Hackathon
Encrypted Local Tally Integrity
A protocol and reproducible artifact for federated elections in which each authority publishes an encrypted local tally and the aggregation stays verifiable on-chain.
In a federated election the ballots are already secret and already counted locally. What is left unguarded is the step where someone collects every local tally and announces the total. This protocol removes the need to trust that step without publishing a single local result.
- Origin
- Cryptography track, De Cifris × XRPL Commons hackathon 2024
- Role
- First author, with Lorenzo Camilli and Raffaele Ruggeri
- Stack
- Solidity · Circom · Groth16 · ElGamal
- Repository
- VincenzoImp/encrypted-local-tally-integrity
The manuscript is submitted to Koine and has not been peer reviewed. The artifact establishes the protocol’s stated aggregation guarantees; it is not a deployed voting system.
The problem
The hackathon track posed a federated-election scenario, and the trust gap in it is specific: local committees already keep ballots secret and already count their own votes, but a central actor still collects the tallies and announces the result. That actor can omit an authority, replace a tally, or simply be believed without evidence.
Publishing the local tallies in cleartext closes the gap and opens two others. Anyone can watch partial results accumulate before the election closes, and a small locality’s result stays attributable to that locality forever, which is a retaliation risk rather than a privacy abstraction. Commit-and-reveal only postpones both.
So the requirement we took was stronger than a public bulletin board: local tallies must stay confidential even after the election, and the global result must still be derivable from the full set of them.
What I built
Four roles, and the contract is only one of them. An owner initialises the election and the authority registry. Each local authority tallies off-chain and submits one encrypted tally vector. The smart contract is the bulletin board and the proof gate: it verifies, records one submission per registered authority, and maintains the homomorphic aggregate. A set of trustees performs threshold decryption of that aggregate, once, at the end.
A submission is three things travelling together: the encrypted tally vector, a Groth16 proof that the hidden tally is well formed and sums to the authority’s publicly known electorate size, and a signature binding the submission to the election transcript. Trustee setup and the opening transcript are proof-checked separately, so the final decryption cannot be quietly performed by a different key set than the one registered.
The artifact in artifact/ is the whole thing running: three Circom circuits – tally validity,
trustee-set consistency, and partial-decryption validity – their Groth16 verifiers, the
ZKLocalTallyIntegrity contract, an ElGamal implementation, and a deterministic replay that
runs a two-candidate election across three authorities with 2-of-3 threshold opening and diffs
the result against a checked-in expected output.
Hard parts
A hidden number still has to be a plausible number. Encrypting the tally removes the reviewer’s ability to sanity-check it, which is exactly what a malicious authority would want: negative entries, oversized entries, or a vector that does not sum to anything real. The tally circuit exists to restore that check without decryption: it proves the vector is well formed and sums to the electorate size the contract already knows. The cost is that every submission now carries proof generation, and the electorate sizes have to be public.
Deciding what happens when an authority never submits. A protocol that aggregates whatever arrived is a protocol where omission is a strategy. The finalisation rule cancels an incomplete election rather than publishing a partial total, which trades liveness for integrity: one missing authority stops the result, and that is the deliberate choice.
Keeping the guarantee narrower than the word “verifiable”. What is proved is that the submitted tally is well formed, not that it is the true local tally. A fully corrupted local committee is outside the model, and saying so is what makes the rest of the claim usable.
Drawing the boundary around key generation. The artifact uses a dealer-generated threshold key rather than distributed key generation, and decodes the final tally off-chain through bounded discrete-log recovery. Voter authentication and coercion resistance sit outside the protocol, so its guarantee is confined to the aggregation step.