Is the JCJ voting system really coercion-resistant?

Abstract

Coercion-resistance is a security property of electronic voting, often considered as a must-have for high-stake elections. The JCJ voting scheme, proposed in 2005, is still the reference when designing a coercion-resistant protocol. We highlight a weakness in JCJ that is also present in all the systems following its general structure. It comes from the procedure that precedes the tally, where the trustees remove the ballots that should not be counted. This phase leaks more information than necessary, leading to potential threats for the coerced voters. Fixing this leads to the notion of cleansing-hiding, that we apply to form a variant of JCJ that we call CHide.