Re: [belenios-discuss] Complex trustee structures with web server

[Roberto Blanco <roberto.blanco AT mpi-sp.org>]

Hi Stéphane,

On 25/04/2022 09:10, Stéphane Glondu wrote:
> > As I understand it, the web server lets an election administrator manage
> > trustees in one of two ways: either as a collection of Single trustees
> > (by default) or as a single Pedersen group (by going into "threshold
> > mode"). For the elections I have in mind, the natural setup would be one
> > Pedersen group and a small number of Single trustees, but the web server
> > does not seem to support this kind of configuration, or in general more
> > than one Pedersen group. Is this observation correct?
>
> Yes. I thought about this use case in the design (and it is actually
> used to enforce the presence of the server), but you are the first one
> to raise it publicly.

Many thanks for the careful answers! Indeed, I thought about the
placement of the server while considering this problem, but figured it
would simply become a Single trustee on top of any other trustees
defined by the administrator.

For the record, the idea behind my proposed trustee structure is to
reflect the existence of several, independent groups of stakeholders,
each of which must be given trustee authority. The reason for using
Pedersen trustees to represent all or some of those independent groups
is so that each member of a group, including substitutes, manages their
keys independently, with thresholds set appropriately.

> > In the "worst case" I expect voting could be done through the web
> > interface, and setup and tally through belenios-tool. Do you foresee any
> > problems in doing so? This would at least be practical for voters but
> > cumbersome for trustees.
>
> This might be possible, but is not obvious to me (see below).
>
> > Ideally, the trustees would at least be able to submit their election
> > keys and manage their decryption tasks through the web interface, as we
> > also need non-technical people to be able to play this role. Is there
> > any way to do this at the moment, or is belenios-tool the only solution?
>
> I cannot think of a way of doing that not involving belenios-tool.
>
>
> What I have in mind, using the current web UI is:
> 1. for each Pedersen group:
>     a. run the DKG (distributed key generation) protocol using
>        belenios-tool (see tests/tool/demo-threshold.sh)
>     b. compute the resulting public key of the group
>     c. in the web UI, add a (single, not threshold) trustee, using the
>        the result of b. above as public key
> 2. run the election as usual
> 3. for each Pedersen group:
>     a. compute a suitable number of partial decryptions
>     b. compute the resulting combined partial decryption for the group
>     c. in the web UI, submit the result of b. above as the group's
>        partial decryption
>
> For 1.b., the necessary is not implemented in belenios-tool. Computing
> the public key itself should be easy, but I'm not sure about the
> zero-knowledge proof.
>
> For 3.a., "belenios-tool threshold-decrypt" might do the job.
>
> For 3.b., as for 1.b., the necessary is not implemented in
> belenios-tool. Computing the decryption factors themselves should be
> easy, but I'm not sure about the zero-knowledge proofs.
>
> I believe building the ZKPs in 1.b. and 3.b. are open questions worth
> investigating per se. As a side-effect, it would allow an elegant
> implementation of arbitrary trees of trustees.

That makes sense. I see things are somewhat more involved than I
anticipated in the "worst case" but ultimately it comes as no big
surprise. And it does raise some interesting questions, indeed.

It seems to me using belenios-tool is the cleanest way of running an
election like the ones I describe at the moment. In order to involve
non-technical trustees, a reasonable workaround could involve doing away
with Pedersen groups altogether and arranging key sharing among certain
trustees out-of-band. This is probably what I will end up doing in the
immediate term.

> Anyway, implementing the feature natively in the web UI, without the
> proxy-via-single-trustees hack of above, should be possible, but is not
> on top of our priority list.

Good to know! I had had a quick look at the code to get a feel for what
the web server may be able to do. It did not seem then like it would be
terribly complex, but coming up with a simple and above all usable
design may not be trivial. If you think it would be useful to keep track
of this closer to the repository, I could open an issue and write some
initial thoughts there.

Best,
Roberto