Cryptology firm cancels elections after losing encryption key

The firm, considered one of the world's leading experts in encryption, has canceled the announcement of its leadership election results after an official lost the encrypted key needed to unlock them.

International Association for Cryptological Research (IACR) uses an electronic voting system that requires three participants to access the results, each of whom has part of the encrypted key.

In the statement The scientific organization said one of the trustees lost his key as a result of “an honest but unfortunate human error”, making it impossible to decipher and disclose the final results.

The IACR said it would re-run the election with “new safeguards” to prevent similar mistakes from happening again.

IACR is a global non-profit organization founded in 1982 with the goal of “furthering research” in the field of cryptology, the science of secure communications.

Voting opened for three director positions and four officer positions on October 17, and the process closed on November 16.

The association used an open source electronic voting system called Helios for the process.

The browser system uses cryptography to encrypt votes or keep them secret.

Three members of the association were chosen as independent trustees, each of whom was given a third of the encrypted material, which, when used together, would render a verdict.

While two of the trustees uploaded their share of the encrypted material to the Internet, the third one never did it.

In a statement, IACR said the lack of results was due to one of the trustees “irretrievably” losing his private key, making it “technically impossible” for the firm to know the final verdict.

It said it was therefore left with no choice but to cancel the elections.

The association added that it “deeply regrets” the error, which it takes “very seriously”.

American cryptographer Bruce Schneier told the BBC that the problem with cryptographic systems is that they must be “managed by people” to be truly secure.

“Whether you forget keys, share keys incorrectly, or make some other mistake,” he said, “cryptographic systems often fail for very human reasons.”

Voting for IACR positions has resumed and will continue until December 20th.

The association said it has replaced the original trustee who lost encrypted information and will now adopt a “2 of 3” threshold mechanism for managing private keys, with a clear written procedure for trustees to follow.