Sacred Vote
Sacred Vote: voting you can actually verify
A voting platform built on the premise that a result nobody can check is not a result.
Secrecy and verifiability pull against each other: a voter must be able to confirm their ballot was counted, without ever being able to prove to anyone else how they voted.
Why that tension is the whole problem
If a voter can prove how they voted, their vote can be bought or coerced — so a receipt is not a feature, it is a vulnerability. But if they cannot check anything at all, they are asked to trust the people running the election. Verifiable voting schemes exist to give the first guarantee without giving up the second.
What a voter can check
- The ballot is on the record Every vote is hashed into an append-only chain and published at a public address. The board is the same bytes for everyone who asks for it.
- Checking it does not tell the site who you are The browser fetches a published root and an inclusion proof — both public data, identical for every caller — and folds them locally. The server is never asked to look up one voter's ballot, so it cannot learn which check was yours.
- The site cannot fake the answer The root the browser computes has to match both the proof's own root and a root published separately. A server that lies has to lie consistently in two places a reader can fetch independently.
A second layer implements the Belenios election lifecycle in full — trustee keys, encrypted ballots, a homomorphic tally and a decryption proof. It is written and wired in, and it is switched off: it runs only for polls at a higher security tier than any poll now on the site, which today store a ballot as a plain option index. Building on a reviewed scheme rather than inventing one is the whole point — cryptography nobody else has attacked is not yet known to be strong.
Built on
- Belenios: verifiable online voting The scheme this work extends, from Inria.