How do voters verify a Helios (v3) election result?

Question

So from my understanding of verification specification version 3, a Helios election proceeds as follows:

1. A voter retrieves the system's public key to encrypt their vote & submit it. The voter gets a fingerprint representing their vote.
2. When the election period is over, a list of all names & their fingerprints are made public so that an individual voter can see that their vote is in the list correctly
3. Using the homomorphic properties of the encryption algorithm, all votes are summed
4. A couple of key people are selected to watch as the private key is used to decrypt only the final summed result, proving that it was done with all votes counted correctly

Questions:

1. How does an average voter know that his vote actually counted? He doesn't have any way of performing the summation and obtaining the private key to decrypt.

2. If at the end of the election the private key is made public, then is knowing the list of fingerprints alone enough to calculate the result themselves? I assume no, otherwise individual votes would be known after the fact.

3. How does the summation process prevent someone from submitting a value outside the range of allowed values, unless they decrypt each individual result... which I thought was the whole point of the homomorphic encryption to not do that?

Answer 1

1. How does an average voter know that his vote actually counted? He doesn't have any way of performing the summation and obtaining the private key to decrypt.

This is not actually true. He does have a way of performing the summation. From the spec, "all captured votes are displayed (in encrypted form) for all to see". Given the encrypted votes, you can do the summation. The summation is deterministic, so the homomorphic tally that you come up with in your audit, should be the same tally that each of the trustees comes up with. So when the trustees publish their partial decryption of the summation (the decryption factors), the decryption proofs, and the proof of knowledge of the private key, you can verify that they indeed know the private key, verify that the decryption factors are correct (given the tally you computed using all the encrypted votes). Do this for all trustees and you know all decryption factors are correct. Given all the decryption factors, you can decrypt the summation. At this point, you know that the decryption factors match the tally you computed, and you have used those to get the plaintext of the summation. You still need to make sure that your vote is in the list.

There are still a number of other things you need to do to really verify everything. See Verifying a Complete Election Tally for the complete information.

2. If at the end of the election the private key is made public, then is knowing the list of fingerprints alone enough to calculate the result themselves? I assume no, otherwise individual votes would be known after the fact.

According to the spec:

When a voter generates a ballot, Helios provides the ballot fingerprint, which is the base64-encoding of the SHA256 hash of the data structure defined above.

Since it is just a SHA256 hash, even having the private key will not allow an attacker to compromise the privacy of votes given only the fingerprints. They would have to have the <VOTE> data structure.

3. How does the summation process prevent someone from submitting a value outside the range of allowed values, unless they decrypt each individual result... which I thought was the whole point of the homomorphic encryption to not do that?

The documentation you link to describes how this is done at a high level.

A zero-knowledge proof, denoted , is a transcript of a non-interactive proof that the corresponding ciphertext encodes an integer value between 0 and max. For the overall proof, the ciphertext whose value is being proven to be between 0 and max is the homomorphic sum (element-wise product) of the choices ciphertexts.

I'm sure they specify exactly how the zero-knowledge proofs work somewhere.