Post

The International Association for Cryptologic Research has used heliosvoting.org – my online voting system – for a number of years. This year, a trustee lost their secret key. The election has to be re-run. Below, a few thoughts that didn't fit in the NYT piece. www.nytimes.com/2025/11/21/w...

First, this is really unfortunate, and I feel really bad. Sure, you can say "the trustee should have saved their secret key", but ultimately, as a system designer, I want my systems to be resilient to human mistakes. To be human is to err. Although, it's really hard to strike the right balance.

If you want voter privacy, even from me, the administrator of the Helios server, you need to use strong encryption on the ballots – in fact you need a special form of encryption that allows for accumulating votes under the covers of encryption.

And then you need to manage how the decryption of the tally is performed, and the only way we know how to do that reasonably well is by having a set of trustees where no single individual can go rogue and break privacy. But there's a very specific design tradeoff here.

And of course this is where designing Helios for different audiences is really tricky. Some users, like the IACR, are super expert and they can go through the complex setup process. Other users don't even understand what a key is.

I used to regularly get emails saying "I lost my private key, can you send me a new one?" But ... that doesn't work. So I made the trustee function really scary. By default, Helios manages the key, and privacy is not as strong. There's an ugly scary popup if you try to set up trustees.

And still, to this day, about once every 2 months, a user clicks through the scary popup that tells them that if they don't save their secret key, they won't be able to tally their election. Then they lose their key and email asking for help. Help that is mathematically infeasible for me to provide.