Votegral: Towards Usable, End-to-End Verifiable, Coercion-Resistant Online Voting
Louis-Henri Manuel Jakob Merino
Ph.D. thesis advised by Bryan Ford
December 5, 2025
Abstract:
Online voting promises greater convenience and accessibility, but moving from
supervised polling places to unsupervised settings magnifies the risk of
coercion and vote buying. A compelling strategy is to give voters fake
credentials: credentials that look and behave like real voting credentials but
whose ballots are silently excluded from the tally. Despite its conceptual
appeal, practical realizations and usability evidence for fake credentials have
remained limited.
This dissertation presents Votegral, the first end-to-end verifiable,
coercion-resistant online voting system with empirical evidence towards
practical usability. Votegral has two components: TRIP and VLT. TRIP is a
trust-limited, in-person registration scheme that issues voters a real
credential and any number of fake credentials on paper, without trusted
hardware. TRIP embeds an interactive zero-knowledge proof into the physical
printing process so that real credentials carry sound proof transcripts while
fake credentials carry identically formatted but unsound proof transcripts —
distinguishable only by the voter during issuance and not transferable
thereafter.
VLT is a tallying scheme that constrains ballots to registrar-issued
credentials to enable linear-time filtering of fake ballots. VLT also
introduces standing votes: a voter facing extreme coercion can, at
registration, delegate their voting rights to a publicly registered political
party and leave the booth with only fake credentials. Tallying then credits the
party’s ballot by the number of such delegations and publishes publicly
auditable proofs, resulting in both transparency and coercion evidence —
evidence that an aggregate number of voters felt unsafe to leave the registrar
with a real credential.
Our prototype tallies 1 million ballots in about 14 hours on a 128-core, 256 GB
RAM machine; this puts Votegral on par with modern end-to-end verifiable
systems such as Swiss Post, while significantly outperforming prior JCJ-style
systems such as Civitas. TRIP’s end-to-end, voter-observable registration
session completes in under 20 seconds on resource-constrained hardware. In our
main user study with 150 demographically diverse participants recruited in
Boston, Massachusetts, 83% successfully registered and cast a ballot in our
mock election. Among the 120 participants exposed to fake credentials, 96%
correctly understood the purpose of fake credentials. These promising results
suggest a path for practical viability of coercion-resistant, end-to-end
verifiable online voting using fake credentials.