The cryptography behind electronic voting (and why paper ballots are still essential)

What it is

A Trail of Bits post of 3 November 2026 (U.S. midterm day) on how Helios and ElectionGuard use cryptography in voting, and where that stops. Helios targets low-stakes, low-coercion elections and is used by the IACR to elect its board. ElectionGuard adds end-to-end verifiability on top of paper-based infrastructure. It has been piloted alongside paper ballots in College Park (Maryland), Preston (Idaho) and Fulton (Wisconsin).

How it works

• Privacy: the election key is threshold-shared among N trustees, and a quorum of t+1 must cooperate to decrypt. Ballots use exponential ElGamal, E_K(x) = (g^r, K^r g^x), which is additively homomorphic under pointwise multiplication. The backend can therefore decrypt only the aggregate tally. Decryption yields g^x, so the small tally is recovered by brute force or a lookup table.
• Ballot validity: each ballot carries a zero-knowledge proof that the ciphertext holds a permitted value. Without it, a compromised client could encrypt 1,000,000 and count as a million Yes votes.
• Compromised client: under a Benaloh challenge, the device commits to the encrypted ballot before the voter chooses to cast or spoil it. A spoiled ballot is opened so the voter can check it. This needs external validation of the plaintext, or the client can simply lie.
• Compromised backend: voters check their commitment against a public bulletin board. ElectionGuard chains commitments per device, so changing an earlier ballot alters every later commitment. Once the record is trusted, a zero-knowledge proof shows the aggregate ciphertext was decrypted correctly.

What to do

For anyone designing or evaluating a voting system, the page gives these constraints:

• Require software independence: any outcome change caused by a software error or vulnerability must be detectable, in practice through a paper audit trail.
• Do not set the trustee threshold to all N. Helios used that setting, and the IACR had to rerun its 2025 election after one trustee lost their key share.
• Treat electronic ballot return as unsuitable for general elections, following the 2018 National Academies report.

Caveats

• Benaloh challenges only catch a compromised client if enough voters use them. The page's example: if 1 in 100 voters challenge and a client tampers with 1000 votes, the chance of going undetected is 0.99^1000, about 4.3 × 10^-5. It also notes that voters who detect tampering may have no recourse and may just retry.
• Challenges do not stop a client from leaking the plaintext ballot to a third party.
• Detecting injected ballots is harder. It usually needs external data such as participation records, and linking ballots to voter identities is not enough, because a malicious server could pad the record with ballots for abstainers.
• Voter authentication is unsolved in countries without a widely used national ID. Overseas military systems use the Common Access Card. The post says coercion resistance for unsupervised voting seems hard to achieve with cryptography.
• The post says a single supply-chain flaw or 0-day could let one actor swing an electronic election across many jurisdictions, possibly undetected. It argues paper makes that much harder.
• The post gives no implementation guidance, code or parameters for either protocol.