For educational reasons I am implementing an e-voting platform. The idea is that the voter generates the ballot on client side, the ballot is verified using a zero-knowledge proof protocol. Also, the voter encrypts the the ballot before to send it to the server.

The server can sum all the encrypted ballots, using an homomorphic encryption scheme, and decrypt the results.

The problem of this idea is that if the server owns the private key, it is possible to decrypt the single ballot, violating the secrecy of the vote.

Is it possible to define a protocol where it is possible to decrypt the sum of the votes but not the single vote?

  • 1
    $\begingroup$ I don't know the answer of your question but for e-voting you may want to check Secure Multiparty Computation (MPC) concept. There are many e-voting schemes in this context and I think it is more suitable than homomorphic encryption. $\endgroup$
    – NB_1907
    Commented Apr 30 at 21:59
  • $\begingroup$ This is something to evaluate, maybe is the best solution anyway for the purposes of my project this not the best alternative I suppose it requires a lot of effort to implement it. I keep it into account for the future, an idea can be an user-friendly library to implement is some programming language. $\endgroup$
    – g3k0
    Commented May 1 at 11:49

1 Answer 1


I think there's something called Threshold Homomorphic Encryption.

The decryption key is split into multiple shares, and a certain threshold of shares is required to decrypt the result. The shares are distributed among multiple parties (e.g. election authorities), and no single party has enough shares to decrypt the result on their own.

So generally speaking your voting system could work like this:

  1. Key Generation:

    • Generate a public key and a set of private key shares using a Threshold Homomorphic Encryption scheme.
    • Distribute the private key shares among multiple trusted parties (e.g., election authorities).
  2. Voting:

    • The voter generates the ballot on the client-side and encrypts it using the public key.
    • The encrypted ballot is sent to the server along with a zero-knowledge proof to verify its validity.
  3. Aggregation:

    • The server collects all the encrypted ballots and uses the homomorphic property of the encryption scheme to compute the sum of the encrypted votes.
  4. Decryption:

    • To decrypt the sum of the votes, a threshold number of trusted parties (election authorities) need to come together and use their private key shares.
    • The trusted parties perform a distributed decryption protocol, where they combine their shares to decrypt the sum of the votes without revealing the individual votes.

About the server:

  • The server can compute the sum of the encrypted votes without being able to decrypt individual votes.
  • Decryption of the election result requires the cooperation of a threshold number of trusted parties, preventing any single party from decrypting the result on their own.

Here are the schemes I was able to find online you could use on your project:

  • Threshold Paillier Cryptosystem
  • Threshold ElGamal Cryptosystem
  • Threshold BFV Scheme (for fully homomorphic encryption)
  • $\begingroup$ Thank you this is an interesting solution. Of course one election aouthority should never be able to know the share of another election authority and at the same time cooperate to decrypt the results. Another sensible point is to implement a zk-proof that verifies not only if a ballot is formally correct but also if it is really used to produce the encrypted ballot. $\endgroup$
    – g3k0
    Commented May 1 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.