Cryptography organization has to nullify election because someone lost the decrypt key!

[thewayne]

This is both funny and sad because (A) it happened to the International Association of Cryptologic Research, an organization that's been around for 50-some years, and (2) because it demonstrates how brittle encryption can be.

The organization was its annual leadership election, and was using high-strength and verifiable encryption. Everyone who submitted their vote could verify, through their own encryption key, that their vote was correct and not tampered with. Three members of the election committee each held one-third of the key required to completely decrypt the master file to tabulate the vote, so all three had to simultaneously submit their part of the key to process the votes.

One of the members lost their part of the key, irrecoverably, through simple human error - not a hack. Thus, the file remains forever locked.

The IACR is re-running the election which will close on December 20 using a different encryption methodology requiring two of the three key portions. And the person who lost their part of the key has resigned from the election committee, I don't know if they're still part of the organization.

https://arstechnica.com/security/2025/11/cryptography-group-cancels-election-results-after-official-loses-secret-key/

https://www.schneier.com/blog/archives/2025/11/iacr-nullifies-election-because-of-lost-decryption-key.html

Comments

[disneydream06]

WOW... Talk about a massive mess. :o
Hugs, Jon

[mtbc]

That's great, I do appreciate your tech news summaries.

[thewayne]

Like I said, cryptography can be brittle.  As demonstrated.  Lose your key, you are utterly screwed.  There's a guy in England who has put together a bunch of backers who want to buy a town dump because a hard drive got thrown away that contains Bitcoins that contain over $400 million in value.  They may or may not be able to find it, and the coins may or may not be retrievable.  But it would be a major environmental problem to dig up the dump!

[thewayne]

Thank you!  I do appreciate it.  Being a geek, and being able to usually spread information in an understandable way to the less geeky, I like doing so.  Of course, you need no simplification. :-)

[warriorsavant]

This is so sad that it's funny.

[disneydream06]

WOW... :o

[ndrosen]

I also appreciate your tech news summaries.

[silveradept]

An apt example of the greatest issue with encryption - lose the decryption key, and you're hosed. And if someone built a strong encryption system and a good key, then there's no way that the key can be reconstructed or determined using current technology. I wonder how many people we will find who have created password vaults, and then forget their primary password, or don't have it somewhere for their surviving kin to use to ensure their matters are properly wrapped up and their wishes are respected.

I dread the day that someone comes into the library and it's not "I forgot my e-mail password, we need to reset it," but "I forgot the password to my password vault, but you know how to retrieve that, right?" And we will have a long conversation at that point.