Security in electronic voting Advanced Cryptography and Ballot Secrecy
The cryptographic architecture protects each individual vote and separates the voter's choice from their identity, both from EVoting and the organiser.
Ballot secrecy by mathematical design
Unlike systems that rely solely on access policies, EVoting protects ballot secrecy through its cryptographic architecture and auditable operational controls.
Homomorphic encryption: votes counted without decrypting
Each vote is encrypted on the voter's device before being sent. The tally operates directly on encrypted votes.
- Encryption at source: the voter's preference is encrypted on their own device; it never travels in plain text over the network.
- Encrypted tally: the system tallies and processes encrypted votes without decrypting them individually, thanks to homomorphic encryption.
- Only the result is decrypted: only the consolidated total is decrypted at the end, through a formal key-opening ceremony.
Key ceremony: opening under third-party custody
Decrypting the final result requires the concurrence of multiple keys, held by independent custodians.
- Distributed keys: the decryption key is split among the election tribunal, the designated auditor and (optionally) the organisation.
- No unilateral opening: neither EVoting nor the organiser can open the votes alone; the custodians must concur.
- Transparency and traceability: the ceremony is recorded and auditable, guaranteeing the opening process was correct.
Ballot secrecy is protected by design
Four cryptographic properties that back it up.
Identity-choice separation
The system architecture avoids recording a voter's identity together with their choice.
Source encryption
The preference is encrypted on the voter's device before being sent to the server.
Distributed custody
Decryption keys are held by independent custodians chosen by the organiser.
Verifiability
The system is auditable: anyone can verify that votes were counted correctly without revealing individual preferences.