💻 computer science

MultiBallot: Verifiable and privacy-preserving E-Collecting in the Swiss setting

This paper proposes a secure, privacy-preserving, and verifiable protocol for electronic signature collections in Switzerland, leveraging the parallel nature of multiple active collections to guarantee participation privacy without requiring an anonymous channel.

Original authors: Florian Moser, Léo Louistisserand

Published 2026-05-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Florian Moser, Léo Louistisserand

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine Switzerland as a giant, bustling town square where people constantly propose new rules or changes to how the town is run. In this town, citizens don't just wait for an election day; they can start a "signature drive" at any time to force a vote on a specific issue. If enough people sign up, the whole town has to vote on it.

The problem? Currently, these signature drives are mostly done on paper. Paper is slow, easy to lose, and sometimes people try to cheat by forging signatures. The authors of this paper, Florian Moser and Léo Louistisserand, want to move this process online but with two very strict rules:

Privacy: No one should know which specific cause you signed for.
Verifiability: You must be able to prove your signature was counted, and the town must be able to prove the final count is correct.

Here is how their solution, called MultiBallot, works, explained through simple analogies.

The Big Problem: The "Silent" Signature

In a normal election, you vote "Yes" or "No." If you vote "Yes," it's obvious you voted. But in a signature drive, you are only ever voting "Yes." If you sign a petition, you are saying "I support this."

The tricky part is that in Switzerland, many signature drives happen at the same time. Maybe one is about building a new park, another about lowering taxes, and a third about changing school hours.

The Old Way: If you sign the "Park" petition, the system knows you signed the "Park" petition. If you don't sign the others, the system knows you didn't sign them. This leaks your privacy.
The New Way (MultiBallot): The system treats all active petitions like a single, giant "menu." When you interact with the system, you don't just pick one item; you update your entire menu.

The Core Magic Trick: The "Re-Encryption" Mask

Imagine you have a locked box for every single active petition in the country.

The Default State: Every box is locked and contains a "0" (meaning "I haven't signed this yet").
The Action: When you want to sign the "Park" petition, you don't just open that one box. You take every single box on the menu and swap the contents.
- For the "Park" box, you swap the "0" for a "1" (meaning "Signed!").
- For all the other boxes (Tax, School, etc.), you take the existing "0," shake the box (re-encrypt it), and put it back. To an outside observer, the box looks completely different, but it still contains a "0."

Why is this cool?
Because you updated every box at the same time, an outsider looking at your menu cannot tell which box you actually changed to a "1." They only see that you updated your whole menu. You could have signed the Park petition, or the Tax petition, or both. To them, it's a mystery. This is how they hide your privacy without needing a secret, anonymous tunnel.

The "Two-Device" Safety Net

To make sure no one cheats, the system uses two different devices for every citizen:

The Participation Device (Your Phone): This is where you actually click to sign. You trust this device to keep your secret safe.
The Audit Device (A Separate Tablet or Computer): This is like a receipt printer. After you sign, you check this second device. It downloads the "locked boxes" from the public record and unlocks them only for you. It shows you: "Yes, you signed the Park petition."

If your phone tries to cheat (e.g., it signs the Tax petition but tells you it signed the Park one), your Audit Device will show you the truth. If the phone and the Audit Device agree, you know your signature is safe and counted.

The "Public Ledger" (The Bulletin Board)

Imagine a giant, glass-walled blackboard in the town square. Every time someone signs a petition, they write their update on this board.

Transparency: Anyone can look at the board.
Proof: Every update comes with a "mathematical seal" (a Zero-Knowledge Proof). This seal proves, "I did the math correctly," without revealing what the math was.
No Erasing: Once something is written on this board, it cannot be erased or changed. This prevents fraud.

Handling the "Real World" Mess

The authors know life isn't perfect. People move, turn 18, or die.

The Eligibility List: There is a trusted "Roll Call" (like a voter registry) that constantly updates who is allowed to sign. If you move to a new town, the system automatically updates your permission to sign local petitions.
Paper + Digital: The system is designed to work even if some people sign on paper and others online. The "Paper" signatures are treated just like the digital ones, entering the same locked-box system so they can be counted fairly alongside the digital votes.

The Result

The paper claims that MultiBallot achieves a "best of both worlds" scenario:

Privacy: It hides which petition you signed by hiding it among all the other active petitions.
Verifiability: It allows you to prove your signature was counted and allows the public to prove the final count is accurate.
Realism: It doesn't require impossible technology (like magic anonymous internet tunnels) and fits the Swiss legal framework where many petitions run at once.

In short, it turns a chaotic pile of signature drives into a secure, transparent, and private digital process where your "Yes" is counted, but your specific "Yes" remains your secret.

Technical Summary: MultiBallot: Verifiable and privacy-preserving E-Collecting in the Swiss setting

Problem Statement
The paper addresses the security and privacy challenges inherent in electronic signature collection systems (e-collecting), specifically within the Swiss context of direct democracy. Unlike electronic voting (e-voting), where elections are discrete events with fixed electorates, e-collecting involves continuous, parallel-running campaigns where eligibility changes dynamically (e.g., due to age, relocation, or death).

Existing e-collecting systems, such as the European Citizens Initiative (ECI) system or the upcoming St. Gallen cantonal system, lack state-of-the-art security guarantees. Specifically, they often rely on fully trusted servers or fail to provide end-to-end verifiability. A critical gap identified is participation privacy: in e-collecting, signing a petition is equivalent to a "yes" vote, meaning the act of participation itself reveals the voter's stance. Standard e-voting privacy definitions (which assume a choice between options) do not apply directly. Furthermore, achieving participation privacy in e-voting typically requires an anonymous channel, a strong and often unrealistic assumption. The paper notes that in Switzerland, many parallel collections are active simultaneously, a factor currently unexploited for privacy enhancement.

Methodology and Protocol Design
The authors propose MultiBallot, a protocol designed to achieve verifiability and participation privacy without assuming an anonymous channel. The methodology is grounded in a realistic trust model derived from Swiss e-voting regulations, utilizing distributed control components (Bulletin Board, Talliers, Electoral Roll) rather than a single trusted server.

The core technical innovation is the parallel ballot structure:

Ballot Composition: For every active collection ( $C_1, C_2, \dots, C_n$ ), a voter maintains a single ballot containing a dedicated ciphertext for each collection.
Participation Mechanism: To sign a specific collection, the voter's device encrypts the value 1 for that collection's ciphertext. For all other active collections, the device performs a re-encryption (randomization) of the existing ciphertexts.
Zero-Knowledge Proofs (ZKP): The voter generates a ZKP proving that for every collection, the new ciphertext is either an encryption of 1 (signing) or a re-encryption of the previous ciphertext (not signing). Crucially, the proof does not reveal which operation was performed for which collection.
Indistinguishability: Because many collections run in parallel, an observer cannot distinguish whether a voter signed Collection A, Collection B, or neither, as the voter's ballot always contains valid ciphertexts for all active collections. Participation in a specific collection is hidden within the set of all active collections.

Key Contributions

Realistic Setting Derivation: The paper establishes a formal setting for e-collecting based on Swiss e-voting laws, accounting for continuous operation, dynamic eligibility (via an Electoral Roll), and the absence of revocation.
Privacy without Anonymous Channels: The protocol achieves participation privacy by leveraging the parallel nature of collections. It hides a specific participation among potential participations in other active collections, removing the need for the strong assumption of an anonymous channel.
Verifiability: The system provides End-to-End (E2E) Verifiability:
- Individual Verifiability: Voters can verify via an independent Audit Device that their ballot contains their intended choices (by decrypting the ciphertexts associated with their public key).
- Universal Verifiability: The final tally is computed by homomorphically aggregating the ciphertexts for each collection and performing distributed decryption by the Talliers. The result is auditable by third parties.
Hybrid Support: The protocol is designed to work in a hybrid setting where physical signatures (paper) are converted into digital entries by a Hybrid Channel (HC). The Talliers can audit these entries to ensure no "stuffing" (fake signatures) or "dropping" (omission) occurs, without learning the specific participation details of voters who did not use the hybrid channel.
Dynamic Eligibility and Key Rotation: The protocol supports continuous operation, allowing for voter key rotation and changes in eligibility (e.g., a voter moving to a new municipality) without disrupting the integrity of the ongoing collections.

Results and Security Claims
The paper provides a formal security analysis under a Dolev-Yao adversary model.

Verifiability: The protocol guarantees that if a voter verifies their participation, it is counted. Universal verifiability holds provided the Electoral Roll, the Hybrid Channel (if used), and the Talliers are honest.
Privacy: Participation privacy is guaranteed assuming the Participation Device and the Audit Device are honest. The ZKPs ensure that the adversary cannot distinguish between a re-encryption and an encryption of 1.
Trust Assumptions: The system requires a distributed setup where only one component per control group (e.g., one honest Tallier, one honest Bulletin Board node) needs to be trusted. It explicitly avoids the need for a fully trusted server.

Significance and Limitations
The paper claims that MultiBallot brings e-collecting security to the level of state-of-the-art e-voting systems. Its primary significance lies in solving the participation privacy problem in a realistic setting without relying on impractical anonymous channels.

However, the authors are modest regarding the limitations of this privacy model. They acknowledge that while the protocol hides which collection a voter signed, it does not fully hide whether a voter participated at all. If a collection has a unique period of high popularity or if tallying occurs frequently, statistical analysis might still allow an adversary to infer participation in specific collections. Additionally, the paper notes that achieving stronger privacy (hiding total participation) would require voters to perform regular "dummy" actions (re-encrypting without signing), which poses usability challenges, or would necessitate stronger trust assumptions (e.g., a hidden channel to an authority), which the current protocol avoids.

In summary, MultiBallot offers a practical, verifiable, and privacy-preserving framework for e-collecting that aligns with Swiss legal requirements and leverages the unique parallel structure of signature campaigns to enhance security.