Private electronic voting

The cryptographic construction behind the voting research is not my design. It is the work of the researcher I collaborate with on that track, and the credit for it belongs there. This site documents joint research and supports that work; it does not claim authorship of the cryptography.

That distinction is worth stating first rather than in a footnote. The cryptography here is difficult, it took someone else years of study to reach, and a page that stayed silent about authorship would be taking credit by omission.

What this site adds is the systems reading of that work: what an election built on such a construction would demand of the people running it, what has to be published for the result to be checkable, and where the engineering stops being a cryptographic question and becomes an operational one.

Electronic voting asks for two properties that pull in opposite directions: only eligible voters may vote, and no one may learn how anyone voted.

Add a third requirement, that anyone should be able to verify the result, and the naive designs collapse. A register that proves eligibility also links a person to a ballot. A ballot box that hides the link also hides whether the count is honest.

The interesting adversary is not an outsider. It is the operator of the system, or someone able to compel the operator afterwards.

• Honest-but-curious operator
• Coerced operator
• Colluding authorities
• Network observer
• Voter under coercion
• Retrospective de-anonymisation

Ballot secrecy has to hold against the party running the election, and it has to still hold in ten years.

A system that only hides the vote from other voters is not private. The design target is that the correlation between an identity and a ballot does not exist anywhere in the system, rather than being stored and protected.

Proving membership of the eligible set without revealing which member.

The voter demonstrates that they belong to a published set of eligible voters. The proof convinces a verifier of membership and of nothing else, which is exactly the property a membership proof provides.

Two ballots from the same eligible set must not be attributable to the same voter, and a ballot must not be attributable to the credential that produced it.

Duplicate participation still has to be prevented, which is why the interesting primitives are those able to detect a second use of a credential without identifying its holder.

• Ballot secrecy
• Credential unlinkability
• Duplicate participation prevention
• No coercion evidence

Individual verifiability: a voter can check that their ballot was counted. Universal verifiability: anyone can check that the tally follows from the recorded ballots. Both without opening a single ballot.

The research surveys constructions that provide anonymous membership proofs, commitments and verifiable tallying, and studies how they compose into an election with an auditable transcript.

The output of this track is written analysis and open questions, not an implementation claim.

• Membership proofs
• Commitments
• Nullifiers
• Verifiable tallying
• Public transcripts

Studied as a cryptographic construction. Not a voting protocol.

FCMP++ is examined for what it offers as a primitive: proving membership in a large set with strong privacy properties and practical proof sizes. The question under study is whether that primitive maps cleanly onto voter eligibility, and where it does not.

No claim is made that FCMP++ was designed for voting, nor that any of this constitutes a security analysis of it.

Kept open on purpose.

• Coercion resistance in remote settings
• Credential issuance without a trusted issuer
• Revocation of eligibility mid-election
• Verifiability for a non-technical voter
• Cost of a public transcript at national scale

Notes are published as they are written, with their date and their references. Nothing is published as settled while it is still being studied.