Proof of One: one-person-one-identity polling with encrypted ballots — design and reference code, requesting critical review

What it is

Proof of One is a design-stage, unaudited open-source system for polls where each voter is a unique human and ballots cannot be linked to people. The pseudonymous maintainer, Nemo Unus, posted it to ethresear.ch for critical review. Most of the design and code was drafted by AI agents (disclosed in AGENTS.md), and no independent human has reviewed it. There is no token and nothing for sale.

How it works

Enrolment has two parts. For the document, the phone reads an ICAO 9303 passport chip over NFC. It proves in zero knowledge that a document signer in a public tree signed the chip data. The reference circuit covers SHA-256 and RSA-2048 and has 577,678 constraints. Phone proving time has not been measured.

For the person, a face match against the chip photo runs inside an attested enclave. Duplicates are caught by an OPRF document fingerprint and a 1:N face search. The enclave signs only a hiding commitment. The phone then registers its identity leaf with a ZK proof of holding a credential. A hidden revocation handle lets re-enrolment revoke the old identity without revealing which leaf it was.

Voting uses one-hot exponential ElGamal on Baby Jubjub under a per-poll threshold key. One Groth16 proof covers membership, non-revocation, nullifier, eligibility and ballot well-formedness. It has 32,607 constraints and takes 3.5 s in the browser on an iPhone 14. The latest ballot per nullifier counts.

Tally sums ballots homomorphically. A GJKR-style DKG makes the key, and anyone can settle complaints from the public transcript. Trustees publish partial decryptions with DLEQ proofs. The contract checks that the sum of counts equals the number of distinct voters, which must be at most the number of eligible identities. A 7-day challenge window follows, then key shares are deleted.

flowchart LR
    P[Phone] -->|ZK: signed chip data| T[Signer tree]
    P -->|live face| E[Enclave]
    E -->|signs hiding commitment| P
    P -->|ZK credential proof| L[Identity leaf registry]
    L --> V[Vote: Groth16 + ElGamal]
    V --> S[Homomorphic sum]
    S --> D[Trustee decryption + DLEQ]
    D --> C[7-day challenge window]

Preconditions / Affected

The trust list of country signing certificates is built from the German master list and covers 113 of 186 chip-passport countries. The list holds references only, and its hash can be rebuilt by anyone. A field test found a commercial verifier that read a genuine chip correctly but could not verify it because it lacked the issuing country's certificate.

Caveats

• The author's stated limit: an authority that issues passports can mint genuine-looking identities. The goal is costly, bounded and visible, not impossible.
• There is no receipt-freeness beyond re-voting. The author asks for views on combining operator re-encryption with voter self-verification.
• The ballot layer is close to Vocdoni's DAVINCI. The claimed difference is the census: DAVINCI and MACI take the voter list from the organiser, while this builds a census of unique humans from chip documents. The author has asked the DAVINCI authors whether the registry could plug in as their census.
• The reference code has 93 tests, many of them attack cases.
• Review is requested on five areas:
• Enrolment credential unlinkability when the enclave knows the revocation handle (issue #3).
• Ballot circuit and tally completeness (issue #2).
• Whether the "fundamental limit" threat model is framed honestly (issue #1).
• How to obtain and audit country signing certificates (issue #14).
• Groth16 with a ceremony versus a universal setup (issue #7).

The repository also has a technical brief, a reviewer's guide (REVIEWING.md) and a landscape review.