Background
Looking to create an anonymous voting system. The system must track whether or not a user voted on an item (public information), but only that user is ever allowed to know whether they voted for or against an item (private information).
Users must login with a unique identifier and a password.
Problem
All data and all software is open to the public for inspection.
Question
How would you prevent people from mining the public database to discover how constituents voted, yet permit constituents to see how they voted?
Idea #1
Encrypt:
- Client-side encrypts vote (up/down) using AES (JSAES) against their hashed password.
- Client sends vote (for tallying) and AES-encrypted vote to the server.
- Server logs the tally (public) and the AES-encrypted vote (for/against) separately.
Decrypt:
- Client requests vote record.
- Server transfers AES-encrypted vote.
- Client decodes AES-encrypted vote using hashed password.
I picture two hashed password instances: one for the AES-encrypted password applied to votes and one for the user's actual password.
For authentication purposes, the client might send a hash of the password repeated twice to use for the actual password hash. I don't know if that would add any information attackers could use to target the AES-encrypted vote.
Constraints
The system has the following constraints:
- All data is transferred over a secure protocol (e.g., HTTPS).
- People use the system in private (i.e., no peeking at screens).
- Web-based system (no information may be permanently stored on user computers).
Mitigating Buy Offs
The system entails voting for policies. Policies are submitted anonymously, subjected to moderation, and require sufficient reputation (like StackExchanges) before going "live." You can change your vote at any time, so even if you were (somehow) awarded a payout, the payer has no guarantee that you don't switch the vote after payment. After the policy is enacted, you can no longer see how you voted.
Related Links
Related: