from a generator provided by a trusted entity and the specific private key; an HMI module for obtaining a vote v i ; the COM communication module being configured to obtain a public key ( g T , h T = ∏ i = 1 n g T x T i = g T ∑ i = 1 n x T i , g T ˜ , h ˜ T = ∏ i = 1 n g ˜ T x ˜ T i = g ˜ T ∑ i = 1 n x ˜ T i ) for at least one threshold encryption algorithm; the MCR cryptographic module being configured to calculate a commitment ( C 1 i = Commit v i , r i ) on a vote v i ; the MCR module being configured to calculate a cipher ( C 1 i = g v i h T r i , C 2 i = g T r i ) of the vote v i , this figure comprising, in the embodiment described here, the commitment C 1 i , this cipher being calculated using the public key threshold encryption algorithm; the MCR cryptographic module being configured to calculate, in the context of a ballot, a traceable anonymous signature S i of commitment C 1 i using the private key, the anonymity of this signature can only be revoked by at least one trusted entity , ; the COM communication module being configured to send a ballot B i including at least the commitment C 1 i , the encrypted ( C 1 i , C 2 i ), and the traceable anonymous signature S i of the elector entity V i to a virtual private ballot box UPV.

[0105] In the embodiment described here, the DVA validation and archiving device comprises: a COM communication module configured to receive ballots B i including at least one commitment C 1 i on a vote v i , a cipher ( C 1 i , C 2 i ) of the vote v i , a cipher C 3 i of a random value r i used in the commitment and a traceable anonymous signature S i of an elector entity V i ; an MCR cryptographic module configured to verify traceable anonymous signatures S i and to verify that the virtual private ballot box UPV does not contain at least two ballot papers containing traceable anonymous signatures associated with the same anonymous public key; the communication module COM being configured to send to the virtual public ballot box UPB, if the result of the verifications is positive, for each valid ballot paper, a truncated ballot paper BT i including at least the commitment C 1 i on voting and traceable anonymous signature S i ; an MS ballot storage module B i until the expiry of an appeal period, this module being configured to destroy the ballots at the expiry of this period.

[0106] In the embodiment described here, the DA ballot audit device comprises: a COM communication module configured to obtain, at the end of a vote, truncated ballot papers BT i stored in a virtual public ballot box UPB. These truncated ballots BT i were obtained from complete ballots B i stored in a private virtual ballot box UPV, each complete ballot B i including at least one commitment C 1 i on a vote v i and on a random value r i , a cipher ( C 1 i , C 2 i ) of the vote v i , a cipher ( C 3 i of the random value r i and a traceable anonymous signature S i of an elector entity V i . In the embodiment described herein, the truncated ballot BT i only involves commitment C 1 i and the traceable anonymous signature S i . the communication COM module being configured to obtain, at the end of the counting of the complete ballots B i , a result ( Res = ∑ i = 1 l v i ) of the ballot and a value ( Rand = g ˜ ∑ i = 1 l r i ) corresponding to the sum of the random values r i ; an MCR cryptographic module configured to verify traceable anonymous signatures S i truncated ballots BT i to verify that the virtual public ballot box UPB does not contain at least two truncated ballots containing traceable anonymous signatures associated with the same anonymous public key; the cryptographic module MCR being configured to calculate an audit commitment R' 1 from the commitments C 1 i of all truncated ballots BT i ; and an MD module for determining an audit result by comparing the audit commitment R' 1 with a commitment calculated on the result Res and on the value Rand calculated on the complete ballots.

[0107] In the embodiment described herein, the SR recourse system comprises: COM means of communication capable of obtaining an electoral list containing identifiers of legitimate voter entities and their respective own public keys P i of these voter entities; the communication COM module being configured to obtain from the organizer entity and the registration entity a list of remedies whose elements are re-identified public keys obtained by lifting the anonymity of the anonymous public keys used by the voter entities in the context of the vote; an MCT control module capable of verifying that the re-identified public keys of said appeal list are all included in the said electoral list .

[0108] There figure 2 represents in the form of a flowchart the main steps PS2 to PS34 of a method for preparing a ballot, implemented by a ballot preparation system SPS in accordance with the invention.

[0109] The invention will be described in the context of a referendum, the legal votes being "0" or "1" but the invention can be applied to any type of vote.

[0110] In the embodiment described herein, the SPS preparation system comprises two trusted entities, namely an organizer entity and a registration entity .

[0111] During a PS2 stage, each assessor M i generates a private key SK M i = x T i of partial decryption for a first additive homomorphic encryption algorithm with threshold E in the cyclic group G 1. For the record, a homomorphic public key encryption algorithm for addition allows, from a ciphertext of a message m 1 and a cipher of a message m 2 to obtain an encrypted message m 1 + m 2 . The algorithm discussed here also has the characteristics of a threshold encryption algorithm presented previously.

[0112] During a PS4 stage, each assessor M i generates a private key SK M ι ˜ = x ˜ T i partial decryption for a second threshold additive homomorphic encryption algorithm E in the cyclic group G 2 .

[0113] Once the private key parts SK M i = x T i And SK M ι ˜ = x ˜ T i were created for all assessor modules M i from the polling station, the MCR cryptographic module of the SPS poll preparation system generates: (step PS6) the public key of the threshold encryption algorithm E In G 1, noted first threshold encryption algorithm, ( g T , h T = ∏ i = 1 n g T x T i = g T ∑ i = 1 n x T i ) and the corresponding private key x T = ∑ i = 1 n x T i ; (step PS8) the public key of the threshold encryption algorithm E in G 2 , denoted second threshold encryption algorithm, ( g T ˜ , h ˜ T = ∏ i = 1 n g ˜ T x ˜ T i = g ˜ T ∑ i = 1 n x ˜ T i ) and the corresponding private key x ˜ T = ∑ i = 1 n x ˜ T i .

[0114] During a PS10 stage, the organizing entity the SPS poll preparation system draws a random number ∈ Z p and generates a key pair ( SK O = x O , P O = g 0 x O ) for a traceable anonymous signature algorithm SigA 1 described later; in this key pair, SK O is the private key and is the public key. In the embodiment described herein, the organizing entity also calculates in a step PS11 a proof with zero disclosure of knowledge that she knows the discrete logarithm of in base g O : Proof O = PoK α 1 : P O = g 0 α 1 . During a PS12 stage, the organizing entity publishes his public key .

[0115] Similarly, during a PS10 step, the recording entity draws a random number ∈ Z p and generates a key pair ( ) for the traceable anonymous signature algorithm SigA 1 ; in this pair of keys, is the private key and is the public key. In the embodiment described herein, the registration entity also calculates in a step PS11 a proof with zero disclosure of knowledge that she knows the discrete logarithm of in base . During a PS12 step, the recording entity publishes his public key .

[0116] During a PS13 stage, the organizing entity and the registration entity calculate, each on their own, a value and publish g s These entities must prove that they have calculated correctly g s by generating a zero-knowledge proof respectively And And .

[0117] We will now describe in detail how the SPS poll preparation system generates, for each of the n voter entities V i i = 1 n , a key pair of the traceable anonymous signature algorithm for a first traceable signature algorithm SigA 1 .

[0118] It is assumed that each of the voter entities V i previously drew, during a PS17 step, a value x i ∈ Z q , and generated a key pair ( x i , P i = g 0 x i ) of the traceable anonymous signature algorithm SigA 1 . In this pair of keys, x i is the private key and P i is a public key specific to the entity. Each of the voter entities V i also calculates a proof with zero disclosure of knowledge that she knows the discrete logarithm of P i in base g O : Proof V i = PoK α 1 : P i = g 0 α 1 .

[0119] Each voting entity V i wishing to participate in the election registers with the registration entity . In the embodiment described herein, the own public key P i of each voting entity V i is certified by at least one recognized certification authority, for example by the organizing entity and by the registration entity .

[0120] During a PS18 stage, the organizing entity checks whether the voter entities wishing to vote are legitimate and constitutes the electoral list containing the identifiers voter entities V i legitimate and their respective own public keys P i : LE = ID V i P i i = 1 n . From this list, the organizing entity create a new list containing only the voters' own public keys: L = P i i = 1 n .

[0121] During a PS20 stage, the organizing entity randomly chooses a permutation Π 1 of {1, ... , n} in {1, ..., n} and calculates the new list L 1 = P i 1 i = 1 n Or P i 1 = P Π 1 i x O . To get this list , the elements of the list are permuted using the permutation Π 1 , then raised to the power .

[0122] During a PS22 stage, the organizing entity transmits the list to the registration entity , accompanied by a zero-knowledge proof Proof 1 , that it has indeed swapped all the elements of the list , then raised to the power each of the elements of this permuted list, without revealing nor the permutation used Π 1 . Proof 1 can be generated using the RPC (Random Partial Checking) technique.

[0123] During a PS24 step, the recording entity checks the validity of the proof Proof 1 .

[0124] If this proof is valid, it proceeds in a similar manner to . More precisely, during a PS26 step, the recording entity randomly chooses a permutation Π 2 of {1, ... , n} in {1,...,n} then calculates a new list L 2 = P i 2 i = 1 n Or P i 2 = P Π 2 i 1 x A . This list is a list in which the elements of the list are permuted using the permutation Π 2 and then raised to the power .

[0125] During a PS28 step, the recording entity transmits the list to the organizing entity , accompanied by a zero-knowledge proof Proof 2 , that it has indeed swapped all the elements of the list , then raised to the power each of the elements of this permuted list, without revealing nor the permutation used Π 2 . The proof Proof 2 can be generated using the RPC technique.

[0126] During a PS30 stage, the organizing entity checks the validity of the proof Proof 2 .

[0127] If this Proof 2 proof is valid, the organizing entity publishes, during a PS32 step: the electoral list , the list anonymous public keys of voter entities V i ; and possibly Proof 1 and Proof 2.

[0128] It is important to note that only trusted entities, namely the organizing entity , and the registration entity are able, provided they cooperate, to link an anonymous public key of to a public key of (and therefore make the link between a public key of and the voter entity V i to whom it belongs).

[0129] Each voting entity V i obtains his anonymous public key during a PS34 step and reconstructs the key pair ( x i , g S x i ). In this pair, x i is the private key that she will have to use to sign her vote anonymously and is the associated anonymous public key. It is fundamental to note that obtaining the anonymous public key by a voter entity V i is done blindly, which implies in particular that no one, apart from the voter entities themselves, including trusted authorities, knows these keys. They are, in the embodiment described here, obtained by the voter entities V i by calculating g S x i .

[0130] There figure 3 represents in the form of an organizational chart the main steps SC0 to SC18 implemented by an elector entity V i in the context of a vote, in a particular mode of implementation of the invention.

[0131] During an SC0 step, the voter entity V i gets the public key ( g T , h T = ∏ i = 1 n g T x T i = g T ∑ i = 1 n x T i ) of the first threshold encryption algorithm calculated in step PS6.

[0132] During an SC1 step, the voter entity V i gets the public key ( g T ˜ , h ˜ T = ∏ i = 1 n g ˜ T x ˜ T i = g ˜ T ∑ i = 1 n x ˜ T i ) of the second encryption algorithm calculated in step PS8.

[0133] We remind you that the elector entity V previously drawn, during step PS17, a value x i ∈ Z q , and generated a key pair ( x i , P i = g 0 x i ) of the traceable anonymous signature algorithm SigA 1 . In this pair of keys, x i is the private key and P i is a public key specific to the entity. Each of the voter entities V I also calculated a proof with zero disclosure of knowledge that she knows the discrete logarithm of P i in base g O : Proof V i = PoK α 1 : P i = g 0 α 1 .

[0134] We remind you that the elector entity V i registered with the registration entity and that it generated an anonymous public key at step PS34 associated with his private key which is used to sign his vote anonymously.

[0135] During an SC4 step, the user of the voter entity V he expresses his vote v i using the entity's HMI interface. In the embodiment described here the vote v i is the value 0 or 1.

[0136] During an SC6 step, the voter entity V i generates a random value r i .

[0137] During an SC8 step, the voter entity V i calculates a commitment ( C 1 i = Commit ( v i , r i )) on his vote v i using random value r i . In the embodiment described herein, this commitment is a pledging scheme of Pedersen and C 1 i = Commit v i r i = g v i h T r i .

[0138] During an SC10 step, the voter entity V I calculate C 2 i = g T r i then gets a cipher ( C 1 i = g v i h T r i , C 2 i = g T r i ) of the vote v i according to the first threshold encryption algorithm.

[0139] During an SC12 step, the voter entity V i calculates a cipher of the random value r i , noted C 3 i = g ˜ r i h ˜ T s i , g ˜ T s i according to the second threshold encryption algorithm, where s i ∈ Z p is a value randomly drawn by the voter entity V i .

[0140] In the embodiment described herein, these figures are calculated using the variant of the Pedersen scheme introduced previously.

[0141] During an SC14 step, the voter entity V i generates two zero-knowledge proofs (ZKP 1 , ZKP 2 ) in which: ZKP 1 proof proves that the vote v i pledged through commitment C 1 i = Commit v i r i relates to a candidate in the running, in other words is worth either “0” or “1”; and the ZKP 2 proof proves that the plain texts associated with the ciphertexts ( C 1 i , C 2 i ) And C 3 i (namely v i And r i ) are the same as those pledged in the commitment C 1 i .

[0142] In embodiments of the invention described below, a first proof is used ZKP 1 zero-knowledge disclosure proving that the vote pledged through a commitment relates to candidates in the running and a second proof ZKP 2 with zero disclosure of knowledge proving that the clear texts corresponding to the votes (sometimes called choices), or votes, of the voters, associated with the figures of these texts are those which were pledged in the commitment, namely: ZK P 1 = PoK α 1 , α 2 : C 1 i = g α 1 h T α 2 ∧ α 1 = 0 ∨ α 1 = 1 ZK P 2 = PoK α 1 , α 2 , α 3 : C 1 i = g α 1 h T α 2 ∧ C 2 i = g T α 2 ∧ C 3 i = g ˜ α 2 h ˜ T α 3 , g ˜ T α 3 Or C1i represents a voter's commitment V i on a choice vi and on a random value laughed, C2i the voting figures vi And C3i the cipher of the random value ri.

[0143] As for the first proof ZKP 1 , we can use the following calculation: We set v i = v with v = 0 or v = 1. The voting entity V i randomly draws 3 values, r , c 1- v , D 1- v of Z p . She then calculates: T v = h T r ; T 1 − v = C 1 i / g 1 − v c 1 − v h T D 1 − v ; c = H C 1 i , T 0 , T 1 ; c v = c − c 1 − v mod p ; D v = r − r i c v mod p .

[0144] The proof consists of the 4 elements of Z p following: ZKP 1 = ( c 0 , c 1 , D 0 , D 1 ) .

[0145] The proof is valid if c 0 + c 1 = H C 1 i , C 1 i c 0 h T D 0 , C 1 i / g c 1 h T D 1 .

[0146] Regarding the second proof ZKP 2 we can use the following diagram: We pose L 3 i = g ˜ r i h ˜ T s i And R 3 i = g ˜ T s i . The elector entity V i randomly draws 3 values, s, t , u of Z p . She then calculates: W 1 = g s h T t ; W 2 = g T t ; W 3 = g ˜ t h ˜ T u ; W 4 = g ˜ T u ; c = H C 1 i C 2 i C 3 i c 0 c 1 D 0 D 1 W 1 W 2 W 3 W 4 Or c 0 , c 1 , D 0 And D 1 come from the evidence ZKP 1 ; d 1 = s − v i c mod p ; d 2 = t − r i c mod p ; d 3 = u − s i c mod p . The proof consists of the 4 elements of Z p following: ZKP 2 = ( c, d 1 , d 2 , d 3) . The proof is valid if c=HC1i,C2i,C3i,c0,c1,D0,D1,gd1hTd2C1ic,gTd2C2ic,g˜d2h˜Td3L3ic,g˜Td3R3ic

[0147] During an SC16 step, the voter entity V i anonymously signs the commitment C 1 i and the proof ZKP 1 using his private key to which the anonymous public key is associated g S x i of the traceable signature algorithm SigA 1 .

[0148] During an SC18 step, the voter entity V i sends his ballot B i including commitment C 1 i , a cipher ( C 1 i , C 2 i ) of the vote v i , a cipher C 3 i of the random value r i , the two proofs ZKP 1, ZKP 2, and the anonymous signature S i of the elector entity V i to the virtual private ballot box UPV. This signature corresponds to the signature that a voter must affix to the voting list in the context of a traditional election with the fundamental difference that this signature is anonymous.

[0149] There figure 4 represents in the form of a flowchart the main steps U2 to U10 of a method for validating and archiving an electronic vote in accordance with the invention. This method is implemented by a DVA validation and archiving device in accordance with the invention, this device being associated with a virtual private ballot box UPV.

[0150] During a U2 step, the DVA validation and archiving device receives a ballot B i from a voting entity V i This ballot contains a commitment C 1 i on a vote v i , a cipher ( C 1 i , C 2 i ) of the vote v i , a cipher C 3 i of the random value r i , the two proofs ZKP 1, ZKP 2, and the anonymous signature S i of the elector entity V i . In this embodiment, the cipher uses a variant of the EI Gamal scheme introduced previously.

[0151] During a U4 test step, the DVA validation and archiving device verifies the validity of the zero-knowledge disclosure proofs ZKP 1, ZKP 2 and that of the anonymous signature S i included in this bulletin. The signature S i is validated if it uses the traceable anonymous signature algorithm SigA 1 retained for the election and if the anonymous public key used g S x i to verify this signature belongs to the anonymous list anonymous public keys of voter entities V i .

[0152] If the result of the U4 test is negative, the vote is rejected (step U5). If the result of the U4 test is positive, the DVA validation and archiving device checks during a step U6 whether the voting entity V i has not already voted. To this end, the private virtual ballot box UPV checks that said private virtual ballot box UPV does not contain at least one other ballot paper B j including a traceable anonymous signature S j associated with the same public key as S i If the voter has already voted, the DVA device processes the ballot during a U8 step. This step may consist of rejecting the vote or in any case retaining only the first of the two ballots.

[0153] In the embodiment described here, if the result of the U6 test is positive, in other words if all the checks are conclusive, the DVA device transmits a truncated bulletin BT i à the virtual public ballot box UPB during a step U10. In the embodiment described here, this truncated ballot BT i involves commitment C 1 i , the ZKP 1 proof and the anonymous signature S i . During a U12 step, the DVA device stores the bulletins B i until the expiry of a period for appeal. The bulletins B i are destroyed at the end of this period.

[0154] There figure 5 represents, in the form of a flowchart, the main steps of a method for counting a ballot in accordance with a particular embodiment of the invention. This method is implemented by the SDE electronic counting system in accordance with the invention. In the embodiment, the SDE counting system comprises the three assessor modules M i.

[0155] We remind you that each assessor M i of the polling station generated, during steps PS2, PS4, a private key SK M i = x T i partial decryption for the first encryption algorithm and a private key SK M ι ˜ = x ˜ T i partial decryption for the second encryption algorithm.

[0156] At the close of the vote, during a DP2 step each assessor module M i retrieves all valid ballots B i collected by the virtual private ballot box UPV.

[0157] During a DP3 step, each assessor module M i obtains, thanks to the homomorphic character of the pledge scheme Commit a figure C̈ = ( R 1 , R 2) of the result of the vote.

[0158] More specifically, in the embodiment described here, this step DP3 comprises: a DP4 sub-step during which each assessor module M i multiplies all the commitments between them C 1 i to obtain, thanks to the homomorphic character of the pledge scheme Commit, a new commitment R 1 relating to the sum of votes v i carried out by the voting entities V i as well as on the sum of the hazards r i used to calculate these commitments by these entities.

[0159] In the embodiment described herein, R 1 = ∏ i = 1 l C 1 i = ∏ i = 1 l g v i h T r i = g ∑ i = 1 l v i h T ∑ i = 1 l r i Or l means the number of valid ballots received by the UPV private ballot box; and a sub-step DP6, during which each assessor module M i multiplies all the values ​​together C 2 i to obtain a new value R 2 corresponding to the sum of the random steps ri carried out by the voters: . R 2 = ∏ i = 1 l C 2 i = ∏ i = 1 l g T r i = g T ∑ i = 1 l r i

[0160] In the embodiment described here, during a step DP8, each assessor module M i multiply all the numbers together C 3 i to obtain, thanks to the homomorphic character of the pledge scheme Commit, a new figure R 3 corresponding to the sum of the hazards r i randomly drawn by voters who took part in the poll: R 3 = ∏ i = 1 l C 3 i = ∏ i = 1 l g ˜ r i h ˜ T s i , g ˜ T s i = g ˜ ∑ i = 1 l r i h ˜ T ∑ i = 1 l s i , g ˜ T ∑ i = 1 l s i ) Or l designates the number of valid ballots received by the UPV private ballot box.

[0161] During a DP10 step, each assessor module M i proceeds to partial decryption of the ciphertext C̈ = ( R 1 , R 2) using its partial decryption private key SK Mi .

[0162] During a DP12 step, each member module M i of the polling station proceeds to the partial decryption of the encrypted R 3 using his partial decryption private key SK M ι ˜ .

[0163] As soon as partial decryptions of the message C̈ = ( R 1 , R 2) were obtained by assessor modules M i (the threshold s is equal to 2 in the example of the figure 5 ), the MC compilation module of the DPV counting and validation device can, by combining them, find the clear text R = g ∑ i = 1 l υ i during a DP14 step, then by exhaustive search (using Shanks' algorithm) obtain the value Res = ∑ i = 1 l υ i corresponding to the number of votes cast for “1”, and therefore to the result of the referendum (step DP16).

[0164] Similarly, as soon as partial decryptions of the ciphertext R 3 were obtained by assessor modules M i , the MC compilation module of the DPV counting and validation device can, by combining them, find the clear text g ˜ ∑ i = 1 l r i , then during a DP18 step the value Rand = ∑ i = 1 l r i corresponding to the sum of the hazards.

[0165] The compilation MC module publishes the values Res = ∑ i = 1 l υ i And Rand = ∑ i = 1 l r i during a DP20 stage.

[0166] There figure 6 represents the main steps of a method for auditing an election in accordance with an embodiment of the invention. This method is implemented by an audit DA device in accordance with the invention. This device is incorporated into a third-party entity AND of the figure 1 .

[0167] During a step A0, the audit DA device obtains the value Rand = ∑ i = 1 l r i corresponding to the sum of the random numbers drawn by the voting entities V i having participated in the vote.

[0168] During a step A1, the audit DA device obtains the truncated ballots BT i published on the UPB virtual public ballot box.

[0169] During an A2 test step, the audit DA device verifies traceable anonymous signatures S i truncated ballots BT i and checks that the virtual public ballot box UPB does not contain at least two truncated ballot papers BT i , BT j with traceable anonymous signatures associated with the same anonymous public key. This ensures that voters are legitimate and have only voted once.

[0170] If the result of test A2 is negative, the audit device DA considers that the result of the audit is negative. This situation is handled during a step A4 which is not part of the invention.

[0171] If the result of test A2 is positive, the DA audit device multiplies the commitments between them (step A6) C 1 i of all truncated ballots BT i , to obtain, thanks to the homomorphic character of the pledge scheme Commit, an R' 1 audit commitment with: R ′ 1 = ∏ i = 1 l C 1 i = ∏ i = 1 l g υ i h T r i = g ∑ i = 1 l υ i h T ∑ i = 1 l r i Or l designates the number of truncated ballots received by the UPB virtual public ballot box.

[0172] During a step A8, the audit DA device determines the result of the audit by comparing the audit commitment R' 1 with a commitment calculated on the result Res and on the value Rand. If R' 1 = Commit ( Res ,Rand ), the count is considered valid. Otherwise the result of the audit is negative and this situation is dealt with during a step A4 which is not part of the invention.

[0173] There figure 7 represents in the form of a flowchart, the main steps of an appeal method in accordance with one embodiment of the invention. This method, which can be implemented during an appeal period, consists of recounting the votes cast from the ballots archived by the virtual private ballot box UPV. This method is implemented by an appeal system SR in accordance with the invention.

[0174] During an R2 stage, the organizing entity and the registration entity from the SR appeal system retrieve the list anonymous public keys associated with the private keys that were used to produce the l signatures S i : L 3 = P i ′ i = 1 l . is therefore a subset of the list .

[0175] During a step R4, the registration entity randomly chooses a permutation Π 3 of {1, ... , l} in {1, ... , l} then calculates a new list L 4 = P i 3 i = 1 l , Or The list , is obtained by permuting all the elements of the list , using the permutation Π 3 , then raising to the power each of the elements of this permuted list.

[0176] During a step R6, the recording entity transmits the list to the organizing entity , accompanied by a zero-knowledge proof Proof 3 , proving that it has indeed swapped all the elements of the list , then raised to the power each of the elements of this permuted list, without revealing nor the permutation used Π 3 . Proof 3 can be generated using the RPC technique.

[0177] During an R8 stage, the organizing entity checks the proof Proof 3 .

[0178] If this proof is valid, the organizing entity proceeds in a similar manner to . During an R10 stage, the organizing entity randomly chooses a permutation Π 4 of {1, ..., l} in {1, ... , l} then calculates the new list L 5 = P i 4 i = 1 n Or P i 4 = P ∏ 4 i 3 x O − 1 . The list is obtained by permuting all the elements of the list using the permutation Π 4 , then raising to the power x O − 1 each of the elements of this permuted list.

[0179] During an R12 stage, the organizing entity transmits the list to the registration entity , accompanied by a zero-knowledge Proof 4 that it has indeed swapped all the elements in the list , then raised to the power x O − 1 each of the elements of this permuted list, without revealing x O − 1 nor the permutation used Π 4 . Proof 4 can be generated using the RPC technique.

[0180] During a step R14, the registration entity checks the proof Proof 4 .

[0181] If this Proof 4 evidence is valid, the registration entity transmits to an MCT control module the lists , And as well as Proof 3 and Proof 4 evidence during an R16 step.

[0182] During a step R18, the MCT control module ensures that the list is correct by verifying that the public keys of this list are included in the electoral list and that Proof 3 and Proof 4 are valid.

[0183] If this is the case, the control module MCT is able to establish, during a step R20, a signing list L by comparing the list and the electoral list , this one containing the identifiers voter entities V i and their respective own public keys P i : LE = ID V i P i i = 1 n . Variants

[0184] In the embodiment described above, the ballot is a referendum in which the legal votes are "0" or "1". The invention can be applied to votes for which there are N candidates in the running. In this case, if a voter chooses a candidate k, we can return to the previous mode by considering that he voted "1" for candidate k and "0" for all the other candidates. A ballot paper B i can for example include: a commitment jC 1 i on the vote jv i “0” or “1” for each candidate j, a number ( jC 1 i , jC 2 i ) of this vote jv i, a figure jC 3 i of a random value jr i used to calculate the commitment jC 1 i , the two proofs jZKP 1 , jZKP 2 , already mentioned for each of the votes jv i , a proof that the voter voted “1” for one and only one candidate; and the anonymous signature S i .

[0185] In the embodiment described above, the invention uses a threshold encryption algorithm E, in two groups G 1 , G 2 .

[0186] Alternatively, the invention may for example use two different threshold encryption algorithms E, E'.

[0187] In the embodiment described here, the assessor modules M i , the MC compilation module of the SDE electronic counting system, the organizing entity , the registration entity , the MCR cryptographic module of the SPS system for preparing a ballot, the MCT control module of the SR appeal system, the DVA validation and archiving device and the voter entities Vi have the hardware architecture of a ORD computer as shown schematically in figure 8 .

[0188] The ORD computer includes in particular a processor 7, a read-only memory 8, a random access memory 9, a non-volatile memory 10 and COM communication means. These COM communication means allow the different entities to communicate with each other in particular. They may include one or more communication interfaces on one or more telecommunications networks (fixed or mobile, wired or wireless, etc.).

[0189] The read-only memory 8 of the computer 6 constitutes a recording medium in accordance with the invention, readable by the processor and on which is recorded a computer program in accordance with the invention, generally designated here by PROG, comprising instructions for the execution of one of the methods which are the subject of the invention. Thus: for assessor modules M i , the PROG program is a PROG1 program comprising instructions for executing steps PS2 and PS4 of the method for preparing a ballot in accordance with the invention, and steps DP2 to DP12 of the counting method in accordance with the invention, for the compilation module MC of the electronic counting system SDE, the PROG program is a PROG2 program, comprising instructions for executing steps DP14 to DP20 of the counting method in accordance with the invention, for the organizing entity , the program PROG is a program PROG3, comprising instructions for the execution of steps PS10, PS14, PS18, PS20, PS30 and PS32 of the ballot preparation method according to the invention and for steps R2, R8 and R10 of an appeal method according to the invention; for the registration entity , the program PROG is a program PROG4, comprising instructions for executing steps PS11, PS15, PS24 and PS26 of the ballot preparation method according to the invention and for steps R2, R4, R14 and R16 of an appeal method according to the invention; for the cryptographic module MCR of the ballot preparation system SPS, the program PROG is a program PROG5, comprising instructions for executing steps PS6 and PS8 of the ballot preparation method according to the invention, for the control module MCT of the appeal system SR, the program PROG is a program PROG6, comprising instructions for executing steps R16 to R20 of the appeal method according to the invention, for the validation and archiving system DVA, the program PROG is a program PROG7 comprising instructions for executing the steps of the validation and archiving method according to the invention, for the voter entities Vi , the program PROG is a program PROG8, comprising instructions for the execution of steps PS17 and PS34 of the method for preparing the ballot in accordance with the invention, and for the steps of a voting method in accordance with the invention.

[0190] Each of these programs defines, in an equivalent manner, functional modules of the device or module on which it is installed, capable of implementing the steps of the process concerned and relying on the hardware elements 7-10 and the COM communication means of the ORD computer.

[0191] In the embodiment described above, the encryption scheme used is the variant of the EI Gamal scheme introduced previously. In this embodiment, the ciphertext ( C 1 i , C 2 i ) of the vote v i including commitment C 1 i .

[0192] Alternatively, the invention may be implemented using the Pallier scheme and in this embodiment, the voting cipher does not necessarily include the commitment.

[0193] In reference to the figures 9 has 19 , we will now present a second scheme of anonymous signatures SigA 2 . We will present this scheme in the general case and in a particular use in the context of an electronic voting mechanism.

[0194] In the embodiment described herein, it is considered: one or more entities administration of a group; revocation authorities R j j = 1 t with (t ≥ 1); entities V i members of the group. designates the group of n member entities.

[0195] There figure 9 represents a SGC key generation system for the SigA 2 anonymous signature scheme and an entity V i member of a group It also represents a DV verification device.

[0196] The member entity V i includes a COM communication module and an anonymous signature DSA device conforming to the diagram SigA 2 .

[0197] The SGC key generation system includes an entity group administration, and revocation authorities R j j = 1 t with (t ≥ 1) .

[0198] The administrative entity of the group comprises a COM communication module, an MCR cryptographic module and an ERG registration module configured to register at least one member entity V i in the group.

[0199] For this purpose, the DSA system of the member entity V i has an ERG registration module configured to register the member entity V i with the entity of administration of the group.

[0200] In the embodiment described herein, each revocation entity includes an MCR cryptographic module configured to calculate a revocation key pair ( x R j , P j ), this pair including a public key P j and a private key x R j which can be used by the revoking entity to revoke the anonymity of an anonymous signature conforming to said SigA 2 scheme.

[0201] In the embodiment described herein, the MCR cryptographic module of a revocation entity is configured to calculate, from the private keys x R j of the revocation key pair, a trace generator P t = X 1 ∏ j = 1 t x R j , where X 1 denotes a public parameter produced by the SGC key generation system.

[0202] In the embodiment described herein, the DSA device of each member entity V i has an MCR cryptographic module configured to generate a trace T i = P t s i representing the member entity V i using this trace generator from the member entity's private key V i. This trace T i is invariant with respect to anonymous signatures σ i generated by the member entity in accordance with the SigA 2 scheme.

[0203] In the embodiment described herein, the MCR cryptographic module of each member entity V i is configured to blindly obtain a private key SK G i group.

[0204] In the embodiment described herein, the MCR cryptographic module of each member entity V i is configured to generate signatures σ i of messages, using the group private key, these signatures including the trace T i .

[0205] The DV verification device is configured to check whether an anonymous signature σ i conforms to the anonymous signature scheme SigA 2 . It implements a verification algorithm that takes as input a message msg, a signature σ i and the group's public key PK G . It determines whether the signature σ i is valid or not.

[0206] In the embodiment described here, the DV verification device comprises COM communication means and a MCR cryptographic module.

[0207] The COM communication module of the DV verification device is configured to obtain an anonymous signature σ i such as σ i = ( w, w', c 1 , T, PΠ ' i ).

[0208] The MCR cryptographic module of the DV verification device is configured to determine that the anonymous signature σ i of a message msg is valid if: w ≠ 1 G 1 T ≠ 1 G 1 ; PΠ' i is valid; and e w X ˜ 0 ⋅ e c 1 X ˜ 1 = e w ′ , h ˜ .

[0209] In the embodiment described herein, the MCR cryptographic module of a revocation entity is configured to implement the method of lifting the anonymity of a signature described later with reference to the figure 13 .

[0210] There figure 10 represents in the form of a flowchart the main steps of a method for generating keys of the group according to the invention. During a step E2, the cryptographic module MCR of the administration entity randomly draws three values, x 0 , x̃ 0 , x 1 from Z p . During a step E4, the cryptographic module MCR of the administration entity calculates C x0 = g x0< h x̃0< , X 1 = h x1< , X̃ 0 = h̃ x0< ,X̃ 1 = h̃ x1< . During a step E6, the cryptographic module MCR of the administration entity constitutes a pair of keys in which: the private key is made up of the three values ​​( x 0 , x̃ 0 , x 1) which were randomly drawn; and the public key consists of the elements calculated in step E4: = ( C x 0 , X 1 , X̃ 0 , X̃ 1) .

[0211] During a step E8, the cryptographic module MCR of the administration entity generates a zero-knowledge proof PΠ 2 to prove that he knows the private key associated with his public key. PΠ 2 = PoK(α 1 , α 2 , α 3 : C x0 = g α1< h α2< Λ X 1 = h α3< Λ X̃ 0 = h̃ α1< Λ X̃ 1 = h̃ α3< ).

[0212] During a step F2, the cryptographic module MCR of each of the revocation entities R j j = 1 t tire randomly a value x R j of Z p . This random value x R j constitutes a private key of the revoking entity to lift the anonymity of a signature.

[0213] During a step F4, the MCR cryptographic modules of the revocation entities calculate in turn a public key P j associated with this private key x R j . More specifically, in the embodiment described herein: the revoking entity calculated P 1 = X 1 x R 1 and proves that she knows the private key associated with her public key, in other words the discrete logarithm of P 1 in the base X 1. the revoking entity calculated P 2 = P 1 x R 2 and proves that she knows the private key associated with her public key, in other words the discrete logarithm of P 2 in the base P 1. the revoking entity , For t ≥ j ≥ 2, calculate P j = P j − 1 x R j and proves that she knows the private key associated with her public key, in other words the discrete logarithm of P j in the base P j- 1 .

[0214] In step F6, when all revocation entities have calculated their public key P j, the MCR cryptographic module of the revocation entity constitutes the group's public key PK G = ( C x 0 , X 1 , X̃ 0 , X̃ 1 , P t ). It includes the trace generator P t = X 1 ∏ j = 1 t x R j obtained from the private keys of each of the revocation entities . The private key associated with the group public key is SK G = x 0 , x ˜ 0 , x 1 , x R = ∏ j = 1 t x R j . In the embodiment described herein, each member entity V i has a unique identifier ID v i as well as a private, public key pair (SK i , PK i ), of a digital signature algorithm, the public key PK i having been certified by a recognized certification entity, for example by the administration entity .Examples of digital signature algorithms that can be used for this purpose are: RSA, DSA, ECDSA,...

[0215] To obtain its group private key, the member entity V i interacts with the administration entity . During a G2 step, the member entity's MCR cryptographic module V i randomly draws a value xi ∈ Z p and calculates C i = X 1 x i . He then generates a zero-knowledge proof PΠ i that he knows xi the discrete logarithm of C i in base X 1: PΠ i = PoK α 1 : C i = X 1 α 1 An example of such proof is provided in Claus-Peter Schnorr, "Efficient Identification and Signature for Smart Cards," Theory and Application of Cryptology, Springer, 1989.

[0216] During a G4 step, the cryptographic module of the member entity V i generates a signature σ Vi on C i: σ Vi , = Sign SKi ( C i ) where SK i denotes the private key ofV i. The member entity V i then transmits these three values ​​C i ,PΠ i , σ Vi , to the administrative entity .

[0217] During a step E10, the cryptographic module MCR of the administration entity verifies that C i ≠ 1 and that the signature σ Vi and that the proof PΠ i are both valid.

[0218] If this is the case, during a step E12, the cryptographic module MCR of the administration entity generates two random values b And x ' of Z p and calculates E = X 1 x ′ as well as a pair (u, u') where u = h b< And u ′ = u x 0 C i ⋅ X 1 x ′ b = u x 0 + x i + x ′ x 1 . It proves that the pair (u, u') was calculated in a compliant manner and in particular from the private keys x 0 and x 1: Π 3 = PoK α 1 , α 2 , α 3 , α 4 : u = h α 1 Λ u ′ = u α 2 C i ⋅ X 1 α 4 α 1 ∧ C x 0 = g α 2 h α 3 ∧ E = X 1 α 4 During a step E14, the cryptographic module MCR of the administration entity transmitsE , u, u' and the proof PΠ 3 to the member entity V i .

[0219] During a G6 step, the cryptographic module of the member entity V i verifies that u ≠ 1 and that the proof PΠ 3 is valid. If these two verifications are conclusive, the cryptographic module of the member entity V i generates, during a step G7 a signature Sig Vi on C i And E : Sig Vi = Sign SKi ( C i , E ), Or SK i designates the private key of the member entity V i .

[0220] During a G75 step, the member entity V i transmits the signature Sig Vi to the administrative entity .

[0221] During a step E13, the administration entity checks that the signature Sig Vi is valid, and if so, transmits x' to the member entity V i .

[0222] The administrative entity maintains a REG registry containing for each member entity V i of the group the following values: C i , C ′ i = C i ⋅ E = C i ⋅ X 1 x ′ , x ′ , Π i , ID i , PK i And Sig V i : REG = C i , C ′ i , x ′ , Π i , ID i , PK i , Sig V i i = 1 n Or n means the number of duly registered members.

[0223] During a G8 step, the member entity V I check that E = X 1 x ′ and constitutes, if this verification is conclusive, its group private key SK G i This is made up of the triplet SK G i = s i , u , u ′ where si = xi + x'mod p.

[0224] In a particular embodiment, the trace generator P t is renewed periodically (every hour, every day, at the beginning of the month, etc.). This simply requires the revocation entities to renew their private key x R j and recalculate according to the generation method described previously the corresponding trace generator P t .

[0225] In a particular embodiment, the trace generator P t is specific to a given service. Typically a trace generator P t can be generated for a specific election. For a new election, the revocation entities must calculate new private keys x ′ R j to deduce a new trace generator P ' t .

[0226] There figure 11 represents in the form of a flowchart, the main steps of a signature method in accordance with the invention. This signature method uses the anonymous signature scheme SigA 2. This scheme uses an algorithm which from a message msg, from the group public key PK G and the private key SK G i of a member entity, produces a signature σ i of the message msg. In accordance with the anonymous signature scheme SigA 2, to anonymously sign any message msg ∈ {0,1}* with its group private key SK G i ,the member entity's MCR cryptographic module V i randomly draws, during a step H2 a value l ∈ Z p . It calculates, at step H4 the value w = u l< and at step H6 the value w' = ( u' ) l< . During an H8 step, the MCR cryptographic module of the member entity V i calculates the value c 1 = w si< and traces it T i = P t s i . This trace T i calculated from the trace generator P t and the element si of the group private key of the member entity V i does not depend on the message msg. In other words, the trace T i constitutes an invariant of the signatures issued by the member entity V i .

[0227] The member entity V i proves that the discrete logarithm of c 1 in the base w is the same as the discrete logarithm of T i in the base P t: PΠ ′ i = PoK α 1 : c 1 = w α 1 ∧ T i = P t α 1 . In the embodiment of the invention described here, the proof PΠ' i , is the pair (c,r) in which: z is a random value of Z p drawn by the member entity V i ; T 1 = w z ; T 2 = P t z ; c = H T 1 T 2 P t msg ; r = z − cs i mod p The proof is valid if c=Hwrc1c,PtrTic,Pt,m .

[0228] During an H10 step, the member entity's MCR cryptographic module V i generates the anonymous signature σ i of the msg message, this being made up of the following five elements: (w, w', c 1 , T i , PΠ' i ). It includes the trace T i which allows to trace all signatures issued by the member entity V i ,

[0229] There figure 12 represents in the form of a flowchart the main steps of a method for verifying an anonymous signature that can be used in the invention. This method is implemented by the DV verification device of the figure 9 . It implements a verification algorithm that takes as input a message msg, a signature σ i and the group's public key PK G . It determines whether the signature σ i is valid or not.

[0230] During a step K2, the anonymous signature verification device obtains an anonymous signature σ i = (w, w', c 1 , T i , PΠ' i ).

[0231] During a K4 step, the verification device considers that the anonymous signature σ i of a message msg is valid if: w ≠ 1 G 1 T i ≠ 1 G 1 ; PΠ' i is valid; and e w X ˜ 0 ⋅ e c 1 X ˜ 1 = e w ′ , h ˜ .

[0232] There figure 13 represents in the form of a flowchart the main stages of a process for lifting the anonymity of a valid signature σ i = (w, w', c 1 , T i , Pi' i ) of a message msg. This process can only be implemented by revocation entities . It uses an algorithm that takes as input a message msg, a signature σ i , the group's public key PK G and private keys x R j revocation authorities and returns ID v i the identity of a member entity V and also proof that V i is indeed the author of this signature σ i .

[0233] During a step Z2, each of the revocation entities obtains the anonymous signature σ i of a message msg.

[0234] During a Z4 step, the revocation authorities R j j = 1 t calculate successively, T j = T j − 1 x R j − 1 with T 0 = T i . In other words: calculated T 1 = T i x R 1 − 1 and proves PΠ R 1 that the discrete logarithm of T 1 in the base T i is equal to the discrete logarithm of X 1 in the base P 1 . calculated T 2 = T 1 x R 2 − 1 and proves PΠ R 2 that the discrete logarithm of T 2 in the base T 1 is equal to the discrete logarithm of P 1 in the base P 2 . , For t ≥ j ≥ 2, calculate T j = T j − 1 x R j − 1 and proves PΠ R j that the discrete logarithm of T j in the base T j -1 is equal to the discrete logarithm of P j -1 in the base P j .

[0235] It is recalled here that there may be only one revocation entity.

[0236] If all the evidence produced by the revocation authorities is valid, T t = T i ∏ j = 1 t x R j − 1 = X 1 s i = C ′ i .

[0237] During a step Z6, the revocation authorities transmit T t and all the evidence PΠ R j j = 1 t to the administrative entity .

[0238] During a Z8 step, the administration entity finds in its register REG the entry corresponding to C' i: { C i , C' i , x', Π i , ID i , PK i , Sig Vi }.

[0239] During a step Z10, the administration entity provides in return to the revocation entity requesting the lifting of anonymity, the identifier ID v i , the evidence PΠ R j j = 1 t as well as C i , C' i , x', PK i and Sig Vi . If all the evidence PΠ R j j = 1 t are valid, that C ′ i = C i ⋅ X 1 x ′ and that the Sig Vi signature is valid then the administration entity considers that the member entity V i whose identifier is is indeed the author of the signature σ i of the message m sg .

[0240] When the service is electronic voting, it is then possible to create a voting list from the identifiers obtained by implementing the process.

[0241] In the embodiment described herein, each revocation entity includes an MCR cryptographic module configured to calculate a revocation key pair x R j P j , this pair including a public key P j and a private key x R j which can be used by the revoking entity to revoke the anonymity of an anonymous signature conforming to said SigA 2 scheme.

[0242] In the embodiment described herein, the MCR cryptographic module of a revocation entity is configured to calculate, from the private keys x R j of the revocation key pair, a trace generator P t = X 1 ∏ j = 1 t x R j .

[0243] In the embodiment described herein, the DSA device of each member entity Vi has an MCR cryptographic module configured to generate a trace T i = P t s i representing the member entity V i using this trace generator from the member entity's private key V i. This trace T i is invariant with respect to anonymous signatures σ i generated by the member entity in accordance with the SigA 2 scheme.

[0244] In the embodiment described herein, the MCR cryptographic module of each member entity V i is configured to blindly obtain a private key SK G i of the group.

[0245] In the embodiment described herein, the MCR cryptographic module of each member entity V i is configured to generate signatures σ i of messages, using the group private key, these signatures including the trace T i .

[0246] The DV verification device is configured to check whether an anonymous signature σ i conforms to the anonymous signature scheme SigA 2. It implements a verification algorithm that takes a message as input msg, a signature σ i and the group's public key PK G . It determines whether the signature σ i is valid or not.

[0247] In the embodiment described here, the DV verification device comprises COM communication means and a MCR cryptographic module.

[0248] The COM communication module of the DV verification device is configured to obtain an anonymous signature σ i such as σ i = (w, w', c 1 , T i ,PΠ' i ).

[0249] The MCR cryptographic module of the DV verification device is configured to determine that the anonymous signature σ i of a message msg is valid if: w ≠ 1 G 1 T i ≠ 1 G 1 ; PΠ' i is valid; and e w X ˜ 0 ⋅ e c 1 X ˜ 1 = e w ′ , h ˜ .

[0250] In the embodiment described herein, the MCR cryptographic module of a revocation entity is configured to implement the method of lifting the anonymity of a signature described later with reference to the figure 13 .

[0251] There figure 10 represents in the form of a flowchart the main steps of a method for generating keys of the group according to the invention. During a step E2, the cryptographic module MCR of the administration entity randomly draws three values, x 0 , x̃ 0 , x 1 from Z p . During a step E4, the cryptographic module MCR of the administration entity calculated C x 0 = g x 0 h x ˜ 0 , X 1 = h x 1 , X ˜ 0 = h ˜ x 0 , X ˜ 1 = h ˜ x 1 . During a step E6, the cryptographic module MCR of the administration entity constitutes a pair of keys in which: the private key is made up of the three values ​​( x 0 , x̃ 0 , x 1) which were randomly drawn; and the public key consists of the elements calculated in step E4: = ( C x 0 , X 1 , X̃ 0 , , X̃ 1) .

[0252] During a step E8, the cryptographic module MCR of the administration entity generates a zero-knowledge proof PΠ 2 to prove that he knows the private keys associated with his public key. PΠ 2 = PoK(α 1 , α 2 , α 3 : C x0 = g α1< h α2< Λ X 1 = h α3< Λ X̃ 0 = h̃ α1< Λ X̃ 1 = h α3< ).

[0253] During a step F2, the cryptographic module MCR of each of the revocation entities R j j = 1 t randomly draws a value x R j of Z p . This random value x R j constitutes a private key of the revoking entity to lift the anonymity of a signature.

[0254] During a step F4, the MCR cryptographic modules of the revocation entities calculate in turn a public key P j associated with this private key x R j . More specifically, in the embodiment described herein: the revoking entity calculated P 1 = X 1 x R 1 and proves that she knows the private key associated with her public key, in other words the discrete logarithm of P 1 in the base X 1. the revoking entity calculated P 2 = P 1 x R 2 and proves that she knows the private key associated with her public key, in other words the discrete logarithm of P 2 in the base P 1. the revoking entity , For t ≥ j ≥ 2, calculate P j = P j − 1 x R j and proves that she knows the private key associated with her public key, in other words the discrete logarithm of P j in the base Pj -1 .

[0255] In step F6, when all revocation entities have calculated their public key P j, the MCR cryptographic module of the revocation entity constitutes the group's public key PK G = ( C x 0 , X 1 , X̃ 0 , X̃ 1 ,P t ). It includes the trace generator P t = X 1 ∏ j = 1 t x R j obtained from the private keys of each of the revocation entities . The private key associated with the group public key is SK G = x 0 , x ˜ 0 , x 1 , x R = ∏ j = 1 t x R j . In the embodiment described herein, each member entity V i has a unique identifier as well as a private, public key pair (SK i , PK i ), of a digital signature algorithm, the public key PK i having been certified by a recognized certification entity, for example by the administration entity .Examples of digital signature algorithms that can be used for this purpose are: RSA, DSA, ECDSA,...

[0256] To obtain its group private key, the member entity V i interacts with the administration entity . During a G2 step, the member entity's MCR cryptographic module V i randomly draws a value xi ∈ Z p and calculates C i = X 1 x i . He then generates a zero-knowledge proof PΠ i that he knows xi the discrete logarithm of C i in base X 1: PΠ i = PoK α 1 : C i = X 1 α 1 An example of such proof is provided in Claus-Peter Schnorr, "Efficient Identification and Signature for Smart Cards," Theory and Application of Cryptology, Springer, 1989.

[0257] During a G4 step, the cryptographic module of the member entity V i generates a signature σ Vi on C i: σ Vi = Sign SKi ( C i ) where SK i denotes the private key of V i. The member entity V i then transmits these three values ​​C i ,PΠ i , σ Vi , to the administrative entity .

[0258] During a step E10, the cryptographic module MCR of the administration entity verifies that C i ≠ 1 and that the signature σ Vi and that the proof PΠ i are both valid.

[0259] If this is the case, during a step E12, the cryptographic module MCR of the administration entity generates two random values ​​b and x' from Z p and calculates E = X 1 x ′ as well as a pair (u, u') Or u = h b et u ′ = u x 0 C i ⋅ X 1 x ′ b = u x 0 + x i + x ′ x 1 . He proves that the pair ( u, u' ) was calculated in a compliant manner and in particular from the private keys x 0 and x 1: ∏ 3 = Pok α 1 , α 2 , α 3 , α 4 : u = h α 1 Λ u ′ = u α 2 C i ⋅ X 1 α 4 α 1 Λ C x 0 = g α 2 h α 3 Λ E = X 1 α 4 During a step E14, the cryptographic module MCR of the administration entity transmits E , u, u' and the proof PΠ 3 to the member entityV i .

[0260] During a G6 step, the cryptographic module of the member entity V i verifies that u ≠ 1 and that the proof PΠ 3 is valid. If these two verifications are conclusive, the cryptographic module of the member entity V i generates, during a step G7 a signature Sig Vi on C i And E : Sig Vi = Sign SKi ( C i , E ), Or SK i designates the private key of the member entity V i .

[0261] During a G75 step, the member entity V i transmits the signature Sig Vi to the administrative entity .

[0262] During a step E11, the administration entity checks that the signature Sig Vi is valid, and if so, transmits x' to the member entity V i .

[0263] The administrative entity maintains a REG registry containing for each member entity V i of the group the following values: C i , C ′ i = C i ⋅ E = C i ⋅ X 1 x ′ , x ′ , Π i , ID i , PK i And Sig Vi : REG = C i , C ′ i , x ′ , Π i , ID i , PK i , Sig V i i = 1 n Or n means the number of duly registered members.

[0264] During a G8 step, the member entity V I check that E = X 1 x ′ and constitutes, if this verification is conclusive, its group private key SK G i This is made up of the triplet SK G i = s i , u , u ′ where si = xi + x'mod p.

[0265] In a particular embodiment, the trace generator P t is renewed periodically (every hour, every day, at the beginning of the month, etc.). This simply requires the revocation entities to renew their private key x R j and recalculate according to the generation method described previously the corresponding trace generator P t .

[0266] In a particular embodiment, the trace generator P t is specific to a given service. Typically a trace generator P t can be generated for a specific election. For a new election, the revocation entities must calculate new private keys x ′ R j to deduce a new trace generator P' t .

[0267] There figure 11 represents in the form of a flowchart, the main steps of a signature method in accordance with the invention. This signature method uses the anonymous signature scheme SigA 2. This scheme uses an algorithm which from a message msg, from the group public key PK G and the group private key SK G i of a member entity, produces a signature of the message msg. In accordance with the anonymous signature scheme SigA 2, to anonymously sign any message m sg ∈ {0,1}* with its group private key SK G i ,the member entity's MCR cryptographic module V i randomly draws, during a step H2 a value l ∈ Z p . It calculates, at step H4 the value w = u l< and at step H6 the value w' = ( u ') l< . During an H8 step, the MCR cryptographic module of the member entity V i calculates the value c 1 = w si< and traces it T i = P t s i . This trace T i calculated from the trace generator P t and the element si of the group private key of the member entity V i does not depend on the message msg. In other words, the trace T i constitutes an invariant of the signatures issued by the member entity V i .

[0268] The member entity V i proves that the discrete logarithm of c 1 in the base w is the same as the discrete logarithm of T i in the base P t : PΠ ′ i = PoK α 1 : c 1 = w α 1 ∧ T i = P t α 1 . In the embodiment of the invention described here, the proof PΠ' i is the pair (c,r) in which: z is a random value of Z p drawn by the member entity V i ; T 1 = w z ; T 2 = P t z ; c = H T 1 T 2 P t msg ; r = z − cs i mod p The proof is valid if c=Hwrc1c,PtrTic,Pt,m .

[0269] During an H10 step, the member entity's MCR cryptographic module V i generates the anonymous signature σ i of the msg message, this being made up of the following five elements: (w, w', c 1 , T i , PΠ' i ). It includes the trace T i which allows to trace all signatures issued by the member entity V i ,

[0270] There figure 12 represents in the form of a flowchart the main steps of a process for verifying an anonymous signature that can be used in the context of the scheme SigA 2. This process is implemented by the DV verification device of the figure 9 . It implements a verification algorithm that takes as input a message msg, a signature σ i and the group's public key PK G . It determines whether the signature σ i is valid or not.

[0271] During a step K2, the anonymous signature verification device obtains an anonymous signature σ i = ( w, w', c 1 , T, PΠ' i ).

[0272] During a K4 step, it considers that the anonymous signature σ i of a message msg is valid if: w ≠ 1 G 1 T ≠ 1 G 1 ; PΠ' i is valid; and e w X ˜ 0 ⋅ e c 1 X ˜ 1 = e w ′ , h ˜ .

[0273] There figure 13 represents in the form of a flowchart the main stages of a process for lifting the anonymity of a valid signature σ i = ( w, w', c 1 , T i , Pi' i ) of a message msg. This process can only be implemented by revocation entities . It uses an algorithm that takes as input a message msg, a signature σ i , the group's public key PK G and private keys x R j revocation authorities and returns the identity of a member entity V and also proof that V He is indeed the author of this signature σ i .

[0274] During a step Z2, each of the revocation entities obtains the anonymous signature σ i of a message msg.

[0275] During a Z4 step, the revocation authorities R j j = 1 t calculate successively, T j = T j − 1 x R j − 1 with T 0 = T i . In other words: calculated T 1 = T x R 1 − 1 and proves PΠ R 1 that the discrete logarithm of T 1 in the base T i is equal to the discrete logarithm of X1 in the base P 1 . calculated T 2 = T 1 x R 2 − 1 and proves PΠ R 2 that the discrete logarithm of T 2 in the base T 1 is equal to the discrete logarithm of P 1 in the base P 2 . , For t ≥ j ≥ 2, calculate T j = T j − 1 x R j − 1 and proves PΠ R j that the discrete logarithm of T j in the base T j -1 is equal to the discrete logarithm of P j -1 in the base P j .

[0276] It is recalled here that there may be only one revocation entity.

[0277] If all the evidence produced by the revocation authorities is valid, T t = T ∏ j = 1 t x R j − 1 = X 1 s i = C ′ i .

[0278] During a step Z6, the revocation authorities transmit T t and all the evidence PΠ R j j = 1 t to the administrative entity .

[0279] During a Z8 step, the administration entity finds in its register REG the entry corresponding to C' i: { C i , C' i , x', Π i , ID i , PK i , Sig Vi }.

[0280] During a step Z10, the administration entity provides back to the revoking entity requesting the lifting of anonymity, the identifier , the evidence PΠ R j j = 1 t as well as C i , C' i , x', PK i and Sig Vi . If all the evidence PΠ R j j = 1 t are valid, that C ′ i = C i ⋅ X 1 x ′ and that the signature Sig Mi . is valid then the administration entity considers that the member entity V i whose identifier is is indeed the author of the signature σ i of the message ms g .

[0281] When the service is electronic voting, it is then possible to create a voting list from the identifiers obtained by implementing the process.

[0282] The anonymous signature scheme SigA 2 can in particular be used to implement an electronic voting solution.

[0283] There figure 14 represents an electronic voting system SVE2 in accordance with the invention. This system comprises an SGC system for generating keys for an anonymous signature scheme SigA 2 and an entity V i member of a group in accordance with the invention. It also includes a DV verification device.

[0284] In this embodiment, the group member entities V i are voter entities.

[0285] In this embodiment, the SGC key generation system comprises a registration entity and an organizing entity . Each acts as both the group administration entity and the group revocation entity. It is understood that this is an illustrative example and that in other examples the distribution of roles assigned to the different entities may be different. The registration entity and the organizing entity each include a COM communication module and an MCR cryptographic module. The recording entity and the organizing entity each further comprise an ERG registration module configured to register at least one voter entity V i in the group.

[0286] Thus, in this embodiment of the invention, a voter entity registers both with the registration entity and with the organizing entity This embodiment allows the role of group administrator to be distributed between two entities so as to prevent a single entity from being able to create false voter entities.

[0287] The elector entity V i comprises a COM communication module and an anonymous signature DSA device in accordance with the invention.

[0288] The DSA device of the electoral entity V i includes an ERG registration module configured to register the voter entity V i with the registration entity . In the embodiment described herein, the MCR cryptographic module of each revocation entity , is configured to calculate a revocation key pair whose private key can be used to revoke the anonymity of an anonymous signature conforming to said scheme SigA 2 and to calculate, from a public key of the revocation key pair, a trace generator.

[0289] The DSA system of each voting entity V i has an MCR cryptographic module configured to generate a trace T i = P t s i using this trace generator, this trace T i being invariant with respect to anonymous signatures σ i generated by the voting entity in accordance with the SigA 2 scheme.

[0290] In the embodiment described herein, the MCR cryptographic module of each voter entity V i is configured to blindly obtain a private key SK G i group, noted if subsequently.

[0291] In the embodiment described herein, the MCR cryptographic module of each voter entity V i is configured to generate σ signatures i of messages, using the group private key, these signatures including the trace T i .

[0292] The DV verification device is configured to check whether an anonymous signature σ i conforms to the anonymous signature scheme SigA 2. It implements a verification algorithm that takes a message as input msg, a signature σ i and the group's public key PK G . It determines whether the signature σ i is valid or not.

[0293] In the embodiment described here, the DV verification device comprises COM communication means and a MCR cryptographic module.

[0294] The COM communication module is able to obtain an anonymous signature σ i such as σ i = ( w , w ', c 1 , T i , PΠ' i ).

[0295] The MCR cryptographic module is configured to determine that the anonymous signature σ i of a message msg is valid if: w ≠ 1 G 1 T i ≠ 1 G 1 ; PΠ' i is valid; and e w X ˜ 0 ⋅ e c 1 X ˜ 1 = e w ′ , h ˜ .

[0296] In the embodiment described herein, the MCR cryptographic module of a revocation entity , is configured to implement the method of lifting the anonymity of a signature described later with reference to the figure 18 .

[0297] There figure 15 represents in the form of a flowchart a method for generating the keys of the voter entities in accordance with this embodiment of the invention.

[0298] During a VE2 step, the MCR cryptographic module of the organizing entity randomly draws four values x R O , x 0 O , x ˜ 0 O , x 1 O of Z p . In this embodiment, x R O is a private key used by the organizing entity to lift the anonymity of a voting entity.

[0299] During a VE4 step, the MCR cryptographic module of the organizing entity calculated C x 0 O = g x 0 O h x ˜ 0 O , X 1 O = h x 1 O , X ˜ 0 O = h ˜ x 0 O , X ˜ 1 O = h ˜ x 1 O , P O = X 1 x R O .

[0300] During a VE6 step, the MCR cryptographic module of the organizing entity constitutes a pair of keys in which: the private key is made up of the four values x R O x 0 O x ˜ 0 O x 1 O which were randomly drawn; and the public key consists of the elements calculated in step VE4: C x 0 O X 1 O X ˜ 0 O X ˜ 1 O P O .

[0301] During a VE8 step, the MCR cryptographic module of the organizing entity generates a VOPΠ 2 proof that it knows the private key associated with its public key by generating a zero-knowledge proof defined as follows:

[0302] The registration entity proceeds in the same way.

[0303] During a VE2 step, the MCR cryptographic module of the recording entity randomly draws four values of Z p . In this embodiment, is a private key used by the registration entity to lift the anonymity of a voting entity.

[0304] During a VE4 step, the MCR cryptographic module of the recording entity calculated During a VE6 step, the MCR cryptographic module of the recording entity constitutes a pair of keys in which: the private key is made up of the four values which were randomly drawn; and the public key consists of the elements calculated in step VE4:

[0305] During a VE8 step, the MCR cryptographic module of the recording entity generates a VAPΠ 2 proof that he knows the private key associated with his public key. This proof is defined as follows:

[0306] During a VF4 step, the MCR cryptographic modules of the organizing entity and the registration entity , after making their public keys public And , each calculate a trace generator on their own

[0307] During a VF6 step, when all revocation entities, namely the registration entity and the organizing entity in this embodiment, have calculated their public key, they calculate the group's public key PK G . It includes the trace generator obtained from the private keys of these revocation entities And . The private key associated with the group public key is:

[0308] In this embodiment, each voting entity V i has a unique identifier as well as a pair of keys, private and public (SK i ,PK i ), of a digital signature algorithm, the public key PK i having been certified beforehand by a recognized certification authority, for example by the registration entity and by the organizing entity .

[0309] In the embodiment described here, to obtain its group private key, the voter entity V i must interact with the administration entity and with the organizing entity . During a VG2 step, the member entity's MCR cryptographic module V i randomly draws a value xi ∈ Z p and calculates C i = X 1 x i . He then generates a zero-knowledge proof VEPΠ i that he knows xi the discrete logarithm of ci in base X 1 : VEP Π i = PoK α 1 : C i = X 1 α 1 .

[0310] During a VG4 step, the cryptographic module MCR of the voter entity V i generates a signature σ Vi on C i: σ Vi = Sign SKi ( C i ) where SK i denotes the private key of V i. The voting entity V i then transmits these three values ​​C i ,VEPΠ i , σ Vi , to the administrative entity and to the organizing entity .

[0311] During a VE10 step, the MCR cryptographic module of the administration entity and the MCR cryptographic module of the organizing entity verify C i ≠ 1 and that the signature σ Vi , and that the proof PΠ i are both valid.

[0312] If this is the case, during a VE12 step, the MCR cryptographic module of the administration entity and the MCR cryptographic module of the organizing entity jointly generate two random values ​​b and x' from Z p and calculate E = X 1 x ′ as well as a pair ( u, u ') Or u = h b< And u ′ = u x 0 C i ⋅ X 1 x ′ b = u x 0 + x i + x ′ x 1 . They prove that the pair ( u, u' ) was calculated in a compliant manner and in particular from the private keys x 0 and x 1: VOA Π 3 = PoK α 1 , α 2 , α 3 , α 4 : u = h α 1 ∧ u ′ = u α 2 C i ⋅ X 1 α 4 α 1 ∧ C x 0 = g α 2 h α 3 ∧ E = X 1 α 4

[0313] We recall that to jointly generate a value, for example the value x', the administration entity and the organizing entity may use known distributed cryptography techniques. For example, the administration entity (respectively the organizing entity ) randomly generates a value of Z p (respectively of Z p ) and calculates (respectively X 1 x ′ O ). We thus obtain where x' = + (mod p).

[0314] In this embodiment, during a step VE14, the cryptographic module MCR of the administration entity or the organizing entity transmits E, u, u' and the proof VE PΠ 3 to the voter entityV i. Alternatively, these values ​​are sent by the administration entity and by the organizing entity and the voter entity V i verifies that the values ​​received from both entities And are identical.

[0315] During a VG6 step, the cryptographic module of the voter entity V i verifies that u ≠ 1 and that the VOAPΠ 3 proof is valid. If these two verifications are conclusive, the cryptographic module of the voter entity V i generates, during a VG7 step, a signature Sig Vi on C i et E : Sig Vi = Sign SKi ( C i , E ), Or SK i designates the private key of the voter entity V i. During a VG75 step, the voter entity V i transmits the signature Sig Vi to the administrative entity and to the organizing entity .

[0316] During a VE13 step, the administration entity and the organizing entity verify that the signature Sig Vi is valid, and if so, the administration entity transmits x' to the voting entity V i .

[0317] The administrative entity maintains an unrepresented REG registry containing for each member entity V i of the group the following values: C i , C ′ i = C i ⋅ X 1 x ′ , x ′ , PΠ i , ID i , PK i And Sig V i : REG = C i , C ′ i , x ′ , PΠ i , I D V i , PK i , Sig V i i = 1 n where n denotes the number of duly registered voter entities.

[0318] During a VG8 step, the voter entity V I check that E = X 1 x ′ and constitutes, if this verification is conclusive, its group private key SK G i This is made up of the triplet SK G i = s i , u , u ′ where S i = xi + x'mod p.

[0319] There figure 16 represents in the form of a flowchart the main steps of a voting method in accordance with this embodiment of the invention. In accordance with the anonymous signature scheme SigA 2, to anonymously sign any message msg ∈ {0,1}* with its group private key SK G i , the MCR cryptographic module of the voter entity V i randomly draws, during a step VH2, a value 1 ∈ Z p and calculates (step VH4) the value w = ul< as well as (step VH6) the value w' = (u') l< .

[0320] In the case of a single-member majority vote, the message may consist of the vote of the voting entity, possibly in encrypted form, the encryption being able to be calculated using a public key whose private key would be shared between several assessor entities configured to count the vote.

[0321] During a VH8 step, the MCR cryptographic module of the voter entity V i calculates the value c 1 = w si< and traces it T i = P t s i . This trace T i calculated from the trace generator P t and the element si of the group private key of the voter entity V i does not depend on the message msg. In other words, the trace T i therefore constitutes an invariant of the signatures issued by the voting entity V i .

[0322] The elector entity V i proves that the discrete logarithm of c 1 in the base w is the same as the discrete logarithm of T i in the base P t : VEPΠ ′ i = PoK α 1 : c 1 = w α 1 ∧ T i = P t α 1 .

[0323] In the embodiment of the invention described here, the proof VEPII' i is the pair (c,r) in which: z is a random value of Z p drawn by the voting entity V i ; T 1 = w z ; T 2 = P t z ; c = H T 1 T 2 P t msg ; r = z − cs i mod p The proof is valid if c=Hwrc1c,PtrTic,Pt,m .

[0324] During a VH10 step, the MCR cryptographic module of the voter entity V i generates the anonymous signature σ i of the message msg, this being made up of the following five elements: ( w, w', c 1 , T i , VEPII' i ). It includes the trace T i which allows to trace all the signatures issued by the voting entity V i .

[0325] There figure 17 represents in the form of a flowchart the main steps of a method for verifying an anonymous signature in accordance with the invention.

[0326] During a VK2 step, the anonymous signature verification device obtains an anonymous signature σ i = (w, w', c 1 , Ti ,VEPII' i ). During a VK4 step, it considers that the anonymous signature σ i of a message msg is valid if: w ≠ 1 G 1 Ti ≠ 1 G 1 ; VEPIT' i is valid; and e w X ˜ 0 ⋅ e c 1 X ˜ 1 = e w ′ , h ˜ .

[0327] There figure 18 represents in the form of a flowchart the main stages of a process for lifting the anonymity of a valid signature σ i = ( w, w', c 1 , T i , II' i ) of a message msg in accordance with this second embodiment of the invention. This method is implemented by the recording entity and the organizing entity ∂.

[0328] During a VZ2 step, each of these entities And obtains the signature σ i .

[0329] During a VZ4 step, the entities And calculate successively, T j = T j − 1 x R j − 1 with T 0 = T i . calculated T 1 = T i x R O − 1 and proves ( VOP Π R 1 ) than the discrete logarithm of T 1 in the base T i is equal to the discrete logarithm of X 1 in the base P 1 . calculated and proves ( VAP Π R 2 ) than the discrete logarithm of T2 in the base T 1 is equal to the discrete logarithm of P 1 in the base P 2 .

[0330] If all the evidence produced by the revocation authorities is valid,

[0331] In this embodiment, during a step VZ6, the organizing entity transmits the proof VOP Π R 1 to the registration entity .

[0332] During a VZ8 step, the recording entity finds in its register REG the entry corresponding to C' i : [C i , C' i , x', PΠ i , ID i , PK i , Sig Vi}.

[0333] During a VZ10 step, the recording entity returns the identifier , the evidence VOP Π R 1 so and VAP Π R 2 that C i , C' i ,x', PK i and Sig Vi . If all the proofs are valid, that C ′ i = C i ⋅ X 1 x ′ and the Sig Vi signature is valid then the registration entity considers that the voting entity V i whose identifier is is indeed the author of the signature σ i of the message msg.

[0334] In the embodiment described herein, the administration entity , the revocation entities , the organizing entity , the registration entity , the DV verification device member entities or voters V i have the hardware architecture of a ORD computer as shown schematically in figure 19 .

[0335] The ORD computer includes in particular a processor 7, a read-only memory 8, a random access memory 9, a non-volatile memory 10 and COM communication means. These COM communication means allow the different entities to communicate with each other in particular. They may include one or more communication interfaces on one or more telecommunications networks (fixed or mobile, wired or wireless, etc.).

[0336] The read-only memory 8 of the computer ORD constitutes a recording medium in accordance with the invention, readable by the processor and on which is recorded a computer program in accordance with the invention, generally designated here by PROG, comprising instructions for the execution of one of the methods which are the subject of the invention. Thus: for the administration entity , the program PROG is a program PROG1 comprising instructions for the execution of steps E2 to E12 of a key generation method according to the invention, and steps Z8 to Z10 of an anonymity lifting method according to the invention, for the revocation entities , the program PROG is a program PROG1 comprising instructions for the execution of steps F2 to F6 of a key generation method according to the invention, and steps Z2 to Z6 of an anonymity lifting method according to the invention, for the organizing entity , the PROG program is a PROG2 program comprising instructions for executing steps VE2 to VE12 of a key generation method according to the invention and steps VZ2 to VZ6 of an anonymity lifting method according to the invention, for the registration entity , the program PROG is a program PROG3, comprising instructions for executing steps VE2 to VE12 of a key generation method according to the invention and steps VZ2 to VZ10 of an anonymity lifting method according to the invention, for the verification device DV, the program PROG is a program PROG4 comprising instructions for executing steps K2 to K4 or VK2 to VK4 of a signature verification method according to the invention, for the member entities V i , the program PROG is a program PROG5, comprising instructions for the execution of steps G2 to G8 or VG2 to VG8 of the key generation method according to the invention, of steps H2 to H10 or VH2 to VH10 of a signature method according to the invention.

[0337] Each of these programs defines, in an equivalent manner, functional modules of the device or module on which it is installed, capable of implementing the steps of the process concerned and relying on the hardware elements 7-10 of the ORD computer.

Claims

1. Method for preparing a ballot in an electronic voting system, this method comprising: - a step (PS2, PS4) of each module of a plurality of assessor modules (Mi) of a virtual polling station (BVV) generating a partial decryption private key (xT, x T ˜ ) for at least one threshold encryption algorithm; - a step (PS6, PS8) of generating a public key ((gT,hT),( g T ˜ , h̃T)) for said encryption algorithm and the corresponding private key (SKMi, SK M ι ˜ ). - a step of computing, for at least one voter entity (Vi) authorized to participate in the ballot, a public value (gs) from a pair of keys ((SKO, PO), (SKA, PA)) of a traceable anonymous signature algorithm (SigA1,SigA2), said public value being intended to be used by said voter entity (Vi) in association with a private key (xi) of said voter entity (Vi) to generate an anonymous public key ( g S x i ) , said private key (xi) being intended to be used by said voter entity (Vi) to compute at least one signature (Si) in the context of the ballot, the anonymity of a signature thus obtained being able to be revoked only by a trusted entity (O, A), said trusted entity having computed the public value, said voter entity (Vi) being configured to obtain (PS34) its said anonymous public key ( g S x i ) blindly.

2. Electronic voting method, implemented by a voter entity (Vi) in the context of a ballot, comprising: - a step (SCO, SC1) of obtaining a public key ((gT,hT),( g T ˜ , hT)) for at least one threshold encryption algorithm; - a step (SC2) of obtaining a pair of keys ( x i , g S x i ) of a traceable anonymous signature algorithm (SigA1, SigA2), said pair comprising a blindly obtained anonymous public key ( g S x i ) and a private key (xi) intended to be used by said voter entity (Vi) to compute at least one signature (Si) in the context of the ballot, the anonymity of an anonymous signature thus obtained being able to be revoked only by at least one trusted entity (O, A); - a step (SC4) of choosing a vote (vi); - a step (SC8) of computing a commitment ( C 1 i ) to said vote (vi); - a step (SC10) of computing a cipher (( C 1 i , C 2 i )) of said vote (vi) using said threshold encryption algorithm; - a step (SC16) of computing a traceable anonymous signature (Si) of said commitment ( C 1 i ) using said private key (xi) of the traceable anonymous signature algorithm (SigA1, SigA2) ; - a step (SC18) of sending a ballot paper (Bi) comprising at least said commitment ( C 1 i ), said cipher (( C 1 i , C 2 i )) and said traceable anonymous signature (Si) of said voter entity (Vi) to a virtual private ballot box (UPV) .

3. Method according to either one of Claims 1 and 2, characterized in that said at least one threshold encryption algorithm is a threshold additive homomorphic encryption algorithm.

4. Method for validating and archiving an electronic vote in the context of a ballot, this method being implemented in a virtual private ballot box (UPV) and comprising: - a step (U2) of receiving a ballot paper (Bi) comprising at least one commitment ( C 1 i ) to a vote (vi), (( C 1 i , C 2 i )) of said vote (vi), a cipher ( C 3 i ) of a random value (ri) used in the commitment of said vote (vi) and a traceable anonymous signature (Si) of a voter entity (Vi); - a step (U4) of verifying said traceable anonymous signature (Si); - a step (U6) of verifying the absence, from said virtual private ballot box (UPV), of at least two ballot papers (Bi,Bj) comprising traceable anonymous signatures (Si,Sji) associated with one and the same anonymous public key ( g S x i ); - if the result of said verifications (U4, U6) is positive, a step (U10) of sending a truncated ballot paper (BTi) comprising said commitment ( C 1 i ) and said traceable anonymous signature (Si) to a virtual public ballot box (UPB); - a step (U12) of storing said ballot papers (Bi) until a deadline for appeal has expired.

5. Method for auditing a ballot, wherein: - ballot papers (Bi) are stored in a virtual private ballot box (UPV), each ballot paper (Bi) comprising a commitment ( C 1 i ) to a vote (vi) and to a random value (ri), a cipher (( C 1 i , C 2 i )) of said vote (vi), a cipher ( C 3 i ) of said random value (ri) and a traceable anonymous signature (Si) of a voter entity (Vi); - truncated ballot papers (BTi) obtained from said ballot papers (Bi) are stored in a virtual public ballot box (UPB), each truncated ballot paper (BTi) comprising said commitment ( C 1 i ) and said traceable anonymous signature (Si), said method comprising: - a step (A0) of obtaining, at the end of a count of said ballot papers (Bi), a result (Res) of said ballot and a value (Rand) corresponding to the sum of the random values (ri); - a step (A1) of obtaining said truncated ballot papers (BTi) stored in said virtual public ballot box (UPB); - a step (A2) of verifying the traceable anonymous signatures (Si) of said truncated ballot papers (BTi) and of verifying the absence, from said public ballot box (UPB), of at least two truncated ballot papers (BTi,BTj) comprising traceable anonymous signatures (Si, Sj) associated with one and the same anonymous public key; - a step (A6) of computing an audit commitment (R'1) from the commitments ( C 1 i ) of all of the truncated ballot papers (BTi); - a step (A8) of determining an audit result by comparing the audit commitment with a computed commitment (A8) to said result (Res) of said ballot and to said value (Rand).

6. Method of appeal, implemented by a system of appeal at the end of a ballot in which voter entities (Vi) have participated, identifiers () and respective specific public keys (Pi) of said voter entities being registered in an electoral list ( LE), said specific public keys (Pi) conforming to a traceable anonymous signature scheme (SigA1, SigA2), said method comprising: - a step (R2) of obtaining a list (L3) of anonymous public keys used by the voter entities (vi), in order to produce signatures (Si) conforming with said scheme and included in ballot papers (Bi); - a step (R4) of at least one trusted entity (O, A) generating an appeals list (L5) the elements of which are re-identified public keys obtained by removing the anonymity of the public keys in said list (L3); - a step (R18) of verifying that the re-identified public keys in said appeals list (L5) are all included in said electoral list ().

7. Electronic voting method, comprising: - implementing a method for preparing a ballot according to Claim 1; - implementing a voting method according to Claim 2; - implementing a count method comprising: - a step (PS2, PS4) of each of a plurality of assessor modules (Mi) of a virtual polling station (BVV) obtaining a partial decryption private key (SKMi, SK M ι ˜ ) for at least one threshold encryption algorithm; - a step (DP2), after the ballot has closed, of each of the plurality of assessor modules (Mi) obtaining at least one ballot paper (Bi) collected by a virtual private ballot box (UPV), each ballot paper (Bi) comprising at least one commitment ( C 1 i ) to a vote (vi), a cipher (( C 1 i , C 2 i )) of said vote (vi), and a traceable anonymous signature (Si) of a voter entity (Vi); - a step (DP3) of each of said assessor modules (Mi) obtaining a cipher (C̈) of the result of the ballot; - a step (DP10), implemented by each of said assessor modules (Mi), of partially decrypting said cipher (C̈) of the result of the ballot using its partial decryption private key (SKMi); - when a predetermined number (s) of assessor modules corresponding to said threshold have carried out said partial decryption of said cipher (C̈) of the result of the ballot, a step (DP16) of jointly obtaining a result (Res) of said ballot; and - a step (DP20) of publishing said result (Res); - implementing a validation and archiving method according to Claim 4; - optionally implementing an audit method according to Claim 5; and - optionally implementing a method of appeal according to Claim 6.

8. System (SPS) for preparing a ballot in an electronic voting system, this system comprising: - a module (MCR) used by each assessor module (Mi) of a virtual polling station (BVV) to generate a partial decryption private key (SKMi, SK M ι ˜ ) for at least one threshold encryption algorithm; - a module (MCR) for generating a public key ((gT, hT), ( g T ˜ , hT)) for said encryption algorithm and the corresponding private key (xT, x T ˜ ); - a module (MCR) for computing, for at least one voter entity (Vi) authorized to participate in the ballot, a public value (gs) from a pair of keys ((SKO, PO), (SKA, PA)) of a traceable anonymous signature algorithm (SigA1, SigA2), said public value being intended to be used by said voter entity (Vi) in association with a private key (xi) of said voter entity (Vi) to generate an anonymous public key ( g S x i ), said private key (xi) being intended to be used by said voter entity (Vi) to compute at least one signature (Si) in the context of the ballot, the anonymity of a signature thus obtained being able to be revoked only by a trusted entity (O, A), said trusted entity having computed the public value, said voter entity (Vi) being configured to obtain (PS34) its said anonymous public key ( g S x i ) blindly.

9. Voter entity (Vi) able to be used in the context of a ballot, comprising: - a module (COM) for obtaining a public key ((gT,hT),( g T ˜ ,h̃T) for at least one threshold encryption algorithm; - a module (COM) for obtaining a pair of keys (xi, g S x i ) of a traceable anonymous signature algorithm (SigA1, SigA2), said pair comprising a blindly obtained anonymous public key ( g S x i ) and a private key (xi) intended to be used by said voter entity (Vi) to compute at least one signature (Si) in the context of the ballot, the anonymity of an anonymous signature thus obtained being able to be revoked only by at least one trusted entity (O, A); - a module (IHM) for obtaining a choice of a vote (vi); - a module (MCR) for computing a commitment ( C 1 i ) to said vote (vi); - a module (MCR) for computing a cipher (( C 1 i , C 2 i )) of said vote (vi) using said threshold encryption algorithm; - a module (MCR) for computing a traceable anonymous signature (Si) of said commitment ( C 1 i ) using said private key (xi) of the traceable anonymous signature algorithm (SigA1, SigA2) ; - a module (COM) for sending a ballot paper (Bi) comprising at least said commitment ( C 1 i ), said cipher (( C 1 i , C 2 i )) and said traceable anonymous signature (Si) of said voter entity (Vi) to a virtual private ballot box (UPV) .

10. Device (DVA) for validating and archiving an electronic vote in the context of a ballot, this device being associated with a virtual private ballot box (UPV) and comprising: - a module (COM) for receiving a ballot paper (Bi) comprising at least one commitment ( C 1 i ) to a vote (vi), (( C 1 i , C 2 i )) of said vote (vi), a cipher ( C 3 i ) of a random value (ri) used in the commitment of said vote (vi) and a traceable anonymous signature (Si) of a voter entity (Vi); - a step (U4) of verifying said traceable anonymous signature (Si); - a module (MCR) for verifying said traceable anonymous signature (Si); - a module (MV) for verifying the absence, from said virtual private ballot box (UPV), of at least two ballot papers (Bi,Bj) comprising traceable anonymous signatures (Si,Sji) associated with one and the same anonymous public key ( g s x i ); - a module (COM) configured to send, if the result of said verifications (U4, U6) is positive, a truncated ballot paper (BTi) comprising said commitment ( C 1 i ) and said traceable anonymous signature (Si) to a virtual public ballot box (UPB); - a module (MS) for storing said ballot papers (Bi) until a deadline for appeal has expired and destroying these ballots when this deadline has expired.

11. Device (DAS) for auditing a ballot, wherein: - ballot papers (Bi) are stored in a virtual private ballot box (UPV), each ballot paper (Bi) comprising a commitment ( C 1 i ) to a vote (vi) and to a random value (ri), a cipher (( C 1 i , C 2 i )) of said vote (vi), a cipher ( C 3 i ) of said random value (ri) and a traceable anonymous signature (Si) of a voter entity (Vi); - truncated ballot papers (BTi) obtained from said ballot papers (Bi) are stored in a virtual public ballot box (UPB), each truncated ballot paper (BTi) comprising said commitment ( C 1 i ) and said traceable anonymous signature (Si), said device comprising: - a module (COM) for obtaining, at the end of a count of said ballot papers (Bi), a result (Res) of said ballot and a value (Rand) corresponding to the sum of the random values (ri); - a module (COM) for obtaining said truncated ballot papers (BTi) stored in said virtual public ballot box (UPB); - a module (MCR) for verifying the traceable anonymous signatures (Si) of said truncated ballot papers (BTi) and for verifying the absence, from said public ballot box (UPB), of at least two truncated ballot papers (BTi, BTj) comprising traceable anonymous signatures (Si, Sj) associated with one and the same anonymous public key; - a module (MCR) for computing an audit commitment (R'1) from the commitments ( C 1 i ) of all of the truncated ballot papers (BTi); - a module (MD) for determining an audit result by comparing the audit commitment with a computed commitment (A8) to said result (Res) of said ballot and to said value (Rand).

12. System of appeal (SR) configured to carry out an appeal at the end of a ballot in which voter entities (Vi) have participated, identifiers () and respective specific public keys (Pi) of said voter entities being registered in an electoral list (), said specific public keys (Pi) conforming to a traceable anonymous signature scheme (SigA1, SigA2), said system comprising: - at least one trusted entity (O, A), configured to generate an appeals list (L5) the elements of which are re-identified public keys obtained by removing the anonymity of anonymous public keys contained in a list (L3) of anonymous public keys used to verify signatures (Si) produced by the voter entities and conforming with said scheme and included in ballot papers (Bi); - said system comprising a control module (MCT) capable of verifying that the re-identified public keys in said appeals list (L5) are all included in said electoral list ().

13. Electronic voting system (SYS), comprising at least: - a system (DPS) for preparing a ballot according to Claim 8; - a voter entity (Vi) according to Claim 9; - an electronic count system (SDE) comprising: - a plurality of assessor modules (Mi) of a virtual polling station that are configured to receive a partial decryption private key (SKMi, SK M ι ˜ ) for at least one threshold encryption algorithm; - said assessor modules (Mi) being configured, after a ballot has closed, to obtain at least one ballot paper (Bi) collected by a virtual private ballot box (UPV), each ballot paper (Bi) comprising at least one commitment ( C 1 i )to a vote (vi), a cipher (( C 1 i , C 2 i )) of said vote (vi), and a traceable anonymous signature (Si) of a voter entity (Vi); - said assessor modules (Mi) being configured to obtain a cipher (C̈) of the result of the ballot; - said assessor modules (Mi) being configured to partially decrypt said cipher (C̈) using their partial decryption private key (SKMi); - said assessor modules (Mi) being configured to cooperate, as soon as a predetermined number (s) of them corresponding to said threshold have carried out said partial decryption of said cipher (C̈), in order to jointly obtain a result (Res) of said ballot; and - said assessor modules (Mi) being configured to publish said result (Res); - a validation and archiving device (DVA) according to Claim 10; - optionally an audit device (DA) according to Claim 11; and - optionally a system of appeal (SR) according to Claim 12.