Secret Ballots: Why Votes Shouldn't Come With Receipts

A receipt usually makes a system more trustworthy. It gives us evidence that something happened, a record we can return to if something goes wrong, and a way to demonstrate that we fulfilled an obligation.

Voting introduces a strange exception. A receipt that proves how someone voted can undermine the very freedom a secret ballot is supposed to protect. If a voter can demonstrate their choice to someone else, that proof can be demanded under threat or made a condition of payment.

A secret ballot therefore has to do more than keep individual choices out of public view. It has to produce a verifiable collective decision without giving participants a reliable way to prove their individual choices to someone else.

That protection is known as receipt-freeness.

When proof becomes a problem

In a conversation with Vitalik Buterin, Millie, and Auryn Macmillan, Vitalik described two incentive systems that can act on a voter: one tied to the collective outcome, and another tied to that individual's choice. A bribe, threat, or reputational consequence does not need to change the result to influence the voter. It only needs a way to establish whether the person complied.

This is why ballot secrecy and receipt-freeness are related but distinct.

A ballot can be confidential without being receipt-free. Its contents might remain encrypted or otherwise hidden from observers, while the voter still possesses information that can convince a third party how they voted. In digital systems, transaction records, timing, cryptographic material, or supervised voting sessions can introduce additional ways to monitor or demand evidence of a choice.

The problem is not that proof is inherently undesirable. A voting system needs ways to establish that eligible votes were accepted and that the result was calculated correctly. But a confirmation that a ballot was accepted is different from a receipt proving the voter's selection.

A secret ballot should make the outcome verifiable without making the individual choice provable.

That is a more demanding design problem than encryption alone can solve.

How secret ballots fit Interfold

The Interfold is a distributed network for confidential coordination. One of its reference applications is CRISP, the Coercion-Resistant Impartial Selection Protocol, which uses encrypted computation to produce verifiable secret ballots.

CRISP allows individual choices to contribute to a collective result without becoming visible to other voters, administrators, or a single trusted tallying authority.

Each secret-ballot round uses an Encrypted Execution Environment (E3) instantiated for that specific vote. A committee selected through sortition from the ciphernode network participates in distributed key generation, establishing the shared public key used to encrypt votes.

A separate Compute Provider tallies the encrypted inputs using fully homomorphic encryption (FHE). Zero-knowledge proofs (ZKPs) support verification, while the ciphernode committee participates in threshold decryption of the permitted aggregate result once the required conditions are satisfied.

Individual ballots remain protected, while the outcome can be published and verified. The computation does not depend on trusted hardware, such as trusted execution environments (TEEs), or give any single operator unilateral decryption authority.

But protecting encrypted ballots and distributing authority over the tally is only part of CRISP's design. Receipt-freeness introduces another problem: what if someone demands proof from the voter?

Making a vote harder to prove

CRISP addresses this through a mechanism called vote masking.

In an encrypted voting system, a visible transaction may still reveal that a particular voter took an action. Even if the vote itself is hidden, that activity can become useful to someone monitoring or coercing the voter.

CRISP allows genuine vote updates and masking operations to produce computationally indistinguishable outputs.

A masking operation adds an encryption of zero to the existing encrypted vote state. It changes the ciphertext without changing the underlying selection. Both genuine vote updates and masks can produce valid ZKPs, without revealing which kind of operation occurred.

Suppose someone pressures a voter to choose option B. Later, the encrypted ballot is updated. From that update alone, the person cannot tell whether the voter changed their choice or whether someone simply masked the existing vote. The proof establishes that the update was valid, not which action took place.

Vote masking does not make every form of coercion impossible. Its effectiveness depends in part on the surrounding system, including sufficient masking activity and the conditions under which voters can act. What it changes is the information available to someone attempting to turn ballot activity into proof of compliance.

That is the deeper purpose of receipt-freeness: protecting a choice not only from disclosure, but also from becoming something another party can reliably demand evidence of.

A larger space for collective decision-making

CRISP is integrated with Aragon OSx through a governance plugin, providing a concrete implementation of encrypted, verifiable secret ballots for onchain organizations.

But the underlying problem extends beyond DAO governance. Organizational decisions, impartial selection, and other collective processes can require people to arrive at a shared outcome without exposing their individual positions to inspection or pressure.

Confidentiality allows people to participate without surrendering those positions to everyone involved in producing or verifying the result. Receipt-freeness goes further by making their choices harder to turn into enforceable obligations to someone else.

What secret ballots reveal

Privacy is not the final product of a secret ballot. The final product is a collective decision that participants can verify and act on. But the legitimacy of that decision also depends on whether participants were free to make their choices without enforceable pressure.

Secret ballots reveal something important about confidential coordination: sometimes protecting people's ability to participate requires limiting what even they can prove about their own participation.

This is one dimension of a new coordination model for the internet: shared outcomes can be verifiable without turning every private choice into evidence someone else can demand.

The point is not simply to keep choices hidden. It is to preserve the freedom to make them.

Keep the input. Share the outcome.