Current Projects
Digitalisation and Elections
- OpenVoting: Recoverability from Failures in Dual Voting
[Authors: Prashant Agrawal, Kabir Tomer, Abhinav Nakarmi, Subodh Sharma, Mahavir Jhawar, Subhashis Banerjee]
This research underscores the importance of recoverability in large-scale elections, a property that complements the established tenets of verifiability and secrecy in secure voting systems. Current voting mechanisms—end-to-end verifiable systems and those reliant on voter-verified paper audit trails (VVPATs)—ensure verifiability of election results, but the question of how to deal with the situation when verifications actually fail is often overlooked. Yet, in large national elections running across multiple polling booths, voter disputes and errors caused by different actors are quite commonplace and having to discard the entire election because of a few failures, with no easy way to recover from them, is unacceptable.To address this, we introduce OpenVoting, a novel protocol enhancing large elections’ resilience by enabling the isolation and diagnosis of verification failures. OpenVoting identifies problematic polling booths and pinpoints a verifiable subset of accurate votes, facilitating swift and targeted recovery without jeopardising the entire election’s integrity, [Read More].
- Traceable Mixnets:
[Authors: Prashant Agrawal, Abhinav Nakarmi, Subodh Sharma, Mahavir Jhawar, Subhashis Banerjee]
In this work, we develop a novel privacy enhancing technique called traceable mixnets that plays a crucial role in enabling recoverability in OpenVoting while maintaining strong vote secrecy properties. A traditional mixnet allows anonymous communication by shuffling encrypted messages sent by multiple message senders and then decrypting them so that the information about which sender sent what message remains completely hidden. Verifiable mixnets additionally allow proving the correctness of the list of decrypted messages, while retaining the mixnet’s strong anonymity properties. However, in many applications, the privacy-utility trade off requires revealing some partial information about this association. Traceable mixnets allow provable disclosure of such partial information without revealing any additional information. Specifically, a traceable mixnet supports two types of queries: TraceIn, which verifies if a given ciphertext corresponds to any plaintext in a specified subset of the output list, and TraceOut, which checks if a given plaintext originated from any ciphertext in a specified subset of the input list. This functionality is crucial when disputes arise in a mixnet-based voting system, for example, as it allows for the identification of the origin of specific votes without exposing overall voting patterns, thus upholding the principle of secret ballots even in the face of disputes.We rigorously define the security properties needed for such a system, and we propose a construction that relies on novel distributed zero-knowledge proofs for set membership, as well as for a newly introduced problem we term ZKP of reverse set membership. The main challenge in our construction is that the distributed setting prevents the mix-servers from learning any information about the association between the ciphertexts and plaintexts, yet requires them to jointly provide convincing set membership proofs. Our implementation showcases that these distributed proofs are not only feasible but also significantly more efficient than current state-of-the-art technologies, with at least an order of magnitude increase in speed, [Read More].
- Publicly Auditable Yet Private Electoral Rolls:
[Authors: Prashant Agrawal, Subodh Sharma, Mahavir Jhawar, Subhashis Banerjee]
The integrity of elections relies not only on verifiable voting protocols but also on safeguarding the accuracy and privacy of voter lists, also known as electoral rolls. While existing literature has extensively addressed verifiability of voting protocols, the vulnerability of electoral rolls remains a critical concern. The current practice is to either make electoral rolls public or share them with the political parties, so that they can verify for themselves that the list contains all valid eligible voters and nothing else. However, this practice allows political parties to construct detailed voter profiles and selectively target and manipulate voters, thereby undermining the fundamental principle of free and fair elections. In this paper, we study the problem of designing publicly auditable yet privacy-preserving electoral rolls. We first analyse the threats associated with manipulation and leakage of electoral rolls, formalising them into security definitions for a secure electoral roll protocol that safeguards against these threats. Subsequently, we propose a concrete protocol that satisfies our definitions. In our protocol, eligible voters can verify their inclusion in the list, while political parties and auditors can statistically audit the electoral roll against verified and accurate identity and address data of the voters. This is done without ever revealing the entire electoral roll, which prevents any large-scale voter targeting and manipulation. By delving into this crucial weak link, this work contributes to the ongoing efforts of enhancing electoral transparency and integrity, [Read More].
An Architecture For Privacy
- An Operational architecture for privacy-by-design in public service applications
[Author: Prashant Agrawal, Anubhutie Singh, Malavika Raghavan,Subhodh Sharam, Subhashis banerjee ]
Governments around the world are trying to build large data registries for effective delivery of a variety of public services. However, these efforts are often undermined due to serious concerns over privacy risks associated with collection and processing of personally identifiable information. While a rich set of special-purpose privacy-preserving techniques exist in computer science, they are unable to provide end-to-end protection in alignment with legal principles in the absence of an overarching operational architecture to ensure purpose limitation and protection against insider attacks. This either leads to weak privacy protection in large designs, or adoption of overly defensive strategies to protect privacy by compromising on utility.In this paper, we present an operational architecture for privacy-by-design based on independent regulatory oversight stipulated by most data protection regimes, regulated access control, purpose limitation and data minimisation. We briefly discuss the feasibility of implementing our architecture based on existing techniques. We also present some sample case studies of privacy-preserving design sketches of challenging public service applications, [Read More].
Digitalisation of Identity Systems
- Determinants of the failure to link Aadhaar with the Public Distribution System
[Author: Anustubh Agnihotri]
The Aadhaar program, which assigns a 12-digit unique biometric ID to individuals, has become a central pillar of the Indian welfare state. The debate on the use of Aadhaar for the delivery of public services has focused on reducing leakage, improving the efficiency of public service delivery, and the potential for exclusion of deserving welfare beneficiaries. However, less attention has been devoted to the determinants of failures when incorporating a new technology into an existing welfare policy. We use a unique administrative dataset that documents the errors in linking Aadhaar with the public distribution system (PDS) across 16 districts, close to 20 million citizens, and more than 20,000 villages and urban local bodies to analyse determinants of technological failure.  By analysing a large-scale administrative dataset generated by the state, the project provides a systematic understanding of the challenges encountered while incorporating a new technology architecture within an existing welfare service. Further, we aim to use this analysis to adjudicate between societal, state-capacity related, and technological determinants of success/failure in linking biometric technology with an existing welfare program. We do so by linking the prevalence of technological failure at the village, gram panchayat, and block level with socio demographic and state capacity measures. At the end of the project, we aim to answer the question of whether failures in linking Aadhaar to PDS are agnostic to social factors like rates of poverty, literacy, and state capacity variables like the degree of state presence and absence, [Read More].
Digitalisation and Payments
- A Privacy and Security Analysis of India’s Unified Payments Interface
[Authors: Mukundan A., Prashant Agrawal, Debayan Gupta, Subhashis Banerjee ]
The Unified Payments Interface (UPI), owned and operated by the National Payments Corporation of India (NPCI), is the most significant component of India’s retail digital payments infrastructure. By enabling instant transactions between almost all banks in India, it has played an important role in the growth of India’s fintech industry and revolutionized the payments experience for millions of users. But, despite its deep significance to economic life in India, the security and privacy guarantees associated with the UPI have received scant attention from researchers and journalists. In fact, while there has been limited attention paid to the risks of the end-user’s device being compromised, there has been virtually no academic reflection on the security, privacy or effectiveness of the UPI’s payments architecture per se. This project is an attempt to remedy this lapse. Our task is made difficult by the NPCI’s relative opaqueness about how the UPI’s infrastructure looks and works. Therefore, our first contribution is an unofficial, abstract model of the UPI’s current operational infrastructure based on some archived design documents. We then advance an intuitive ideal-world model of how a payments system (with similar pragmatic constraints) ought to operate in light of some reasonable privacy and security expectations. Furthermore, in light of this model, we assess our informal understanding of the UPI’s current operational infrastructure. Finally, based on this assessment, we identify a set of feasible changes that the NPCI may make to the UPI to help address our concerns. This project is anchored in computer science and technology, in particular in approaches to cryptography and database studies.But it presumes interests and engagement with:
-  Economics: with respect to an agent’s expectations from a transaction system,
- Legal studies and public affairs (given our attempts to align the UPI’s security and privacy guarantees with India’s jurisprudence on privacy and other rights), [Work in progress].
