Moscow Blockchain Voting System 'Completely Insecure,' Says Researcher

A blockchain system that will soon be used to allow Moscow residents to vote in elections is currently easy to hack, according to a researcher.

AccessTimeIconAug 16, 2019 at 12:17 p.m. UTC
Updated Sep 13, 2021 at 11:20 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

A blockchain-based system that will be used to allow Moscow residents to vote in municipal elections this autumn is very easy to hack, according to a research note from a French cryptography expert.

Titled, "Breaking the encryption scheme of the Moscow internet voting system," the paper by Pierrick Gaudry, a researcher from French governmental scientific institution CNRS, looked at the encryption scheme used to secure the public code of the Moscow city government's ethereum-based e-voting platform.

Gaudry concluded that encryption scheme used in part of the code "is completely insecure, explaining:

"It can be broken in about 20 minutes using a standard personal computer, and using only free software that is publicly available. More precisely, it is possible to compute the private keys from the public keys. Once these are known, any encrypted data can be decrypted as quickly as they are created."

To be clear, the issue is not with the ethereum code used as a basis for the platform. The encryption used in the Moscow system, the researcher said, is a variant of ElGamal and uses keys that are "less than 256 bits long."

"This is way, way too short to guarantee any security," Gaudry said.

As stated on the city administration's website, voters from three constituencies can choose to use the system to elect deputies to the Moscow City Duma, or parliament, on Sept. 8.

For the trial effort, the site claims:

"Moscow electronic elections guarantee complete anonymity and secrecy of the vote. No one can associate an electronic return with the name of the voter."

In fact, Gaudry said, "in the worst-case scenario," the poor level of encryption at present would mean details of all voters' choices "would be revealed to anyone as soon as they cast their vote." He added though that, not having read the protocol for the system, the consequences of a potential hack are hard to pinpoint.

To be fair to the development team, the system had been the subject of a "public intrusion test" aimed to spot any such issues late in July with Gaudry using the source code made available on Github.

Gaudry did reach out to the Moscow Department of Information Technology team developing the voting system about the security weakness. They acknowledged that the cryptographic keys are not currently sufficiently secure, and said they would be upgraded to 1,024 bits soon.

Moscow image via Shutterstock

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.