Member Avatar for bondito

Hi everyone, i am building a secure online voting system for my project, i really need some tips on how i can go about encrypting the information stored in a database which contains the votes submitted by the candidates. I was told by my project supervisor to try and implement public/private key encryption, i really dont know where to start. Please if u have any more ideas i could use to make the system more secure let me know. Thanks :?:

  • 4 Contributors
  • 3 Replies
  • 190 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by Evenbit

Dani AI

Generated

Brief, practical addendum to the thread: ’s supervisor is pointing in the right direction — public/private keys are a tool, not the whole solution. and are correct that Java has the primitives; ’s concern about key distribution is valid in spirit (don’t hand private keys to voters). The design below focuses on patterns that work for storing ballots safely and on the operational controls that make them meaningful.

Recommended pattern (concise): use hybrid encryption per ballot. Generate a fresh symmetric key (AES-256, AEAD mode such as GCM) for each submitted ballot and encrypt the ballot with that key. Wrap (encrypt) the symmetric key with the election authority’s public key (RSA-OAEP or an EC alternative) and store: ciphertext, IV, AEAD tag, wrapped key and minimal metadata. On tally, unwrap keys in an offline, auditable environment and decrypt. This limits blast radius if the database is leaked and preserves a clear separation of duties.

Privacy, authenticity and verifiability: keep voter authentication separate from stored ballots (single-use tokens, one-time voting tokens, or a blind-signature flow) so ballots cannot be trivially linked back to voters. For true end-to-end verifiability use established techniques (mixnets or homomorphic tallying) rather than ad-hoc signing. Election systems require a threat model, independent review, and careful protocol choice — encryption of the DB is only one layer.

Operational cautions and quick checklist: protect private keys in an HSM or tightly controlled server; use SecureRandom for IVs/nonces; prefer AEAD (avoid separate MACs); rotate and back up keys securely; use TLS for transport; log and audit accesses; do not implement custom crypto primitives. The following minimal Java sketch shows the basic AES-GCM + RSA-OAEP wrap pattern:

KeyGenerator kg = KeyGenerator.getInstance("AES");
kg.init(256);
SecretKey aesKey = kg.generateKey();

Cipher aes = Cipher.getInstance("AES/GCM/NoPadding");
byte[] iv = new byte[12];
new SecureRandom().nextBytes(iv);
GCMParameterSpec spec = new GCMParameterSpec(128, iv);
aes.init(Cipher.ENCRYPT_MODE, aesKey, spec);
byte[] ciphertext = aes.doFinal(ballotBytes);

Cipher wrap = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
wrap.init(Cipher.WRAP_MODE, electionPublicKey);
byte[] wrappedKey = wrap.wrap(aesKey);

For a project: implement the pattern, document the threat model, and seek an external review before treating the system as authoritative.

Recommended Answers

All 3 Replies

Member Avatar for server_crash

Java has a really nice security package that will do everything for you.

Member Avatar for ckmajor

Java Cryptography Extension (JCE) which is part of J2SE(1.4 onwards) has packages and framework to carryout encryption.

Check out following sites
http://java.sun.com/j2se/1.4.2/docs/guide/security/jce/JCERefGuide.html
http://java.sun.com/j2se/1.4.2/docs/guide/security/jce/HowToImplAJCEProvider.html

Oracle also provides DBMS packages which can be used to carryout encryption. Following are the Oracle packages that have functions related to encryption

Oracle Package DBMS_OBFUSCATION_TOOLKIT (Oracle Database 8i, 9i and 10g )
Oracle Package DBMS_CRYPTO (Oracle Database 10g )

Member Avatar for Evenbit

Hi everyone, i am building a secure online voting system for my project, i really need some tips on how i can go about encrypting the information stored in a database which contains the votes submitted by the candidates. I was told by my project supervisor to try and implement public/private key encryption, i really dont know where to start. Please if u have any more ideas i could use to make the system more secure let me know. Thanks :?:

tip#1) Please DO NOT allow the 'candidates' to submit all of the votes. Wouldn't it make much more sense to allow the 'voters' to submit the votes?

tip#2) Stay away from the public/private key charade. Are you going to lock-up your house and then toss duplicates of the key into the street for anyone to pick up?

tip#3) Code for common encryption systems are widely available on the 'net -- if you can't find Java code for your favorite one(s), then it'd be an educational benefit to you to do the conversion(s).

Nathan.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.