Bingo voting is an electronic voting scheme for transparent, secure, end-to-end auditable elections. It was introduced in 2007 by Jens-Matthias Bohli, Jörn Müller-Quade, and Stefan Röhrich at the Institute of Cryptography and Security (IKS) of the Karlsruhe Institute of Technology (KIT).
Random numbers are used to record votes. Central to the scheme is the use of trusted random number generating devices in the voting booths alongside the electronic voting machines. Also crucial are its paper receipts which, while not revealing how a vote was cast, and so inhibiting vote buying and intimidation, still allow voters to check that their vote was correctly counted.
The scheme allows the correctness of an election result to be verifiably proved relying only on the integrity of the in-booth random number generators (hence "trusted"); the proof of correctness does not rely on, still less need to prove, the integrity of the electronic voting machines themselves.
Before the poll
Before the election, a pool of "dummy votes", random numbers, is generated. As many numbers are generated for each candidate as there are voters. Each dummy vote is encrypted using a cryptographic commitment scheme—akin to placing the dummy votes in "sealed envelopes." A list of all commitments (encrypted dummy votes) is then published along with a proof that dummy votes are equally distributed to all candidates.
During the poll
In the voting booth a voter chooses his or her preferred candidate by pressing the corresponding voting machine button. A random number generating device in the booth then generates a fresh random number, displays it, and passes it to the voting machine, which allocates it to the selected candidate. For all other candidates the voting machine randomly selects one of the candidate's dummy votes from the dummy vote pool. A dummy vote is used only once. A ballot, then, consists of a random number for each candidate.
The voting machine issues the voter with a printed receipt listing the candidates and their assigned random numbers. So, before leaving the booth, the voter can check that the vote was correctly recorded by comparing the chosen candidate's number on the receipt with the number displayed by the random number generator.
The receipt does not show how the voter voted because the non-dummy random number issued in the voting booth is indistinguishable from the dummy votes drawn from the pool. The dummy votes in the pool remain hidden (in "unopened" commitments).
After the poll
After the polls close all ballots are published in a sorted list (they could be published during the vote, in real-time