The Western Australian government is pushing back against concerns about the security of its implementation of the iVote electoral system. iVote is an electronic system already used in another Australian State, New South Wales, primarily as an accessibility tool because it lets the vision-impaired and others with disabilities vote without assistance. Perhaps in response to last year’s Census debacle, Western Australia has decided to put in place denial-of-service (DoS) protection, and that’s attracted the attention of a group of veteran electronic vote-watchers. Writing at the University of Melbourne’s Pursuit publication, the group notes that the DoS proxy is not in Australia: it’s provided by Imperva’s Incapsula DoS protection service. That raises several issues, the academics (Dr Chris Culnane and Dr Vanessa Teague of the University of Melbourne, Dr Yuval Yarom and Mark Eldridge of the University of Adelaide, and Dr Aleksander Essex of Western University in Canada) note. First: the TLS certificate iVote uses to secure its communications is signed not by the WA government, but by Incapsula; and second, that means Incapsula is decrypting votes on their way from a voter to the State’s Electoral Commission.
While it would be fatal to Incapsula’s business if it weren’t trustworthy, the academics are worried about votes existing in decrypted form anywhere but the Electoral Commission, because a suborned employee, someone wandering around Incapsula’s systems without authorisation, or US government agencies also stand as “possible eavesdroppers”.
The Western Australian Electoral Commission has issued a “calm down”, telling The West Australian votes have two layers of encryption: one when the vote is cast, and a second for transit (the TLS session that uses the Incapsula certificate).
That’s true, white-hat mathematician Dr Vanessa Teague told The Register, adding that the Javascript-based in-browser encryption of votes looks “pretty good” to the group.
Full Article: Western Australia’s Web votes have security worries, say ‘white hat’ mathematicians • The Register.