Listen to this Post
Introduction:
Electronic voting represents one of the most challenging frontiers in cybersecurity—balancing absolute ballot secrecy with end-to-end verifiability while defending against nation-state adversaries, insider threats, and client-side compromise. Swiss Post’s E-Voting system, deployed across multiple Swiss cantons since 2023, addresses these challenges through a fully transparent, community-audited architecture that publishes all source code, runs recurring public intrusion tests, and maintains an indefinite bug bounty program. The system’s cryptographic protocol leverages ElGamal encryption, patented mix-1et processes, and return-code-based individual verifiability to ensure that votes remain secret yet auditable.
Learning Objectives:
- Understand the cryptographic primitives and infrastructure layers securing Swiss Post’s production E-Voting system
- Analyze attack surfaces including client-side threats, insider risks, and network-layer vulnerabilities
- Master practical security testing techniques using the publicly available source code and test environment
You Should Know:
1. Cryptographic Architecture: End-to-End Encryption and Mix-1et Verifiability
Swiss Post’s E-Voting system implements a sophisticated multi-layered cryptographic protocol that guarantees vote secrecy and verifiability simultaneously. The system generates six sets of asymmetric key pairs during configuration—three ElGamal key pairs for encryption/decryption and three exponentiation key pairs where secret keys are used for exponentiating certain values. Continuous end-to-end encryption throughout the entire voting and election process ensures that votes remain confidential from casting through tallying.
A patented “mixer” process is executed before votes are decrypted, preventing any inferences between cast votes and voting order. This mix-1et approach, combined with homomorphic encryption techniques, allows the system to tally votes without ever decrypting individual ballots in the clear. The system achieves individual verifiability through return codes—voters receive physical code sheets via postal mail that allow them to confirm their vote was recorded correctly, even if their device is compromised.
For security practitioners, understanding the cryptographic flow is essential:
Verify cryptographic signatures of published components Clone the public repository git clone https://gitlab.com/swisspost-evoting/e-voting/e-voting-documentation.git Verify GPG signatures on release tags git tag -v v1.0.0 Check cryptographic library dependencies The crypto-primitives library implements core algorithms cd crypto-primitives cargo build --release cargo test -- --1ocapture
2. Infrastructure Hardening: Multi-Layer Defense with Kubernetes Isolation
The production E-Voting infrastructure employs defense-in-depth across multiple isolated layers. Critical control components run within isolated network zones inside Swiss Post infrastructure, while cantonal components operate on separate premises. The system uses Kubernetes to deploy parts of the system as Docker containers for additional isolation.
The infrastructure stack includes:
| Layer | Technology | Security Controls |
|-||-|
| Reverse Proxy | Apache 2.4.62, ModSecurity 2.9.8, mod_qos 11.74 | WAF, rate limiting, TLS termination |
| Container Orchestration | Kubernetes 1.26, Rancher 2.7, Docker 26.1 | Namespace isolation, network policies |
| Operating Systems | RHEL 8.10, Debian 11.11, Windows Server 2022 | Regular patching, SELinux |
| Database | Oracle Enterprise 19.24 | Encrypted storage, audit logging |
System administrators and privileged users cannot view or modify votes—cryptographic protections prevent even insiders from accessing ballot data. All activities are recorded via inalterable logs combining HMAC techniques, digital signatures, and temporary cryptographic keys.
- Public Bug Bounty and Intrusion Testing: Continuous Security Validation
Swiss Post operates one of the most transparent security programs in government technology. The bug bounty program, hosted on YesWeHack, runs indefinitely with rewards up to €230,000 for critical findings. Researchers can submit findings through GitLab, encrypted email, or the bug bounty platform.
Public Intrusion Tests (PIT) are conducted periodically, lasting four weeks each. During the 2024 test, Swiss Post detected approximately 29,000 hits on the voting platform, with 9,665 classified as attempted attacks. The 2022 test attracted around 3,400 international security researchers.
To participate in security testing:
Deploy a self-contained test instance Follow the deployment guide in the documentation git clone https://gitlab.com/swisspost-evoting/e-voting/e-voting.git cd e-voting docker-compose -f docker-compose.test.yml up -d Run static analysis on the source code Using SonarQube as recommended in documentation sonar-scanner -Dsonar.projectKey=evoting \ -Dsonar.sources=. \ -Dsonar.host.url=http://localhost:9000 \ -Dsonar.login=your_token Dynamic testing against the test environment The test environment is available at pit.evoting.ch during PIT periods nmap -sV -p- pit.evoting.ch sslscan --1o-failed pit.evoting.ch
- Client-Side Threat Mitigation: Return Codes and Device Independence
One of the most challenging attack vectors in E-Voting is client-side compromise—malware on voters’ devices could theoretically alter ballots before transmission. Swiss Post addresses this through a return-code mechanism that doesn’t rely on device trust.
Voters receive physical voting materials including individual security codes via postal mail. During voting, the system generates return codes that the voter must verify against their physical code sheet. If a vote is altered by malware, the return code won’t match, alerting the voter to the manipulation.
The protocol involves:
- SendVote: Voter submits encrypted ballot via voting client
- ConfirmVote: Voter verifies return code against physical sheet
- Verification: Electoral authorities can audit all votes post-closure
For security researchers analyzing client-side risks:
Windows: Analyze voting client network traffic netsh trace start capture=yes provider=Microsoft-Windows-WinINet tracefile=C:\trace.etl Simulate voting, then stop netsh trace stop Linux: Analyze browser-based voting client The voting client runs in the browser with HTML, JavaScript, CSS Monitor WebSocket and HTTPS traffic tcpdump -i any -w voting.pcap port 443 wireshark voting.pcap Filter for WebSocket frames containing encrypted ballot data
5. Verification and Auditing: Independent Validation Infrastructure
The system provides complete verifiability through independent verification software that runs outside Swiss Post’s control. Cantonal electoral authorities can check all electronically cast votes after ballot box closure and determine any irregularities.
The verifier component, published as open source under Apache 2.0 license, allows anyone to audit election results independently. This addresses the “who audits the auditors” problem by making verification transparent and reproducible.
Clone and build the verifier git clone https://gitlab.com/swisspost-evoting/verifier/verifier.git cd verifier mvn clean install Run verification against election data The verifier checks cryptographic proofs and tally correctness java -jar target/verifier.jar --input election_data.json --verify The verification process validates: 1. All ballots are properly encrypted 2. Mix-1et operations preserved secrecy 3. Tally matches decrypted results 4. No duplicate or invalid votes
6. Attack Surface Analysis and Known Vulnerabilities
Despite rigorous security measures, the system has known threat vectors that researchers continue to explore. The Federal Chancellery’s threat model for universal verifiability acknowledges that a dishonest setup component could impair security. The predecessor system, sVote, was withdrawn in 2019 after numerous vulnerabilities were uncovered.
Key attack surfaces include:
- Print Office Compromise: Physical security of code sheet printing varies by canton
- Network Layer DDoS: Swiss Post uses 5 Gbps upstream links; attacks exceeding this capacity could disrupt availability
- Insider Threats: While cryptographic protections prevent vote viewing, malicious insiders with setup access could theoretically corrupt the count
- Coercion and Vote-Buying: Postal voting security shouldn’t be benchmarked for internet voting due to scalability concerns with coercion
For penetration testing:
Test for common web vulnerabilities in the voting portal Using OWASP ZAP zap-cli quick-scan --self-contained --start-options "-config api.disablekey=true" \ https://pit.evoting.ch Check for misconfigurations in the reverse proxy Apache with ModSecurity, mod_qos curl -I https://pit.evoting.ch Look for missing security headers curl -H "Host: pit.evoting.ch" https://pit.evoting.ch/ -v Test TLS configuration testssl.sh --quiet --color 0 https://pit.evoting.ch
What Undercode Say:
- Transparency as a security multiplier – Swiss Post’s decision to fully disclose source code, run public bug bounties, and host recurring intrusion tests represents a paradigm shift in government technology security. The community programme enables hundreds of independent researchers to continuously audit the system, far exceeding what any internal team could achieve.
- The return-code mechanism is elegantly simple yet cryptographically robust – By anchoring verification in physical code sheets delivered via postal mail, the system breaks the device trust assumption that plagues most digital voting systems. This hybrid physical-digital approach deserves broader adoption in high-stakes authentication scenarios.
- Infrastructure transparency reveals real security maturity – Publishing detailed component specifications including OS versions, Kubernetes configurations, and hardware models demonstrates genuine confidence in the system’s security posture. Few organizations are willing to expose this level of operational detail.
- The 2024 intrusion test statistics (29,000 hits, 9,665 attack attempts) underscore the system’s resilience – While no system is impenetrable, the ability to withstand sustained, globally-sourced attack campaigns without compromise validates the architectural choices.
- Client-side threats remain the most significant unresolved challenge – Even with return codes, the voter experience friction may lead to reduced verification compliance. Future iterations should explore hardware-based authentication or mobile app integrations to streamline the verification process while maintaining security.
Prediction:
- +1 The Swiss Post E-Voting model will become the global reference standard for secure digital voting, with at least five additional countries adopting similar transparent, cryptographically-verifiable architectures by 2030.
- +1 The success of the community programme will inspire other critical infrastructure providers to adopt full-source disclosure and permanent bug bounty programs, fundamentally shifting the cybersecurity paradigm from security-through-obscurity to security-through-transparency.
- -1 Despite cryptographic protections, nation-state adversaries will increasingly target the physical supply chain—the print offices and code sheet distribution channels—as the weakest link in the hybrid system.
- +1 Formal verification efforts using tools like Tamarin prover will mature to the point where the entire cryptographic protocol can be mathematically proven secure, eliminating classes of implementation vulnerabilities.
- -1 Scalability challenges with coercion-resistant voting will limit adoption to countries with strong postal infrastructure and high trust in government institutions, creating a digital voting divide between developed and developing nations.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Baeurnhaeuckt Hackathon – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
