Here is a draft architecture for a privacy-preserving online voting system designed for non-governmental, high-risk scenarios (e.g., civic consultations, diaspora voting, or opposition primaries).
The goal is to determine the theoretical and practical limits of security for a fully online deployment under a hostile threat model.
Core Architecture Goals: Strict one-person-one-vote enforcement
- Full ballot secrecy and anonymous participation
- End-to-end verifiability and public auditability
- Zero single points of trust
- Resilience against partial or total
- infrastructure compromise
The system must simultaneously protect vote integrity and participation privacy; a failure in either invalidates the protocol.
Beyond testing cryptographic strength, the design focuses on minimizing data reconstruction in the event of an operational breach.
Areas for Feedback & Technical Review Looking for input from experts in #cryptography, distributed systems, #privacy engineering, and election tech on these specific challenges:
- Eligibility Proofs: Methods for verifying voters while minimizing identity collection.
- Sybil/Duplicate Prevention: Techniques to prevent double-voting without creating recoverable identity-to-ballot mappings.
- Metadata Leakage: Common operational blind spots (e.g., CDNs, timing attacks, logs, backup persistence).
- Failure Domains: Identifying fundamental theoretical limits versus solvable engineering trade-offs.
Seeking technical criticism, threat model stress-testing, and design reviews on where the architectural hard limits lie