Search

Plasma detachment involves interactions of the plasma with impurities and neutral particles, leading to significant losses of plasma power, momentum, and particles. Accurate mapping of plasma emissivity in the divertor and X-point region is essential for assessing the relationship between particle flux and radiative detachment. The recently validated InfraRed Video Bolometer (IRVB) diagnostic, in MAST-U enables this mapping with higher spatial resolution than more established methods like resistive bolometers. In previous preliminary work, the evolution of radiative detachment was characterised in L-mode (power entering the scrape-off layer, PSOL ~0.4MW). With a conventional divertor the inner leg consistently detached ahead of the outer leg, and radiative detachment preceded particle flux detachment. This work presents results also from the third MAST-U experimental campaign, fuelled from the low field side instead of the high field side, including Ohmic and beam heated L-mode shots (with a power exiting the core up to PSOL ~1-1.5MW). The radiation peak moves upstream from the target at lower upstream densities than the ion target flux roll-over (typically considered the detachment onset), while the inner leg detaches before the outer one. The movement of the radiation is in partial agreement with the expectations from the DLS model, predicting a sudden shift from the target to the X-point. The energy confinement is found to be related to detachment, but there seems to be some margin between the radiation on the inner leg reaching the X-point and confinement being affected, a beneficial characteristic if it could be extrapolated to future reactors. For increasing PSOL the particle flux roll over is almost unaffected, while radiative detachment occurs at higher density in both legs, but much higher on the outer, suggesting an uneven distribution of the power exiting the core., Comment: Submitted to Nuclear Materials and Energy

Voting protocols seek to provide integrity and vote privacy in elections. To achieve integrity, procedures have been proposed allowing voters to verify their vote - however this impacts both the user experience and privacy. Especially, vote verification can lead to vote-buying or coercion, if an attacker can obtain documentation, i.e. a receipt, of the cast vote. Thus, some voting protocols go further and provide mechanisms to prevent such receipts. To be effective, this so-called receipt-freeness depends on voters being able to understand and use these mechanisms. In this paper, we present a study with 300 participants which aims to evaluate the voters' experience of the receipt-freeness procedures in the e-voting protocol Selene in the context of vote-buying. This actually constitutes the first user study dealing with vote-buying in e-voting. While the usability and trust factors were rated low in the experiments, we found a positive correlation between trust and understanding.

A voting system should not merely report the outcome: it should also provide sufficient evidence to convince reasonable observers that the reported outcome is correct. Many deployed systems, notably paperless DRE machines still in use in US elections, fail certainly the second, and quite possibly the first of these requirements. Rivest and Wack proposed the principle of software independence (SI) as a guiding principle and requirement for voting systems. In essence, a voting system is SI if its reliance on software is ``tamper-evident'', that is, if there is a way to detect that material changes were made to the software without inspecting that software. This important notion has so far been formulated only informally. Here, we provide more formal mathematical definitions of SI. This exposes some subtleties and gaps in the original definition, among them: what elements of a system must be trusted for an election or system to be SI, how to formalize ``detection'' of a change to an election outcome, the fact that SI is with respect to a set of detection mechanisms (which must be legal and practical), the need to limit false alarms, and how SI applies when the social choice function is not deterministic.

This paper shows first quantitative analysis of the detachment processes in the MAST Upgrade Super-X divertor (SXD). We identify an unprecedented impact of plasma-molecular interactions involving molecular ions (likely $D_2^+$), resulting in strong ion sinks (Molecular Activated Recombination - MAR), leading to a reduction of ion target flux. The MAR ion sinks exceed the divertor ion sources before electron-ion recombination (EIR) starts to occur, suggesting that significant ionisation occurs outside of the divertor chamber. In the EIR region, $T_e \ll 0.2$ eV is observed and MAR remains significant in these deep detached phases. The total ion sink strength demonstrates the capability for particle (ion) exhaust in the Super-X Configuration. Molecular Activated Dissociation (MAD) is the dominant volumetric neutral atom creation process can lead to an electron cooling of 20\% of $P_{SOL}$. The measured total radiative power losses \emph{in the divertor chamber} are consistent with inferred hydrogenic radiative power losses. This suggests that intrinsic divertor impurity radiation, despite the carbon walls, is minor in the divertor chamber. This contrasts previous TCV results, which may be associated with enhanced plasma-neutral interactions and reduced chemical erosion in the detached, tightly baffled SXD. The above observations have also been observed in higher heat flux (narrower SOL width) type I ELMy H-mode discharges. This provides evidence that the characterisation in this paper may be general.

Voting procedures are designed and implemented by people, for people, and with significant human involvement. Thus, one should take into account the human factors in order to comprehensively analyze properties of an election and detect threats. In particular, it is essential to assess how actions and strategies of the involved agents (voters, municipal office employees, mail clerks) can influence the outcome of other agents' actions as well as the overall outcome of the election. In this paper, we present our first attempt to capture those aspects in a formal multi-agent model of the Polish presidential election 2020. The election marked the first time when postal vote was universally available in Poland. Unfortunately, the voting scheme was prepared under time pressure and political pressure, and without the involvement of experts. This might have opened up possibilities for various kinds of ballot fraud, in-house coercion, etc. We propose a preliminary scalable model of the procedure in the form of a Multi-Agent Graph, and formalize selected integrity and security properties by formulas of agent logics. Then, we transform the models and formulas so that they can be input to the state-of-art model checker Uppaal. The first series of experiments demonstrates that verification scales rather badly due to the state-space explosion. However, we show that a recently developed technique of user-friendly model reduction by variable abstraction allows us to verify more complex scenarios.

We present the first analysis of the atomic and molecular processes at play during detachment in the MAST-U Super-X divertor using divertor spectroscopy data. Our analysis indicates detachment in the MAST-U Super-X divertor can be separated into four sequential phases: First, the ionisation region detaches from the target at detachment onset leaving a region of increased molecular densities downstream. The plasma interacts with these molecules, resulting in molecular ions ($D_2^+$ and/or $D_2^- \rightarrow D + D^-$) that further react with the plasma leading to Molecular Activated Recombination and Dissociation (MAR and MAD), which results in excited atoms and significant Balmer line emission. Second, the MAR region detaches from the target leaving a sub-eV temperature region downstream. Third, an onset of strong emission from electron-ion recombination (EIR) ensues. Finally, the electron density decays near the target, resulting in a density front moving upstream. The analysis in this paper indicates that plasma-molecule interactions have a larger impact than previously reported and play a critical role in the intensity and interpretation of hydrogen atomic line emission characteristics on MAST-U. Furthermore, we find that the Fulcher band emission profile in the divertor can be used as a proxy for the ionisation region and may also be employed as a plasma temperature diagnostic for improving the separation of hydrogenic emission arising from electron-impact excitation and that from plasma-molecular interactions. We provide evidences for the presence of low electron temperatures ($<0.5$ eV) during detachment phases III-IV based on quantitative spectroscopy analysis, a Boltzmann relation of the high-n Balmer line transitions together with an analysis of the brightness of high-n Balmer lines.

We propose the use of PAKE for achieving and enhancing entity authentication (EA) and key management (KM) in the context of decentralized end-to-end encrypted email and secure messaging, i.e., where neither a public key infrastructure nor trusted third parties are used. This approach not only simplifies the EA process by requiring users to share only a low-entropy secret, e.g., a memorable word, but it also allows us to establish a high-entropy secret key; this key enables a series of cryptographic enhancements and security properties, which are hard to achieve using out-of-band (OOB) authentication. We first study a few vulnerabilities in voice-based OOB authentication, in particular a combinatorial attack against lazy users, which we analyze in the context of a secure email solution. We then propose tackling public key authentication by solving the problem of "secure equality test" using PAKE, and discuss various protocols and their properties. This method enables the automation of important KM tasks (e.g. key renewal and future key pair authentications), reduces the impact of human errors, and lends itself to the asynchronous nature of email and modern messaging. It also provides cryptographic enhancements including multi-device synchronization and secure secret storage/retrieval, and paves the path for forward secrecy, deniability and post-quantum security. We also discuss the use of auditable PAKEs for mitigating a class of online guess and abort attacks in authentication protocols. To demonstrate the feasibility of our proposal, we present PakeMail, an implementation of the core idea, and discuss some of its cryptographic details, implemented features and efficiency aspects. We conclude with some design and security considerations, followed by future lines of work., Comment: arXiv admin note: substantial text overlap with arXiv:2005.10787

This paper presents a mobile application for vote-casting and vote-verification based on the Selene e-voting protocol and explains how it was developed and implemented using the User Experience Design process. The resulting interface was tested with 38 participants, and user experience data was collected via questionnaires and semi-structured interviews on user experience and perceived security. Results concerning the impact of displaying security mechanisms on UX were presented in a complementary paper. Here we expand on this analysis by studying the mental models revealed during the interviews and compare them with theoretical security notions. Finally, we propose a list of improvements for designs of future voting protocols., Comment: E-Vote-ID 2019 TalTech Proceedings

Selene is an e-voting protocol that allows voters to directly check their individual vote, in cleartext, in the final tally via a tracker system, while providing good coercion mitigation. This is in contrast to conventional, end-to-end verifiable schemes in which the voter verifies the presence of an encryption of her vote on the bulletin board. The Selene mechanism can be applied to many e-voting schemes, but here we present an application to the polling station context, resulting in a voter-verifiable electronic tally with a paper audit trail. The system uses a smartcard-based public key system to provide the individual verification and universal eligibility verifiability. The paper record contains an encrypted link to the voter's identity, requiring stronger assumptions on ballot privacy than normal paper voting, but with the benefit of providing good auditability and dispute resolution as well as supporting (comparison) risk limiting audits., Comment: E-Vote-ID 2018 TUT Proceedings

An important aspect of AI design and ethics is to create systems that reflect aggregate preferences of the society. To this end, the techniques of social choice theory are often utilized. We propose a new social choice function motivated by the PageRank algorithm. The function ranks voting options based on the Condorcet graph of pairwise comparisons. To this end, we transform the Condorcet graph into a Markov chain whose stationary distribution provides the scores of the options. We show how the values in the stationary distribution can be interpreted as quantified aggregate support for the voting options, to which the community of voters converges through an imaginary sequence of negotiating steps. Because of that, we suggest the name "convergence voting" for the new voting scheme, and "negotiated community support" for the resulting stationary allocation of scores. Our social choice function can be viewed as a consensus voting method, sitting somewhere between Copeland and Borda. On the one hand, it does not necessarily choose the Condorcet winner, as strong support from a part of the society can outweigh mediocre uniform support. On the other hand, the influence of unpopular candidates on the outcome is smaller than in the primary technique of consensus voting, i.e., the Borda count. We achieve that without having to introduce an ad hoc weighting that some other methods do.

The COVID-19 pandemic has influenced virtually all aspects of our lives. Across the world, countries have applied various mitigation strategies for the epidemic, based on social, political, and technological instruments. We postulate that one should {identify the relevant requirements} before committing to a particular mitigation strategy. One way to achieve it is through an overview of what is considered relevant by the general public, and referred to in the media. To this end, we have collected a number of news clips that mention the possible goals and requirements for a mitigation strategy. The snippets are sorted thematically into several categories, such as health-related goals, social and political impact, civil rights, ethical requirements, and so on. In a forthcoming companion paper, we will present a digest of the requirements, derived from the news clips, and a preliminary take on their formal specification.

The design and implementation of an e-voting system is a challenging task. Formal analysis can be of great help here. In particular, it can lead to a better understanding of how the voting system works, and what requirements on the system are relevant. In this paper, we propose that the state-of-art model checker Uppaal provides a good environment for modelling and preliminary verification of voting protocols. To illustrate this, we present an Uppaal model of Pr\^et \`a Voter, together with some natural extensions. We also show how to verify a variant of receipt-freeness, despite the severe limitations of the property specification language in the model checker.

As humanity struggles to contain the global COVID-19 pandemic, privacy concerns are emerging regarding confinement, tracing and testing. The scientific debate concerning privacy of the COVID-19 tracing efforts has been intense, especially focusing on the choice between centralised and decentralised tracing apps. The privacy concerns regarding COVID-19 testing, however, have not received as much attention even though the privacy at stake is arguably even higher. COVID-19 tests require the collection of samples. Those samples possibly contain viral material but inevitably also human DNA. Patient DNA is not necessary for the test but it is technically impossible to avoid collecting it. The unlawful preservation, or misuse, of such samples at a massive scale may hence disclose patient DNA information with far-reaching privacy consequences. Inspired by the cryptographic concept of "Indistinguishability under Chosen Plaintext Attack", this paper poses the blueprint of novel types of tests allowing to detect viral presence without leaving persisting traces of the patient's DNA. Authors are listed in alphabetical order., Comment: 10 pages, 1 figure

Many voter-verifiable, coercion-resistant schemes have been proposed, but even the most carefully designed systems necessarily leak information via the announced result. In corner cases, this may be problematic. For example, if all the votes go to one candidate then all vote privacy evaporates. The mere possibility of candidates getting no or few votes could have implications for security in practice: if a coercer demands that a voter cast a vote for such an unpopular candidate, then the voter may feel obliged to obey, even if she is confident that the voting system satisfies the standard coercion resistance definitions. With complex ballots, there may also be a danger of "Italian" style (aka "signature") attacks: the coercer demands the voter cast a ballot with a specific, identifying pattern. Here we propose an approach to tallying end-to-end verifiable schemes that avoids revealing all the votes but still achieves whatever confidence level in the announced result is desired. Now a coerced voter can claim that the required vote must be amongst those that remained shrouded. Our approach is based on the well-established notion of Risk-Limiting Audits, but here applied to the tally rather than to the audit. We show that this approach counters coercion threats arising in extreme tallies and "Italian" attacks. We illustrate our approach by applying it to the Selene scheme, and we extend the approach to Risk-Limiting Verification, where not all vote trackers are revealed, thereby enhancing the coercion mitigation properties of Selene.

Use of persistent identifiers in wireless communication protocols is a known privacy concern as they can be used to track the location of mobile devices. Furthermore, inherent structure in the assignment of hardware identifiers as well as upper-layer network protocol data attributes can leak additional device information. We introduce SEXTANT, a computational framework that combines improvements on previously published device identification techniques with novel spatio-temporal correlation algorithms to perform multi-protocol entity resolution, enabling large-scale tracking of mobile devices across protocol domains. Experiments using simulated data representing Las Vegas residents and visitors over a 30-day period, consisting of about 300,000 multi-protocol mobile devices generating over 200 million sensor observations, demonstrate SEXTANT's ability to perform effectively at scale while being robust to data heterogeneity, sparsity, and noise, highlighting the urgent need for the adoption of new standards to protect the privacy of mobile device users., Comment: 21 pages, 10 figures