The Public Voting Process
Votes by citizens are secret and tallied without record of which voter
voted for whom. Voting can be performed remotely by personal
computer, and the link between a remote computer and the voting
machine must be encrypted to prevent eavesdropping. If before
completion of stage 8 (described below), one minute of idle time
elapses without the voting machine receiving a message from the voter,
the voter's authoritative record for that ballot item is cleared, the
session ends, and the voter can begin his vote on that item again. To
vote, a voter engages in a session as follows, with stages identified
in parentheses preceding the description of the stage.
Upon establishment of an encrypted connection to the voting machine
(the same encrypted connection can be used for multiple sessions), the
session begins with (1) the voter providing his ostensible identity to
the voting machine, (2) the voting machine producing a cryptographic
challenge, and (3) the voter proving his identity by solving the
challenge. The session ends if the solution is incorrect.
The voter then (4) specifies what
poll item he intends to vote on, and (5a) the machine then verifies
the voter's eligibility to vote on that poll item, by accessing a
coherent authoritative database (voting on the item must be open, the
individual's record with respect to that poll item must not be
locked, the voter must be properly registered with no current
disqualifying legal handicaps, and must not have already finalized a
vote on the item). If eligibility is confirmed, then (5b) the
individual's record with respect to that poll item is locked for the
duration of the session and (5c) the voter is informed of his
eligibility, else the session ends.
If the poll item at issue is a vote for a legislator, the voter has
previously cast a vote for a legislator in the same unit of state, and
that vote has not yet expired, then (5d) the voter must provide the
voting machine with the receipt received at stage 9e in the course of
casting that previous vote. (5e) The voting machine verifies the
encoding and signatures of the 5d receipt, if any, and verifies that
the 5d receipt, if any, has not previously been submitted to effect
vote revocation. If verification fails, the session ends, otherwise
it continues. In either case, (5f) the voter is informed of the
results of his 5d submission, if any.
Next, (6a) the voter completes the specified poll item (specifies his
voting position on one item in the poll), (6b) computes a digest of
the completed poll item, (6c) computes an encryption of that digest
with a random symetric key of his choice, and (6d) computes a
decryption of that digest encryption using his private key using an
algorithm with which decryption can be safely used to generate a
(6e) The voter provides the voting machine with the completed poll
item, the above random symmetric key, and the fully processed digest
(the assymetric decryption of the symmetric encryption of the digest
of the completed poll item). The voting machine verifies the
validity and consistency of the data. Validity is determined by (7a)
confirmation that the name given for the item unambiguously identifies
a candidate, or the response given for a non-election item is a valid
response. Consistency is determined by (7b) confirmation that the
cryptographic relationships among the data are mathematically valid.
If the poll item as completed is not valid, or the consistency check
fails, the voter's authoritative record for that poll item is cleared,
this session ends, and the voter can begin his vote on that item
again. (7c) The voter is alerted to each invalid name in the previous
completed poll item (if any), and is alerted to each ambiguous name
(if any) as described above.
If validity and consistency are verified, the voting machine (7d)
generates a string with a random portion, a timestamp portion, a
portion identifying the precise poll item completed above (but not
including any information about how the poll item was completed),
and a portion fully identifying the individual, and (7e) demands that
the individual sign this with his private key. If (8) the individual
properly signs this string and forwards the signature to the machine,
then (9a) the signed string is archived by the machine and (9b) the
authoritative database is notified that the individual has completed
his vote on that particular item and cannot vote on it again, or if
the item is a vote for a legislator, the authoritative database is
provided with the receipt from stage 5d, if any.
Next, (9c) the voting machine computes an encryption of the above
random symmetric key using the individual's public key, and (9d)
produces a cryptographically verifiable receipt consisting of a
machine-signed record consisting of the completed poll item, the
above fully processed digest, the above timestamp, and the above
assymetric encryption of the symmetric key. (9e) This receipt is
delivered to the voter, and the session ends. With this receipt, the
individual can prove that he cast a vote on this particular item and
how it was cast.
The machine then (10) irreversibly discards its copy of the stage 6c
random key and archives a record consisting of the stage 6a completed
poll item and the associated stage 6d fully processed digest. The
individual (11) archives a copy of the stage 9d receipt.
When voting closes, all stage 10 item-digest pairs, and all stage 8
signed strings, are made anonymously and immediately available to the
public at large. For a particular item, the number of counted and
published stage 10 item-digest pairs must precisely equal the number
of stage 8 signed strings.
An individual can verify that his vote was registered correctly by
retrieving the completed poll item which has associated with it a
fully processed digest that matches his archived fully processed
digest (included in the receipt). The stage 6c symmetric key is
recovered by decrypting the stage 9c encryption of it found in the
receipt. Using the recovered stage 6c key, the voter ascertains
whether the published completed poll item matches. The individual
can prove that his vote was fraudulently registered by producing the
receipt the voting machine gave him, and showing that the fully
processed digest for which he was given a receipt was not published,
or that the completed poll item accompanying the fully processed
digest does not match the fully processed digest, in which case he
must provide the recovered stage 6c key.
Votes cannot be tallied or published until after the voting period has
ended, and must be tallied and published within 24 hours of the close
If within one week following closing of a vote, more than 1% of voters
eligible to vote on an item demonstrate fraud in the vote on that
item, then the entire vote on that item is repeated.
previous section "Voting Procedures"
next section "Competency of State Employees"
back to index for this chapter ("General Principles of State")
back to top-level index
Send email to me at email@example.com
This is a preliminary draft. Pending changes are in The To-Do List