In brief
The International Association for Cryptologic Research (IACR) announced the cancellation of its leadership election results after one of the trustees lost an encrypted key deemed essential for accessing the vote. The organization plans to rerun the election, implementing new security measures to prevent similar incidents in the future. This episode highlights the vulnerabilities associated with cryptographic systems that rely on human management.
A firm considered one of the leading global voices in encryption has cancelled the announcement of its leadership election results after an official lost the encrypted key needed to unlock them.
The International Association for Cryptologic Research (IACR) uses an electronic voting system which needs three members, each with part of an encrypted key, to access the results.
In a statement, the scientific organisation said one of the trustees had lost their key in an honest but unfortunate human mistake, making it impossible for them to decrypt - and uncover - the final results.
The IACR said it would rerun the election, adding new safeguards to stop similar mistakes happening again.
The IACR is a global non-profit organisation which was founded in 1982 with the aim to further research in cryptology, the science of secure communication.
It opened votes for three Director and four Officer positions on 17 October, with the process closing on 16 November.
The Association used an open source electronic voting system called Helios for the process.
The browser-based system uses cryptography to encrypt votes, or keep them secret.
Three members of the association were chosen as independent trustees to each be given a third of the encrypted material, which when shared together would give the verdict.
Whilst two of the trustees uploaded their share of the encrypted material online, a third never did.
'Irretrievably' lost
The IACR said in a statement that the lack of results was due to one of the trustees irretrievably losing their private key, leaving it technically impossible for the firm to know the final verdict.
It said it was therefore left with no choice but to cancel the election.
The association added it was deeply sorry for the mistake, which it took very seriously.
American cryptographer Bruce Schneier told the BBC that failures in cryptographic systems often lie in the fact that to provide any actual security they have to be operated by humans.
Whether it's forgetting keys, improperly sharing keys, or making some other mistake, he said, cryptographic systems often fail for very human reasons.
Voting for the IACR positions has been renewed and will run until 20 December.
The association said that it had replaced the initial trustee who lost the encrypted information and will now adopt a 2-out-of-3 threshold mechanism for the management of private keys, with a clear written procedure for trustees to follow.
