Votegral: Towards Usable, End-to-End Verifiable, Coercion-Resistant Online Voting
Online voting promises greater convenience and accessibility, but moving from supervised polling places to unsupervised settings magnifies the risk of coercion and vote buying. A compelling strategy is to give voters fake credentials: credentials that look and behave like real voting credentials but whose ballots are silently excluded from the tally. Despite its conceptual appeal, practical realizations and usability evidence for fake credentials have remained limited.
This dissertation presents Votegral, the first end-to-end verifiable, coercion-resistant online voting system with empirical evidence towards practical usability. Votegral has two components: TRIP and VLT. TRIP is a trust-limited, in-person registration scheme that issues voters a real credential and any number of fake credentials on paper, without trusted hardware. TRIP embeds an interactive zero-knowledge proof into the physical printing process so that real credentials carry sound proof transcripts while fake credentials carry identically formatted but unsound proof transcripts -- distinguishable only by the voter during issuance and not transferable thereafter.
VLT is a tallying scheme that constrains ballots to registrar-issued credentials to enable linear-time filtering of fake ballots. VLT also introduces standing votes: a voter facing extreme coercion can, at registration, delegate their voting rights to a publicly registered political party and leave the booth with only fake credentials. Tallying then credits the party's ballot by the number of such delegations and publishes publicly auditable proofs, resulting in both transparency and coercion evidence -- evidence that an aggregate number of voters felt unsafe to leave the registrar with a real credential.
Our prototype tallies 1 million ballots in about 14 hours on a 128 core, 256 GB RAM machine; this puts Votegral on par with modern end-to-end verifiable systems such as Swiss Post, while significantly outperforming prior JCJ-style systems such as Civitas. TRIP's end-to-end, voter-observable registration session completes in under 20 seconds on resource-constrained hardware. In our main user study with 150 demographically diverse participants recruited in Boston, Massachusetts, 83% successfully registered and cast a ballot in our mock election. Among the 120 participants exposed to fake credentials, 96% correctly understood the purpose of fake credentials. These promising results suggest a path for practical viability of coercion-resistant, end-to-end verifiable online voting using fake credentials.
École Polytechnique Fédérale de Lausanne
Prof. Thomas Emile Bourgeat (président) ; Prof. Bryan Alexander Ford (directeur de thèse) ; Prof. Clément Pit-Claudel, Dr Oliver Spycher, Prof. Dave Levin (rapporteurs)
2025
Lausanne
2025-12-05
10958
172