Schulze Voting as Evidence Carrying Computation

Verifiable Homomorphic Tallying for the Schulze Vote Counting Scheme

“…This last part is identical to our previous formalisation of the Schulze Method (for plaintext ballots), and we refer to [17] for more details.…”

“…Once all ballots are counted, the computed margin is decrypted, and winners (together with evidence of winning) are computed using plaintext counting. We discuss this part only briefly, for completness, as it is identicial to the existing work on plaintext counting [17]. For each of the winners w and each candidate x we publish a natural number k(w, x) and a path w = x 0 , .…”

“…Rather than scrutinising the details of the construction of this data type, we follow a different approach: we demonstrate that homomorphic counting always yields the same results as plaintext counting, where plaintext counting is already verified against its specification. Plaintext counting has been formalised, and verified, in the precursor paper [17]. This correspondence has two directions, and both assume that we are given two lists of ballots that are the encryption (resp.…”

“…In previous work [17] we have demonstrated how to achieve verifiability of counting plaintext ballots by producing a verifiable certificate of the count, where ballot privacy and receipt freeness are not addressed. The certificate has two parts: The first part witnesses the computation of the margin matrix where each line of the certificate amounts to updating the margin matrix by a single ballot.…”

“…Crucially, the evidence of w winning the election only depends on the margin matrix. We refer to [17] for details of the second part of the certificate as this will remain unchanged in the work we are reporting here.…”