Abstract

Electronic voting must keep individual ballots private while letting anyone verify the final tally. This paper presents an architecture that meets both goals without a trusted key dealer: each voter encrypts a ballot in the browser with a self-generated secret key under the Paillier additive homomorphic cryptosystem, and no party ever holds every key. Two server roles divide the tally. A _collector_ combines the voters per-ballot auxiliary values into a single group element; an _aggregator_ uses that element to cancel the voters random masks inside the homomorphic product and recover the exact vote sum, learning the result but no individual ballot. The Solana blockchain records every ciphertext immutably and enforces the election lifecycle, while a native C library (libtommath) performs the heavy modular arithmetic. The paper states six assumptions under which the protocol is correct and prove product homomorphism, mask cancellation, and sum recovery; privacy rests on the assumptions standard for aggregator-oblivious encryption: the Decisional Composite Residuosity (DCR) assumption for the additive layer together with a DiffieHellman-style assumption on the masking base. A bit-packing scheme places an entire multi-candidate ballot in one ciphertext, cutting client work, on-chain transactions, storage, and tally cost by a factor of _k_ (the candidate count); the slot width _b_ is free, with only the product _k b_ bounded by log2 _N_ . With _b_ = 25 and a 255-bit modulus the scheme supports ten candidates and up to 2[25] __ 1 = 33 554 431 votes per candidate, about 335 million ballots in total, and the proof-of-concept tallies 50,000 ballots exactly in under one second on its real parameters. Finally, we show how running the collector and aggregator inside attested secure enclaves makes the tally tamper-resistant and prevents a single host from colluding across the two roles to deanonymize voters. The proof-of-concept implementation is open-source.[1] A worked numerical example in the appendix reproduces the full pipeline on those same parameters.