The Estonian i-voting experience is probably the richest to analyze; a country that is considered a pioneer in digitizing both the government and private sector since 2001 followed by online internet voting (i-voting) in 2005. However, there are still some complaints submitted, critics and remarks to consider about the IVXV system. In this paper, we introduce a Systemization of Knowledge of the Estonian IVXV i-voting system and propose some added security enhancements. The presented SoK discusses applications implemented by election observers in 2023 & 2024 elections, which, to our knowledge, have never been mentioned and/or analyzed in the academia before. We also point out to unnoticed automated formal verification analysis of IVXV; the researchers discovered a privacy attack that we show extendable to a possible large scale encrypted vote copying. In addition, we identify and analyze recent fixes and improvements in the June 2024 version used in the European Parliament elections connecting them to their academic sources. Then, we discuss the current system status, pointing out to risks that have never been discussed before like voting trojan horses and automated online attacks, propose our own suggestions to some remaining vulnerabilities, discuss the newest Estonian Cyber Security committee June 2025 report, then raise the inevitable question of the approaching quantum threat.
Note: This is the final complete extended version containing all details of the earlier versions with the newest details up to May 2026 a new paper "Beyond the Happy path" was discussed and the extended version was adjusted to the IEEE Access submission on 15/5/2026; events on Nov 2025 elections and the Trojan horse threat still exists with more details The compact version (in IEEE format ) is on Researchgate https://www.researchgate.net/publication/383220628_On_the_Estonian_Internet_Voting_System_IVXV_SoK_and_Suggestions Most significant updates: the threat of adversary votes through TROJAN HORSEs embedded in non-voting applications, IVXV updates published on 30/9/2025, Estonian Cyber Security Committee report of noteworthy threats (30/9/2025), and covering Oct 2025 local elections. It will take time to merge the 2 versions into a single version based on the place of acceptance and removal of the posters details by citing them. On 20/9/2025: ----------------- An added row in Table1 since IVXV did add a finger print to the Voting application on June 2024 but in kind of technical steps to the average users and attacks are still possible (https://github.com/DrShymaa2022/E_Vote_ID_2025_posters/blob/main/EncryptedcopyattackPoster_13_9_25.pdf) On 21/8/2025: ----------------- Ukraine is NOT Estonia's closest neighbor, but still the war has put some pressure according to prime minister and a cyber security chairman statements in [7] + other writing edits in red. -------------------------------------------- On 20/7/2025: ----------------- Adding Appendix C about absent voting and possible online credential theft, with an accompanying row in Table 2, + some bench mark figures (taken from [91]) in Appendix A.5 about Verkle Tree proof generation time . On 13/7/2025: ----------------- Adding 2 summary tables of sec.s 5,6 respectively + adding AI-generated Verkle Tree proofs simulation + some changes in the final conclusion
BibTeX
@misc{cryptoeprint:2025/506,
author = {Shymaa M. Arafat},
title = {On the Estonian Internet Voting System, {IVXV}, {SoK} and Suggestions},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/506},
year = {2025},
url = {https://eprint.iacr.org/2025/506}
}
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。