05/07/2008

Analysis of Belgian evoting code back online

In 2003/2004 afront.be published a study that claimed that the digivote software for these elections was not guaranteeing the anomity of the voters. Maybe there model is theoretical, maybe it is far stretched but at least somebody took time to analyse the code.

This should be an inspiration for other code crackers. The actual code that was used in the last Belgian elections is online (see other evoting subjects) and there are now more tools available to analyse tool (fuzz it). It is a pitty that code is put online because the community can research it for mistakes and problems and no one ever analyses it again. Than it is better to keep it offline and to spend much more time and money to let it analyse and clean by professionals worldwide (maybe in contest with each other). 

This is the conclusion  http://www.zhodani.net/lib/vote.html  

Casual inspection of the Digivote sourcecode reveals obvious errors from which we deduce scant peer review of the code, if any, has taken place. Keeping the voting anonymous isn't high on the priorities list: stack variables are not zeroed after their useful lifetime has expired, the randomize function is misused thus that the data on the magnetic cards contain a timestamp, and the order of votes can in almost all cases be deduced from the contents of the B003 and B013 files.  

11:38 | Permalink | Comments (1) | Email this | |  del.icio.us | | Digg! Digg |  Facebook

Comments

1500 11th St.
Sacramento, CA
USA95814

Posted by: Lowell Finley | 05/07/2008

Respond to this comment

Post a comment