Tallying encrypted ballots

Encrypt every ballot, combine the ciphertexts, decrypt only the total. Paillier does it with factoring; an LWE scheme does it with noise.

n = p·q = 17 · 19 = 323g = n + 1 = 324public: (n, g) · private: λ = 144

VoterBallot

Aysel

Babək

Cavid

Dilarə

Elvin

Fidan

Günay

Hikmət

Ballot box

C = ∏ cᵢ mod n²—

L(C^λ mod n²) · μ mod n—

1 / 4

Click a ballot to change a vote. Nobody but the voter knows these choices.

What to notice

No single ballot is ever decrypted: the authority only sees the final sum.
Paillier ciphertexts multiply to add the votes. Its security rests on factoring n, which Shor's algorithm breaks.
In the LWE scheme every ciphertext carries a little noise, and adding ciphertexts adds the noise. Too many votes, or too much noise, and the tally decrypts wrong. Schemes like BFV choose parameters so that this never happens.