NARAD: Non-colluding Aggregator-oblivious Record-And-Decrypt Blockchain-Verifiable Voting via Packed Paillier Encryption

Jul 16, 2026

Electronic voting requires ballot privacy and public verifiability of the final tally. This paper introduces an architecture that avoids a trusted key dealer by letting each voter encrypt in the browser with a Paillier additive homomorphic scheme using a self-generated secret key. Two server roles split tally computation: a collector prepares auxiliary values and an aggregator cancels voter masks to recover the exact encrypted vote sum without learning individual ballots. Solana records ciphertexts immutably, while a native C (libtommath) implementation performs modular arithmetic. Correctness and privacy rely on six explicit assumptions including DCR and a Diffie–Hellman-style masking-base assumption, with bit-packing reducing on-chain and tally costs by a factor of k.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages25

Reading Time1 h 3 min

Abstract

Introduction

The aggregator-oblivious model

Contributions

Outline

Preliminaries

Paillier encoding and the L-function

arXiv :2607 .07596v 1 [ cs .CR] 8 Jul 2026 NARAD: Non-colluding Aggregator-oblivious Record-And-Decrypt Blockchain-Verifiable Voting via Packed Paillier Encryption Akshit Vakati Venkata Rajat Dugar Ayush Adarsh Indian Institute of Technology Madras Abstract Electronic voting must keep individual ballots private while letting anyone verify the final tally. This paper presents an architecture that meets both goals without a trusted key dealer: each voter encrypts a ballot in the browser with a self-generated secret key under the Paillier additive homomorphic cryptosystem, and no party ever holds every key. Two server roles divide the tally. A collector combines the voters’ per-ballot auxiliary values into a single group element; an aggregator uses that element to cancel the voters’ random masks inside the homomorphic product and recover the exact vote sum, learning the result but no individual ballot. The Solana blockchain records every ciphertext immutably and enforces the election lifecycle, while a native C library (libtommath) performs the heavy modular arithmetic. The paper states six assumptions under which the protocol is correct and prove product homomorphism, mask cancellation, and sum recovery; privacy rests on the assumptions standard for aggregator-oblivious encryption: the Decisional Composite Residuosity (DCR) assumption for the additive layer together with a Diffie–Hellman-style assumption on the masking base. A bit-packing scheme places an entire multi-candidate ballot in one ciphertext, cutting client work, on-chain transactions, storage, and tally cost by a factor of k (the candidate count); the slot width b is free, with only the product k · b bounded by log2 N. With b = 25 and a 255-bit modulus the scheme supports ten candidates and up to 225 − 1 = 33554431 votes per candidate, about 335 million ballots in total, and the proof-of-concept tallies 50,000 ballots exactly in under one second on its real parameters. Finally, we show how running the collector and aggregator inside attested secure enclaves makes the tally tamper-resistant and prevents a single host from colluding across the two roles to deanonymize voters. The proof-of-concept implementation is open-source.1 A worked numerical example in the appendix reproduces the full pipeline on those same parameters. Keywords: Paillier cryptosystem, homomorphic encryption, electronic voting, aggregatoroblivious, blockchain, Solana, WebAssembly, libtommath, vote packing, DCR assumption 1 Introduction Electronic voting must satisfy two requirements that usually pull against each other: ballot privacy (no party learns how an individual voted) and tally verifiability (the published result is publicly checkable) . Mix-net systems give privacy but need trusted authorities to shuffle and decrypt. Additive homomorphic encryption gives a cleaner path: the tally is computed directly on ciphertexts, so no individual ballot is ever decrypted. 1.1 The aggregator-oblivious model In the aggregator-oblivious model [6], voters encrypt their data with self-generated secret keys and no coordination with a key dealer. No single party holds every secret key. The aggregator 1[https://github.com/Akshit11318/narad](https://github.com/Akshit11318/narad) computes the sum of the encrypted values from auxiliary information supplied by a collector, but cannot decrypt any single ciphertext. The mechanism rests on one structural choice: each voter’s secret key ski plays two roles at once. It is the encryption randomness ri of the masking term, and it is the exponent of the auxiliary value auxi = pkskAi . When the aggregator raises the ciphertext product to its own keyskA and divides by the collected auxiliary product, the random masks cancel exactly and only the encrypted sum remains. 1.2 Contributions 1. A system model and architecture that combine aggregator-oblivious Paillier encryption with blockchain immutability: clients encrypt in the browser through WebAs

FAQs

How does the system preserve ballot privacy while enabling tally verification?

Each voter encrypts the ballot in the browser using a self-generated Paillier secret key. An aggregator can cancel random masks using auxiliary values prepared by a collector, recovering only the encrypted vote sum rather than any individual ballot.

What roles do the collector and aggregator play in the tally pipeline?

The collector aggregates per-ballot auxiliary values into a single group element, and the aggregator uses that element to cancel voters’ random masks inside the homomorphic product. This yields the exact vote sum without decrypting single ciphertexts.

Why does vote packing improve efficiency, and what are its main limits?

A multi-candidate ballot is placed into one ciphertext, reducing client work, on-chain transactions, storage, and tally cost by a factor equal to the candidate count k. The tunable slot width b is constrained by the bound on k·b relative to log2 N.

Jul 16, 2026

Upload by Evangeline