How to measure usable security: Natural strategies in voting protocols

Formal analysis of security is often focused on the technological side of the system. One implicitly assumes that the users will behave in the right way to preserve the relevant security properties. In real life, this cannot be taken for granted. In particular, security mechanisms that are difficult and costly to use are often ignored by the users, and do not really defend the system against possible attacks. Here, we propose a graded notion of security based on the complexity of the user's strategic behavior. More precisely, we suggest that the level to which a security property ? is satisfied can be defined in terms of: (a) the complexity of the strategy that the user needs to execute to make ? true, and (b) the resources that the user must employ on the way. The simpler and cheaper to obtain ?, the higher the degree of security. We demonstrate how the idea works in a case study based on an electronic voting scenario. To this end, we model the vVote implementation of the Prêt à Voter voting protocol for coercion-resistant and voter-verifiable elections. Then, we identify 'natural' strategies for the voter to obtain voter-verifiability, and measure the voter's effort that they require. We also consider the dual view of graded security, measured by the complexity of the attacker's strategy to compromise the relevant properties of the election.