End-to-end auditable voting

End-to-end auditable or end-to-end voter verifiable (E2E) systems are voting systems with stringent integrity properties and strong tamper resistance. E2E systems use cryptographic techniques to provide voters with receipts that allow them to verify their votes were counted as cast, without revealing which candidates a voter supported to an external party. As such, these systems are sometimes called receipt-based systems.

Overview

Electronic voting systems arrive at their final vote totals by a series of steps:

voters cast ballots either electronically or manually,

cast vote records are tallied to generate totals,

where elections are conducted locally, such as at the precinct or county level, the results from each level are combined to produce the final tally.

Classical approaches to election integrity focus on ensuring the security of each step individually, going from voter intent to the final total. Such approaches have generally fallen out of favor with distributed system designers, as these local focuses may miss some vulnerabilities while over-protecting others. The alternative is to use end-to-end measures that are designed to demonstrate the integrity of the entire chain.

Comprehensive coverage of election integrity frequently involves multiple stages. Voters are expected to verify that they have marked their ballots as intended, recounts or audits are used to protect the step from marked ballots to ballot-box totals, and publication of all subtotals allows public verification that the overall totals correctly sum the ballot-box totals. Conventional voting schemes do not meet this standard, and as a result cannot conclusively prove that no votes have been tampered with at any point; voters and auditors must instead verify each individual step is fully secure, which may be difficult and introduces many points of failure.