3 ms·
The problem is that "exactly one account for election voting" and "untraceably anonymous" don't go together. What we've got now is a physical mixing where you
by dsr_ 4y ago
The problem is that "exactly one account for election voting" and "untraceably anonymous" don't go together.
What we've got now is a physical mixing where you "prove" your identity to a clerk at the assigned polling location, you are issued a physical token which you fill out in privacy, and then the token with the voting information on it is mixed with all the others from that polling location. By having opposed auditors watching vigilantly, we get some confidence that ballots are not altered or replaced.
Let's say that you have a system which has a single account for every citizen (fine in theory), which can issue an anonymous bearer token that can be used for voting later. That bearer token is now vulnerable to being sold, confiscated, copied (but only usable once, so there's a race), forgotten, and can go unused.
- EGreg 4y agoYes they do. This is basically Group Signatures. I am just asking whether BBS04 is the state of the art still. In there, the group manager is the only one who can deanonymize people. Is there any way to provably opt out of this latter feature, so we can be sure NO ONE can link signatures to users? That’s Chaum’s original 1991 conception. The alternative is to use ZK mixers on distributed ledgers that have solved the double spend problem, but the jury is out on just how anonymous and unlinkable they really are in practice: https://arxiv.org/pdf/2201.09035.pdf https://arxiv.org/pdf/2201.09035.pdf