In this context, local computation means that the browser 2 must support big number arithmetic and cryptographic functions. However, elections also must be accessible to the widest group of voters, independent of their browser configuration. Some browsers don t support cryptographic functions and, therefore, cannot be relied upon to adequately protect ballot secrecy or integrity. So, a trade-off exists between widespread browser compatibility and election security. Before we examine the three models for online elections, we need to discuss attack trees.
Attack trees help to formalize security threats.
3 Figure 1 shows some of the attacks that can be perpetrated on a voting system in order to compromise a voted ballot. To briefly summarize how attack trees work, each level describes an attack. Generally, any successful subordinate attack can be used to accomplish its higher level attack. If a system is to resist any top level attack, it must resist all of the subordinate attacks as well. In the following sections, we ll reference the attack tree in Figure 1 to highlight the security features of certain ballot protection architectures.