- The IACR canceled its leadership election results due to a lost encryption key
- The election used Helios, an open-source cryptographic voting system
- One trustee lost their private decryption key, preventing result verification
In what can be described as a facepalm moment for one of the world's premier security organisations, the International Association of Cryptologic Research (IACR) last week announced it was forced to cancel the results of its annual leadership election after one of the officials lost an encryption key needed to decrypt the results. The secret digital ballot was conducted to fill the positions of three directors and four officer positions.
The votes were submitted and tallied using Helios, an open-source voting system that uses peer-reviewed cryptography to cast and count votes in a verifiable and confidential manner. The results could only be decoded using three cryptographic keys split among select election trustees, according to a report in The New York Times. However, one of the members lost the key 'irretrievably', making it impossible for the officials to unlock the ballot.
"Unfortunately, one of the three trustees has irretrievably lost their private key, an honest but unfortunate human mistake, and therefore cannot compute their decryption share. As a result, Helios is unable to complete the decryption process, and it is technically impossible for us to obtain or verify the final outcome of this election," IACR said.
Change In Election Process
To prevent a similar incident, the IACR said it will adopt a new mechanism for managing private keys. Instead of requiring all three private keys, elections will now require only two. Moti Yung, the trustee who was unable to provide his key, has resigned. He's being replaced by Michel Abdalla.
"We are deeply sorry for this failure and for the disruption it has caused; this situation should not have happened, and we take it very seriously. We respectfully ask for your understanding and patience while we remedy the problem and ensure that the renewed process is as smooth, secure, and transparent as possible," IACR added.
The new election will run from November 21 to December 20, using the same IACR membership electoral roll and the same list of candidates.
