Anonymous ballot

anonymous_ballet.md

Anonymous ballot

The goal is to allow a user to anonymously share sensitive information which can be used in a selection process. The user must be able to prove they were admitted without revealing their sensitive information. A two-step ring signature process meets these requirements.

Ring signature

Consider a group of n users where each user i has a public, P_i, and secret (private) key, S_i. A ring signature allows a user to sign a message using their private key, s = sign(m, S_i, P₁, ..., P_n), proving that they are a member of the group without revealing their identity.

Approach

A user i submits their public information (e.g., their name and e-mail address) along with a public key, P_i, while holding their private key, S_i, secret.

After all users have registered the set of public keys, P₁, ..., P_n, is made public. Each user can now submit their sensitive information, along with a signed message proving that they have registered, s_i = sign('is_registered', S_i, P₁, ..., P_n). The signature must not be shared with other users.

After the ballot has been performed, the user can submit their signature s_i to see whether the corresponding ballot was selected. If they were admitted, the user can claim their ticket by submitting a new public key, P'_i, while keeping the new private key, S'_i, secret.

After all k tickets have been claimed, the new set of public keys, P_i1, ..., P_ik is made public. To receive their ticket, the user must submit their public information (e.g., e-mail address) along with a signed message, s'_i = sign('is_admitted', S'_i, P_i1, ..., P_ik), proving that they were admitted.

Implementation

JavaScript can be used to perform the key generation client-side. The workflow then looks as follows:

• A user submits their personal information through a form. They are given a password (which encodes S_i) that can be written down, printed, or e-mailed to themselves.
• After the registration period closes, users are invited to submit their sensitive information through a form. They fill in their password but only the derived signature is transmitted, proving that they are registered.
• Once the results are in, the user fills in their password on a form and the derived signature is used to notify them whether they were admitted or not. If admitted, they will be given a second password (which encodes S'_i).
• At the event, the user can use the second password to prove that they were admitted.