(IN)SECURITY OF THE ELECTRONIC VOTING SYSTEM IMPLEMENTED AT FEDERAL INSTITUTE OF RONDONIA

Abstract

In this work we present an independent security analysis of the voting system implemented at Federal Institute of Rondonia. During our analysis, vulnerabilities and flaws were detected in the voting software and system deployment. As a result, this work presents scenarios where these problems can be explored in order to promote electoral fraud or, possibly, other responsibility crimes. Additionally, implementation flaws are identified because they also compromise the security of the electoral process. In particular, the main design and/or implementation problems detected in the security mechanisms of the voting software were: Unsafe authentication, Unsafe verifiability of the ballot, Obsolete cryptographic algorithms, Unverifiability of source code in production, Inappropriate attacker model, The possibility of attacks using social engineering, and Inadequate protection of ballot secrecy.