Secret Ballot: What It Hides, and What It Does Not

A campaign for the members of groups can be created as a secret ballot. It is one kind of campaign, chosen by its creator; every other campaign on Logbook records each response under the respondent's address, and is no secret ballot.

> Beta, on a test network. It runs on Sui Testnet, a test network its operators may reset: a vote and its record can be lost. Ballots are sealed for key servers of the test network. Their operators promise neither to keep serving nor to keep their keys, so a vote may never open. Nobody outside Logbook has audited the contracts or this site. Tested: Chrome on a computer, with a test authenticator. Not tested yet: Safari, Firefox, iPhones, Android phones, and the passkey providers people use (iCloud Keychain, Google Password Manager, password managers). Do not use it for a decision that binds anybody.

#The Claim

Your ballot is recorded without your address when the relayer sends it, which is what this page does. The record of such a ballot on the blockchain does not say which member cast it: an admin of your group, the returning officer and somebody who reads the blockchain cannot read that from it. (A ballot you send yourself, from the file this page offers when the relayer does not take yours in time, is recorded beside the address that sent it.) Your answers are sealed for the key servers this vote names, which are to release the key only after the vote ends.

That is the whole claim. It is about one thing: the record of a ballot the relayer sent does not say which member cast it.

What it does not hide, and what it does not protect against:

It does not stop you from showing somebody how you voted, or somebody from watching you vote. If you could be pressed to prove your vote, this is not protection against that.
In a small group the result can show how people voted: a unanimous result shows everybody’s vote.
Whether you voted is not written down, but it can show. The number of ballots is public as it grows, batch by batch: in a small group, or at a quiet hour, one more ballot next to who was online points to a person. The relayer sends ballots at fixed times, every half hour, and a question group leaves only when at least five ballots of that same group are waiting (five on this site’s relayer; an operator can set another number); it never puts two question groups into one transaction, and until a vote’s last half hour it sends one group of a vote a minute. So at a fixed time your ballot reaches the blockchain as one among at least five ballots of its question group, and four of those may belong to people acting together, who know their own and so know yours. In the last three minutes before the end the least number is one: where fewer than five people answer a group in a half hour, those ballots wait until then and leave however few they are, and a voter who is the only one of a group in that last stretch leaves alone. After the end, when the ballots are opened, a batch whose ballots all say the same tells what each of its voters chose to whoever can tell who was in it: reckoned with each ballot as an independent draw, a batch of five is unanimous about one time in three on a question that splits 80 to 20 (6 times in 100 at 50 to 50, 59 in 100 at 90 to 10). Batching makes linking harder; it does not make it impossible. A ballot that waits for those last three minutes may not be recorded: a transaction sent then can fail, and nothing extends a vote. Several ballots of yours for different groups can reach the blockchain minutes apart or, when few people vote, together in the last three minutes before the end, each among the ballots of its own group.
Logbook could work out how you, by name, voted. One service receives your ballot from your network address, pays for your other actions in the community from that same address, serves your encrypted list of communities, and sees you sign in. So Logbook, or Cloudflare, which hosts it and carries every one of those requests, could put them together: this member, this ballot. After the vote ends the ballot is opened by whoever this vote lets open it (in a vote that opens for everyone: anyone), and then it is: this member, this vote. Logbook keeps no table that says so. It does keep, for two days, half of what such a table needs: daily counters of its sponsor, named by keyed hashes of your address in the community and of your network and written in one moment (what it stores is listed under Data Storage). The other half, which ballot came from which network, passes through its relayer and is not stored by it. What stands in the way is that, not mathematics. A second relay run by somebody else, which would prevent it, does not exist yet.
Before the end your answers can be read by the key servers this vote names, if enough of them act together; whoever created the vote chose them, and a creator who runs them reads the count as it goes. You can also open your own ballot early and show it.
Your passkey is kept by your device’s passkey provider (Apple, Google, a password manager), which may copy it to your other devices. Whoever can use your passkey can vote as you and work out which ballots are yours.
A device with malware can read what the passkey derives. So can a changed copy of this page, and this page is served anew on every visit by Logbook and by Cloudflare, which hosts it: either could serve a changed one. So can a browser extension that reads this page. The operators of the Sui node and of the indexer this page asks see which vote your network address reads, and when; the page asks them for whole lists (every ballot of the vote, the whole roll, the whole part of the list of ballot keys that yours lies in), not for your ballot or your key alone.
This page gives you no receipt when the relayer takes your ballot in time; when it does not, the page offers the ballot as a file, and that file is one. Your passkey is a receipt in every case: at any later time it can work out again which ballots are yours. Whoever makes you use it, or takes it over, learns how you voted in past votes of this kind.
What you write can identify you: your style, a fact only you know. Nothing hides that.

If any of these matters more than the convenience of voting from a browser, do not use this for that vote.

#How It Works, in Short

1A ballot key. Each member registers a ballot key in their community, once, when they join. The key is made by a passkey on their device every time it is needed; Logbook never receives it and it is not kept in the browser. What is registered on the blockchain is a commitment: a number that does not reveal the key.
2The roll. When a campaign is created, the commitments of the members who are eligible at that moment are drawn up into a list, the roll, in steps. Until the roll is closed it is fed by the groups contract, which Logbook can upgrade, and by whoever sends the steps; that is why it then stands for inspection and why the returning officer recomputes it before signing. From the moment the officer's signature fixes it, the ballot box takes no addition to it and no change of it. That holds for good only where the contract of the ballot box was published without an upgrade capability: the campaign’s page reads this from the transaction that published it, which anyone can look up, and says so when it could NOT show it.
3A ballot. To vote, a member's browser proves, without saying which one, that it holds a key of the roll, and that it has not voted in this part before. The answers are sealed for the key servers the campaign names. The proof, the sealed answers and a number that marks "this key has voted" are the ballot. No address is in it.
4The relayer. The ballot is not sent by the member's address: Logbook's relayer puts it on the blockchain, in batches, and pays for it. The relayer sends ballots at fixed times, every half hour, and a question group leaves only when at least five ballots of that same group are waiting (five on this site’s relayer; an operator can set another number); it never puts two question groups into one transaction, and until a vote’s last half hour it sends one group of a vote a minute. So at a fixed time your ballot reaches the blockchain as one among at least five ballots of its question group, and four of those may belong to people acting together, who know their own and so know yours. In the last three minutes before the end the least number is one: where fewer than five people answer a group in a half hour, those ballots wait until then and leave however few they are, and a voter who is the only one of a group in that last stretch leaves alone. After the end, when the ballots are opened, a batch whose ballots all say the same tells what each of its voters chose to whoever can tell who was in it: reckoned with each ballot as an independent draw, a batch of five is unanimous about one time in three on a question that splits 80 to 20 (6 times in 100 at 50 to 50, 59 in 100 at 90 to 10). Batching makes linking harder; it does not make it impossible. A ballot that waits for those last three minutes may not be recorded: a transaction sent then can fail, and nothing extends a vote. Several ballots of yours for different groups can reach the blockchain minutes apart or, when few people vote, together in the last three minutes before the end, each among the ballots of its own group. The relayer serves only the communities its operator has listed. A ballot it does not take, or takes too late to promise it a place, can be saved as a file and sent to the blockchain by anybody: the address that sends it is then recorded beside it, and the page says what that shows.
5The end. After the end, the key servers are to release the key of each part that received at least the minimum number of ballots, and whoever may open the ballots (the campaign says who) counts them. The key servers are to refuse the key of a part below its minimum; that holds as long as enough of the key servers the campaign names keep to it.

#Who Runs What

The site and the relayer: Logbook, hosted by Cloudflare. The page you vote on is served anew on every visit by both.
The key servers this site commits a campaign to: two of the three are run by Mysten Labs, the company behind Sui, which also runs the full node this site reads and the service behind Google sign-in; the third is a committee of operators reached through an address of Mysten Labs. Any two of the three open a ballot, so Mysten Labs alone could read ballots before the end.
The blockchain: Sui Testnet.

#What a Member Needs

A ballot key registered before the campaign is created. A key registered later counts for later campaigns. Register it when you join; the group's page has "Your ballot key".
A browser with passkeys that can derive a secret. Tested so far: Chrome on a computer. A browser inside another app (a messenger's own browser) usually cannot: the page says "open this page in Safari or Chrome".
The passkey you enrolled with, on this device or one your passkey provider copied it to. Another passkey makes another key, and the page tells you so before anything is sent. On a shared device the page refuses a passkey that belongs to another Logbook account.
If the passkey is lost, you can register a new ballot key: once in 7 days, and it counts for campaigns created after that. Campaigns already under way keep the old key.

#What Stays Public

That your address in the community has a ballot key, its commitment, when it was set and how many times it was replaced.
The roll: every commitment on it, in order.
How many ballots each part has received, as it grows.
Every ballot, sealed, from the moment it is recorded, beside the address that paid for it: the relayer's, for a ballot the relayer sent.
After the end: what the ballots of an opened part say, and so the result, for whoever may open them; in a campaign that opens for everyone, anyone.

#Receipts: the Passkey Is One, and So Is a Saved Ballot

The page shows no code for your ballot: a code that proved what you chose could be demanded from you. When the relayer takes your ballot in time, the page gives you no receipt. When it does not (it refuses the ballot, or takes it so late that it may not be recorded), the page offers the finished ballot as a file, so that you can cast it yourself, and that file is a receipt: whoever has it can tell which ballot is yours.

"Was my ballot recorded?" asks your passkey again, downloads every ballot of the vote and looks for yours on your device. That same step is the limit: your passkey can find your ballots again at any later time, so whoever makes you use it, or takes it over, learns how you voted in past votes of this kind.