mspecter

Also, I'm just the professor, the grad students on it are the real heroes: Akshaya Kumar [1] and Anna Raymaker [2].

[1] https://akumar805.github.io/

[2] https://annaraymaker.dad/

Interesting! Hadn't heard of it.

In general, yes! We did some follow on work explaining how all of this works, depending on the provider: https://petsymposium.org/popets/2026/popets-2026-0113.pdf

Last author on the paper here (https://arxiv.org/pdf/2510.00350). Happy to answer any questions!

Good point. Most of this was written before the signal-custom-client thing happened, so it wasn't top of mind. We also considered "serious" systems, deployed en masse. Perhaps we should've included this as well.

Oh, I didn't realize it'd made it to Schneier's blog, thanks for letting me know!

A goal of the work was to try to explain to a new audience (specifically nontechnical legal folks) the ongoing challenges with Going Dark. Hopefully it helps!

Coauthor here, somewhat surprised to see this on HN. Any thoughts, questions, or feedback welcome.

The secret ballot is usually considered a core goal of an elections system, blockchain involvement or not.

I have not personally, but there's some fantastic work on the subject: https://ieeexplore.ieee.org/abstract/document/9152765?signou...

They find a few really bad issues. IIRC, the Swiss Post is looking into improving it, with the consultation of real cryptographers, so we'll see how that goes!

You might be interested in some prior work on blockchain voting, it's a bit harder to get right than one might think, and actually introduces some problems [1,2].

[1] https://www.usenix.org/conference/usenixsecurity20/presentat... [2] https://academic.oup.com/cybersecurity/article/7/1/tyaa025/6...

Hey all, coauthor here. Interesting to see it on Hacker News.

I'm a professor in Georgia Tech's CS dept that works on problems related to security, privacy, and public policy. (CV: https://mikespecter.com/)

Happy to answer any questions you all have.

Hi! Check out our Usenix 2021 paper on exactly this topic. The key insight is to release private keys over time:

http://www.mit.edu/~specter/blog/2020/dkim/

To push this further, I was working on a research paper with Ron Rivest, Neha Narula (head of MIT's decentralized currency initiative), and Sunoo Park (a wonderful applied cryptographer) on whether blockchains in general could be helpful in casting and tallying.

We're skeptical.

See: http://people.csail.mit.edu/rivest/pubs/PSNR20.pdf

> How confident are you that we could reach a well engineered and proofed electronic voting platform that also adheres to theoretical rules around vote security?

I don't think we can with the current commodity devices / ecosystem, even assuming that voting system software is well-written. Keeping electronic-only systems secure from nation-state level adversaries is hard.

To put this in short-hand: "We bank online, we buy all sorts of stuff online, why not vote?"

The biggest reason is that banking and other financial transactions have a very different threat model from voting.

In particular, voting requires a secret ballot. In addition to preventing an adversary from learning how you voted, a secret ballot requires you to be unable to prove how you voted, to prevent vote selling and coercion.

So, unlike financial transactions, how you do validation / remediation of failures is very unclear. Ben Adida has a blog post with further thoughts here (https://benlog.com/2007/03/02/on-voting-banking-and-bad-anal...).

That's a wonderful question.

The honest answer is that I have no idea. In the version we reverse engineered, there's no proof of inclusion of any of the data in the blockchain in the client, and the receipt system was via a PDF. The vote selections (ballot?) are also never signed by the client.

It's also worth noting that, according to the ToB article, the backend blockchain is a permissioned hyperledger instance, which runs PBFT[1] rather than proof of work. PBFT is controllable with roughly 1/3 of the network, 100% of which has been controlled by the company.

[1]http://pmg.csail.mit.edu/papers/osdi99.pdf

Oh, hi.

I'm Mike Specter, lead author on the MIT report [1], and have been involved in other voting-related research projects [2,3].

LMK if you all have any questions!

1. https://internetpolicy.mit.edu/wp-content/uploads/2020/02/Se...

2. http://people.csail.mit.edu/rivest/pubs/PSNR20.pdf

3. https://www.belfercenter.org/sites/default/files/files/publi...

Hijacking this to say that we need the following:

1. Risk Limiting Audits (RLAs)[1]

2. Software independence [2]

3. Paper-backed ballots (which are the official record of the vote) that are physically voter-verified (as a requirement for the above)

4. Paper ballots are anonymized after submission, so as to avoid coercion and vote selling

5. Usability improvements

An app may be a solution to some of #5 above, e.g. as a ballot marking device at the polls, but in order to be secure it should absolutely have #1 and #2. FWIW, voting.works will likely support these.

The solution to long lines and timing is a complicated policy issue, which may not be solvable with technology.

[1] https://www.stat.berkeley.edu/~stark/Preprints/gentle12.pdf

[2] https://royalsocietypublishing.org/doi/abs/10.1098/rsta.2008...

Yep! https://groups.csail.mit.edu/mac/users/gjs/6.945/

I'm in his group at MIT.

Sure, though, to be pedantic, a common example of moral hazard is the increased likelihood of driving recklessly in the presence of mandatory seat belts. See https://web.stanford.edu/~leinav/pubs/RESTAT2003.pdf

>"Insured" can be interpreted very broadly; moral hazard is whenever the negative outcomes of a risky decision are directed away from oneself.

Nope! That's called an externality. A moral hazard is a type of externality, but is very focused on a particular set of instances in the definition I provided.

A moral hazard happens when an entity is somehow insured against something (e.g. health insurance), so is rationally more likely to behave in some "bad" way (e.g. driving recklessly).

I'm not seeing how this a moral hazard, do you just mean "immoral"?

More reading: https://www.npr.org/2017/11/22/566039611/colorado-launches-f...

Colorado successfully performed an RLA, and didn't have to recount every ballot. If you really want to read more, Free and Fair (IIRC, the same group bidding on the DARPA grant) has open source software and instructions on how to perform RLAs: https://github.com/FreeAndFair/ColoradoRLA

This is absolute hogwash, there are other methods than a full hand recount if you have a paper trail, some of which only require counting a small number of the ballots by hand.

The best example of this is a Risk Limiting Audit (RLA). You only have to re-count a smaller number of ballots until the overwhelming probability is that the vote is confirmed, or that the vote is rejected. Depending on the disparity between the ballot options, this count can actually be very small.

See: https://www.stat.berkeley.edu/~stark/Preprints/gentle12.pdf

This system is perfect for this kind of an audit -- essentially a ballot marking device written by an organization known for formal verification.

No.

What's the plan for pairing based curves now that the Extended Tower Number Field Sieve has made BN256 unusable for many applications[1]? Do you plan on integrating BLS curves any time soon?

[1] see https://godoc.org/golang.org/x/crypto/bn256

And an update from (mostly) the same authors for 2017: https://dspace.mit.edu/handle/1721.1/97690

The theory is that the cops would be the ones selecting the finger. This would be no different from LE trying to crack a password, and the system permanently locking them out. However, I am also Not A Lawyer.

Hi, author here. Really happy (but somewhat surprised) to see this up on HN, and am generally interested in pursing this as a PhD thesis topic. If anyone has ideas or thoughts on novel systems in this arena I’d be very interested to hear about it!

Hey Matt, just wanted to voice some support for what you're doing. The US gov't needs all the help it can get.