Bingo voting
Bingo voting is an scheme for transparent, secure, elections. It was introduced in 2007 by Jens-Matthias Bohli, Jörn Müller-Quade, and Stefan Röhrich at the Institute of Cryptography and Security (IKS) of the (KIT).
Random numbers are used to record votes. Central to the scheme is the use of trusted devices in the alongside the . Also crucial are its paper receipts which, while not revealing how a vote was cast, and so inhibiting and , still allow voters to check that their vote was correctly counted.
The scheme allows the correctness of an election result to be verifiably proved relying only on the integrity of the in-booth random number generators (hence “trusted”); the proof of correctness does not rely on, still less need to prove, the integrity of the themselves.
Contents
Before the poll
Before the election, a pool of “dummy votes”, random numbers, is generated. As many numbers are generated for each candidate as there are voters. Each dummy vote is encrypted using a cryptographic —akin to placing the dummy votes in “sealed envelopes.” A list of all commitments (encrypted dummy votes) is then published along with a proof that dummy votes are equally distributed to all candidates.
Additional “candidates” can be defined to support , “” votes, etc.
During the poll
In the a voter chooses his or her preferred candidate by pressing the corresponding button. A random number generating device in the booth then generates a fresh random number, displays it, and passes it to the voting machine, which allocates it to the selected candidate. For all other candidates the voting machine randomly selects one of the candidate’s dummy votes from the dummy vote pool. A dummy vote is used only once. A ballot, then, consists of a random number for each candidate.
The voting machine issues the voter with a printed receipt listing the candidates and their assigned random numbers. So, before leaving the booth, the voter can check that the vote was correctly recorded by comparing the chosen candidate’s number on the receipt with the number displayed by the random number generator.
The receipt does not show how the voter voted because the non-dummy random number issued in the voting booth is indistinguishable from the dummy votes drawn from the pool. The dummy votes in the pool remain hidden (in “unopened” commitments).
After the poll
After the polls close all ballots are published in a sorted list (they could be published during the vote, in real-time