05/07/2008
Analysis of Belgian evoting code back online
In 2003/2004 afront.be published a study that claimed that the digivote software for these elections was not guaranteeing the anomity of the voters. Maybe there model is theoretical, maybe it is far stretched but at least somebody took time to analyse the code.
This should be an inspiration for other code crackers. The actual code that was used in the last Belgian elections is online (see other evoting subjects) and there are now more tools available to analyse tool (fuzz it). It is a pitty that code is put online because the community can research it for mistakes and problems and no one ever analyses it again. Than it is better to keep it offline and to spend much more time and money to let it analyse and clean by professionals worldwide (maybe in contest with each other).
This is the conclusion http://www.zhodani.net/lib/vote.html
Casual inspection of the Digivote sourcecode reveals obvious errors from which we deduce scant peer review of the code, if any, has taken place. Keeping the voting anonymous isn't high on the priorities list: stack variables are not zeroed after their useful lifetime has expired, the randomize function is misused thus that the data on the magnetic cards contain a timestamp, and the order of votes can in almost all cases be deduced from the contents of the B003 and B013 files.
11:38 | Permalink | Comments (1) | Email this
|
|
del.icio.us
|
|
Digg |
Facebook




Comments
1500 11th St.
Sacramento, CA
USA95814
Posted by: Lowell Finley | 05/07/2008
Respond to this commentPost a comment