Blind signature: how we protect ballot secrecy | METIS Italia Skip to content

Ballot security

The blind signature: ballot secrecy guaranteed by mathematics

An online election has to combine three things that seem to conflict: only those entitled vote, each of them only once, and nobody can know how anyone voted. With the blind signature the system checks the right to vote and accepts the ballot without ever being able to link the two. This page explains how, first in plain words and then in technical detail.

The idea in an envelope

Imagine putting your completed ballot into an envelope lined with carbon paper and taking it to the polling station.

The official checks your ID, verifies that you are on the list and have not voted yet, then signs on the outside of the sealed envelope. Thanks to the carbon paper the signature goes through onto the ballot, but the official has never seen it.

You step away, remove the envelope and drop the signed ballot into the box, together with everyone else's. Whoever opens the box sees that the signature is genuine, so the ballot is valid, but cannot tell which envelope it came from.

The blind signature does the same with mathematics: the "envelope" is a random number known only to your browser.

Voting step by step

  1. Open your personal link

    The link received by email works once and only for that election. The page loads the election's public key: each election has its own.

  2. Choose and confirm

    You select the candidates and confirm the summary. Nothing has been sent so far.

  3. The browser prepares the token

    Your browser generates a random token and "masks" it by multiplying it by a secret number that stays only on your device.

  4. First request: the signature

    The browser sends the masked token together with your personal link. The server checks that voting is open and that you have not voted yet, marks "voted" with the day only and signs the masked token. It does not receive your choices and does not see the token.

  5. The browser removes the mask

    Using its secret number the browser obtains the valid signature on the real token and checks it by itself: if the server had signed incorrectly, the vote would stop here.

  6. Random wait

    The browser waits between 5 and 20 seconds, chosen at random, to separate the two requests in time.

  7. Second request: the ballot

    The browser sends token, signature and choices in an anonymous request: no personal link, no cookies, no session. The server verifies the signature, checks that the token has not been used and puts the ballot in the box.

  8. Your receipt

    You get a receipt code, shown only to you, and see the two records just stored, read back from the database: the register with your name and no choices, the ballot with choices and no name.

Who knows what

This is what the server sees in each of the two requests. Neither contains both who you are and how you voted.

First request (signature) Second request (ballot)
Who you are yes, from the personal link no
The token no, only masked yes
Your choices no yes
Cookies and session yes no

The masked value and the signature from the first request are kept next to your name only to complete an interrupted vote: without your browser's secret number they lead neither to the token nor to the ballot.

The guarantees

One vote per voter

The server signs only once per personal link and each signed token is valid for one ballot only.

No forged ballots

A ballot without a valid signature, or with a token from another election, is rejected.

Linking is impossible

The server never sees the token next to your name: secrecy does not depend on a promise not to store something.

Result integrity

When voting closes the system checks that there are as many ballots as used tokens, never more than voters, and that the totals match the ballot box.

What you can check yourself

  • Right after voting you see the records actually stored: no choices next to your name, no name on the ballot.
  • With the receipt code you check on the results page that your ballot was counted. Normally (stronger secrecy) the code only confirms that the ballot is there and does not show your choices: so nobody can force you to prove how you voted. The organiser can instead choose a verifiable vote: then the code also shows your choices and must be kept to yourself.
  • When voting closes, with at least 5 ballots, the ballot box is public without names: you can recount every ballot and compare them with the ranking.
  • The browser code that masks the token is public and readable (js/AN05_blind.js): a trusted expert can review it.

See also: what we store, field by field →

Details for experts

  • 2048-bit RSA signature with a key dedicated to each election, RSA-FDH scheme: the 32-byte random token is expanded with MGF1-SHA256 to the modulus length, together with a context that binds it to the election.
  • Blinding in the browser with BigInt arithmetic: b = m · r^e mod n, with r random and coprime with n; the browser unblinds with r^-1 and checks s^e mod n = m before submitting the ballot.
  • Each election's private key is stored encrypted (AES-256) with a secret phrase that is not in the database: whoever reads only the database cannot sign tokens.
  • The server signs only values of exactly the modulus length and smaller than the modulus; used tokens are kept as a SHA-256 fingerprint, with no date and no reference to the voter.
  • The ballot request is sent without credentials (no cookies, no referrer header) and the endpoint opens no session.
  • Resume: until submission, token, mask and signature stay only in the voter's browser; if the page closes, reopening the link from the same device completes the vote with the same receipt.

Limits, stated plainly

Internet address
We do not store it in our tables, but the hosting provider's technical logs keep it. Someone voting from the same network they signed from would leave two requests from the same address.
Closeness in time
Signature and ballot arrive a few seconds apart. The random wait softens this, especially when many people vote at the same time.
Your device
If the voter's computer or phone is compromised by malicious software, no online voting system can protect what happens on that device.
The voter list
Who can vote is decided by the organiser: the number of voters and of people who voted is published in the results, so anyone can check it.
Incomplete votes
If a voter closes the page after the signature and never reopens it from the same device, their right to vote counts as used but the ballot never arrives. The results report it as an "incomplete vote".

Blind signature FAQ

Do I have to do anything special to vote?

No. You choose, confirm and wait a few seconds while the ballot is submitted: the browser does everything else.

What if I close the page before the receipt?

Reopen your personal link from the same device: the vote completes by itself with the same receipt. It cannot be done from another device, because the secret number stayed on the first one.

Does the receipt code reveal my vote?

Normally no: the ballot box holds only its fingerprint and the check only answers "ballot present and counted". Only if the organiser chose a verifiable vote (it is written on the ballot) does the code show your choices to whoever enters it: in that case keep it to yourself.

Do all elections use the blind signature?

Yes, all those created after it was introduced. Earlier elections keep the system in use when they were created, which still separates names and choices in the stored data.

Try it with your next election

Create an election