# A P2P Scheme for Debating and Voting with Unconditional Flexibility
## 4 Analysis
### Attack Example  
Let there be a group of six members: four honest and two adversaries. At the end of the first stage each one shows his/her own list of accepted aliases to the rest, resulting in the set of published lists in Figure 3.  
Each column of Figure 3 corresponds to the list shown by each user. For example, the first column corresponds to the aliases accepted by the first user, which in this case belongs to the honest group \(\{U_{1},U_{2},U_{3},U_{4}\}\). The bottom part of this column contains the aliases sent by honest users \(\{H_{1},H_{2},H_{3},H_{4}\}\). As they are honest, they have used the same alias in all the processes. The upper part shows the aliases that adversaries have sent. With this user in particular, \(U_{1}\), they have sent the aliases \(A_{1}\) and \(A_{3}\). Adversaries can send different aliases to different users, for example \(U_{1}\) and \(U_{2}\) receive \(A_{1}\) and \(A_{3}\), while \(U_{3}\) and \(U_{4}\) receive \(A_{2}\) and \(A_{4}\). Also, they can show whichever set of aliases in their own list. In this case they choose to show \(A_{3}\) and \(A_{4}\) instead of \(H_{3}\) and \(H_{4}\). At the end, honest users realize that there are adversaries because there are more aliases than users, but cannot deduce who are them. \(A_{i}\) appears the same number of times as \(H_{3}\) or \(H_{4}\), which means that most users (more than \(n/2=3\) in this case) accept these aliases. Therefore there must be a limit for adversaries and a threshold for accepting aliases higher than \(n/2\), so that extra aliases are banned. With no extra aliases adversaries can neither vote twice nor lead to inconsistencies. The next lemma establishes the minimum amount of  
Figure 3: Attack example: Bulletin boards of users \(U_{i}\) shown as columns. \(H_{i}\) are alias of honest users; \(A_{i}\) are alias of adversaries (\(U_{5},U_{6}\)). If the acceptance criterion is to be in at least 4 columns, the adversaries may vote double. adversaries to achieve this kind of attack and explains the threshold used in the last step of the protocol:  
**Lemma 2**. : _Adversaries are not able to force different results (inconsistency) among honest users if they number less than \(\sqrt{n+1}-1\) where \(n\) is the total number of users._  
Proof. : If half the honest users vote exactly the opposite to the other half, one adversary vote is able to decide the result. If adversaries manage to register this vote with a different value in different users, the result will differ among users. It would therefore appear that inconsistency can be achieved by changing just one vote. However, adversaries cannot vote differently with the same alias because at the end users will compare the contributions of each alias (Section 3.2 4.) and detect discrepancies. Registering different votes thus implies using different aliases. Furthermore, each honest user will accept just one alias per adversary, but they cannot detect that these accepted aliases are the same for every honest user. In other words, adversaries can use different alias for each honest user. Let us consider that there is the minimum number of adversaries \(m\) that achieves inconsistency. The rest \(h=n-m\) are honest. Then, aliases from honest users will be present in at least \(h\) user bulletin boards. Let us choose this value as a minimal presence for any alias in order to be accepted (this is just the threshold to be calculated). For this purpose, adversaries can use the room in honest users' bulletin boards assigned to them (let us call this area 1, which corresponds to the upper left-hand corner of Figure 4), who can accept \(m\cdot h\) blind signatures, and the room in their own bulletin boards as valid users (let us call this area 2, which corresponds to the right-hand side of Figure 4), \(n\cdot m\), where they can show any alias list. Aliases cannot be repeated in the same user bulletin board (same column in Figure 4). With this constraint each adversary alias will collect no more than \(m\) signatures in area 2.