|
| 1 | +# Authentication Sequence |
| 2 | + |
| 3 | +```mermaid |
| 4 | + sequenceDiagram |
| 5 | + autonumber |
| 6 | +
|
| 7 | + participant Voter |
| 8 | + participant Client |
| 9 | + participant Auth as Authorization Service |
| 10 | + participant Signer as Blind Signature Server |
| 11 | + participant VoteServer as Voting Server |
| 12 | + participant Database |
| 13 | + participant Tally as Tallying Service |
| 14 | +
|
| 15 | + Note over Client,Signer: RSA signing key pair is pre-configured. Public key is known to the client. Private key is kept by the signer. |
| 16 | + Note over Client,Tally: Election encryption public key is known to the client. Private key is kept only for tallying. |
| 17 | +
|
| 18 | + Voter->>Client: Start voting process |
| 19 | + Client->>Auth: Authenticate voter |
| 20 | + Auth-->>Client: Authorization completed |
| 21 | +
|
| 22 | + Client->>Client: Generate token m |
| 23 | + Client->>Client: Generate blinding factor r |
| 24 | + Client->>Client: Blind token using m, r and signer public key |
| 25 | +
|
| 26 | + Client->>Signer: Send blinded token |
| 27 | + Signer->>Auth: Check voter eligibility |
| 28 | + Auth-->>Signer: Voter eligible and not used yet |
| 29 | +
|
| 30 | + Signer->>Signer: Sign blinded token with private key |
| 31 | + Signer->>Auth: Mark authorization as used |
| 32 | + Signer-->>Client: Return signed blinded token |
| 33 | +
|
| 34 | + Client->>Client: Unblind signed token using r |
| 35 | + Client->>Client: Obtain signed anonymous voting token |
| 36 | +
|
| 37 | + Voter->>Client: Select vote |
| 38 | + Client->>Client: Encrypt vote with election public key |
| 39 | +
|
| 40 | + Client->>VoteServer: Submit encrypted vote and signed token |
| 41 | + VoteServer->>VoteServer: Verify token signature with signer public key |
| 42 | + VoteServer->>Database: Check whether token was already used |
| 43 | +
|
| 44 | + alt Token is valid and unused |
| 45 | + VoteServer->>Database: Store token hash and encrypted vote |
| 46 | + VoteServer-->>Client: Vote accepted |
| 47 | + else Token is invalid or already used |
| 48 | + VoteServer-->>Client: Vote rejected |
| 49 | + end |
| 50 | +
|
| 51 | + Tally->>Database: Retrieve encrypted votes |
| 52 | + Tally->>Tally: Decrypt votes with election private key |
| 53 | + Tally->>Tally: Count votes |
| 54 | +``` |
0 commit comments