Security and verifiability
Where your vote is encrypted, what the server can and cannot read, and what can actually be proven when someone disputes the result.
This is not "cheating is impossible". It is "cheating gets caught".
A system that claims nothing can ever go wrong is asking for your trust in a different costume. What this system offers is narrower and more useful: every claim that matters can be checked by someone who does not have to take our word for anything — including you, including a losing candidate, including a court-appointed expert.
Everything below is written so that a technical advisor can verify it independently, and so that a non-technical reader can see what is being claimed and what is not.
Your vote is sealed before it leaves your device
The ballot is encrypted in your own browser. What travels to the server is already unreadable — the plain choice never reaches the network.
How the browser does it
Your browser derives a shared secret with the election key (ECDH on curve P-256), stretches it with HKDF, and encrypts the ballot with AES-256-GCM. All of it comes from WebCrypto, the cryptography built into the browser itself.
How the server does it
On the server the same primitives come from libsodium, which ships inside PHP: X25519 key exchange with XSalsa20-Poly1305 sealing, SHA-256 for every published fingerprint, and the operating system CSPRNG for randomness.
What is deliberately absent
No cryptography library is downloaded from a CDN. No external service is called. No algorithm was designed by us. The only protocol code we wrote is Shamir secret sharing, a published scheme from 1979, and it is covered by its own test suite.
The two implementations are checked against each other
An automated test feeds the same input to the browser cryptography and the server cryptography and compares the output byte for byte. If the two ever disagreed, the build would fail rather than silently produce ballots nobody can open.
What this costs you
Voting requires JavaScript. There is no way to encrypt something on your device without running code on your device, and we would rather state this limit than send your choice to a server in the clear and call it secure.
The identity list and the ballot box are not connected
This is not a promise about how we behave. It is a constraint in the database itself: there is no foreign key, and no column, linking a voter to a ballot. A single query joining the two does not exist to be run.
| Who is eligible to vote | Stored, and published as a frozen list with a fingerprint so nobody can add names later. |
| Which ballot you cast | Not stored in any form that can be traced back to you. The ballot carries a credential reference, never a voter identity. |
| Your IP address | Kept only as an HMAC fingerprint with an election-specific secret, never in the clear. |
| The contents of your ballot | Sealed. The server cannot open it, because the server does not hold the key that opens it. |
The key that opens the result does not exist in one piece
When the election is created, the private key is split with Shamir secret sharing into three shares. Any two of them can open the result; any one of them reveals nothing at all.
The shares are displayed once, at the moment the election is created, and are never written to the server. They are handed to three different people through three different channels.
This is why an interim result cannot leak while voting is open. It is not a screen we chose not to build — there is no key on the server with which to compute one.
At the count, the key is reassembled in memory, used once, and wiped from memory immediately afterwards.
What can actually be proven, and by whom
This is the part that matters in a real disagreement. Each row is a claim someone might make, the evidence that answers it, and the person who can check that evidence without needing access to our servers.
| The claim | The evidence that answers it | Who can check it |
|---|---|---|
| My vote was not counted | Search your tracking code on the public board. If it is there, your ballot is in the box. | The voter |
| The result was altered | Download the ballots from the board and recount them yourself. | Anyone |
| I never voted, but I am shown as having voted | The published voter roll next to the published turnout list. | Voters and observers |
| The box was touched after closing | The ballot-box fingerprint published at the moment of closing. | Anyone |
| The result leaked while voting was still open | The decryption key was never whole in any one place, and the key ceremony is minuted. | The key holders |
| The software was changed quietly during the election | The published version and source-code hash, frozen when the election was created. | A technical auditor |
Three things, and the middle one is the load-bearing wall
-
The board is published as votes arrive
Every ballot appears on the public board with its tracking code at the moment it is cast. A list produced after the fact proves nothing, because it could have been produced to order.
-
An outside witness holds the fingerprint
The board fingerprint is sent at regular intervals to places the operator does not control: observers by e-mail, copies to candidates, an external timestamping service. This is the single thing that turns "trust us" into "if we cheat, we are caught". Without it, an operator with full control of the server could rewrite everything before anyone looked, and no internal record would betray it.
-
The event log is chained
Every entry carries the hash of the entry before it. Inserting, removing or altering one record breaks every record that follows, which is exactly the property a tamper attempt cannot route around.
What this system cannot prove
A voting system earns trust by being precise about where its guarantees stop. These are ours.
Stated plainly, before anyone has to discover them
- At the default assurance level the operator is technically close to the ballot at the moment it arrives. Secrecy here rests on key separation and operational discipline, not on mathematics. A party who wishes to trust the operator with nothing at all needs the homomorphic level, where ballots are counted without ever being opened.
- Whoever distributes the tokens by hand can link identity to ballot. No software can fix this; separating the role fixes it. When the system e-mails the tokens itself, the pairing exists only in memory during sending and nobody — including us — ever sees it.
- Verification only works if people actually look. A board nobody reads proves nothing, which is why a rehearsal election where every voter finds their own tracking code is a required step, not a nice extra.
- You can prove your ballot was recorded and was not altered. What you cannot prove by mathematics alone is that the code in your browser sealed the candidate you picked — a malicious server could serve you broken JavaScript. A strict content security policy reduces this; it does not end it.
- In a small electorate a unanimous outcome reveals how everyone voted. That is arithmetic, not a flaw, and no system can prevent it. It belongs in the election rules.
Not our own scoring system
The design is mapped clause by clause against two external standards, including the clauses it does not fully meet.
Council of Europe CM/Rec(2017)5
The European recommendation on standards for e-voting. Universal, equal, free and secret suffrage; roll integrity; individual and universal verifiability; transparency; observation; accountability; auditability. Met in full except for three clauses we name: voting needs JavaScript, there is no automatic failover, and cast-as-intended is not mathematical.
OWASP ASVS v4
The application security verification standard: authentication, session management, access control, cryptography at rest and in transit, error handling and logging. Two controls are deliberately not implemented, and the reasons are written down rather than left blank.
Compared, not claimed
The design is also compared against BSI PP-0037 and the Swiss VEleS ordinance to place it honestly on the spectrum. We do not claim certification under either.
You do not need an account, and you do not need us
Every election publishes an evidence package: the board, the event log, the minutes, the result and a verification script.
The verifier is written in Python 3 using nothing but the standard library. It shares no code with this application, so running it is an independent recount rather than asking the system whether it agrees with itself.
The board, the candidate list, the rules, the evidence package and the dispute form are all reachable without signing in. An observer needs no credentials, because a system that decides who is allowed to observe is not being observed.