Homomorphic encryption can count votes nobody can read. So why is your ballot still paper?

On election day most American voters marked a paper ballot, even though cryptography can already add up encrypted ballots without anyone reading one.…

Loading

trail of bits·2026-11-06·PT1M53.133S

video loads only when you press play

On election day most American voters marked a paper ballot, even though cryptography can already add up encrypted ballots without anyone reading one.…

// the short version

On election day most American voters marked a paper ballot, even though cryptography can already add up encrypted ballots without anyone reading one. Trail of Bits walked through how systems like Helios and ElectionGuard do it, and why election security experts still keep the paper.

// what to take away

Encrypting every ballot to one server key fails, because whoever holds the private key can read every vote. Helios and ElectionGuard use exponential ElGamal instead, where multiplying two encrypted ballots gives an encryption of their sum, so thousands of ballots combine into one encrypted total and only that total is decrypted.
The decryption key is split between several officials and a threshold of them must cooperate; the IACR had to rerun its 2025 Helios election when one of three required trustees lost their share. A zero-knowledge proof on every ballot shows each value is 0 or 1, so a tampered machine cannot encrypt 1,000,000.
The proofs show the sum is right, not that a machine encrypted what the voter chose, and a flaw in one machine model can reach every jurisdiction that runs it. That is why election security experts keep paper ballots, and why ElectionGuard has only been piloted on top of them, never instead of them.

What this is about: checking a count, not voting online

On election day most American voters mark a paper ballot. Trail of Bits, a security firm, used that day to explain why, and what cryptography can and cannot add to an election. Its post walks through two real systems, Helios and ElectionGuard, and ends where security researchers generally end: paper stays.

It helps to separate two ideas that are easy to blur. Online voting (also called electronic ballot return or internet voting) means sending a marked ballot over the internet. The post cites the National Academies of Sciences' 2018 report on election security, which concluded that no known technology can yet guarantee that a ballot sent that way stays secret, secure and verifiable, and that it should not be used in general elections. Verifiable voting is the other idea: using cryptography so that voters and observers can check that the count is right, usually alongside paper. ElectionGuard is the second kind. This page is about the second kind.

The four things every election system has to guarantee

The post lists four requirements, and every design below is judged against them:

Privacy. Nobody can learn how you voted, even if you would like to prove it to someone, for example because they are paying you.
Integrity. A ballot cannot be changed after it is cast. This is harder electronically because voters usually have no cryptographic identity to sign their ballot with, and the voting device or the server may be compromised.
One vote each. Nobody votes twice, which is hard to check without linking votes to voters.
A trustworthy result. Everyone can trust, and ideally verify, that the result reflects what voters meant.

Paper meets the first three with physical procedure: you show ID to a poll worker, fill in an unnamed ballot in a private booth, and watch it go into the box. Attacking that at national scale is expensive and noisy. The fourth requirement is the hard one for paper: you trust the people counting, plus chain-of-custody rules and post-election audits. That gap is what cryptography can help with.

Why the obvious encrypted design fails

Encrypting each ballot is the natural first step: the voting device encrypts it with a public key, so it cannot be read in transit. But the question is who holds the matching private key. If it is the election server, the server can decrypt every ballot as it arrives, and voter privacy rests entirely on that one machine and whoever controls it. Even if ballots arrive anonymously, the server would still learn how a given polling place voted.

So the design has to avoid ever decrypting individual ballots at all.

Adding votes while they are encrypted

Helios and ElectionGuard use encryption that is additively homomorphic: combining two encrypted numbers produces an encryption of their sum. The server never needs to read a ballot. It combines every encrypted ballot into one encrypted total, and only that total is ever decrypted.

The scheme is a variant of ElGamal called exponential ElGamal. Trail of Bits describes it using the Helios version, which is closer to textbook ElGamal (ElectionGuard's differs slightly). In outline:

election public key   K = g^k             (k is the private key)
encrypt a choice x    E(x) = (g^r, K^r · g^x)       r is fresh randomness
combine two ballots   E(x) ⊕ E(y) = (g^r · g^s, K^r g^x · K^s g^y)
                                  = (g^(r+s), K^(r+s) · g^(x+y))
                                  = E(x + y)

The "addition" is pointwise multiplication of the two ciphertext parts, which is why the video says multiplying two encrypted ballots gives their encrypted sum. A yes is encoded as 1 and a no as 0, so the encrypted total of a yes/no question is an encryption of the number of yes votes.

There is one wrinkle. Decrypting gives back g^x, not x. Recovering x from g^x is normally infeasible, but a vote total is small enough to find by trying values in turn or looking it up in a table.

Splitting the key so nobody holds it

If one person held the private key, they could still decrypt individual ballots. So the key is threshold-shared: it is split between N trusted officials (ElectionGuard calls them guardians), and some fixed number of them, t + 1, must cooperate to decrypt anything. No smaller group can decrypt a single ballot. Privacy holds as long as enough of the officials stay honest that the dishonest ones cannot reach the threshold.

The threshold has to be chosen with care, and Trail of Bits points to a real case. The International Association for Cryptologic Research (IACR) runs its board elections on Helios. In its 2025 election the decryption key was split between three trustees and all three were required. One trustee irretrievably lost their share, the result could not be decrypted, and the IACR voided the election and ran it again from 21 November to 20 December 2025, according to its own notice. A threshold of "all of them" turns one lost key into a lost election.

Stopping a tampered machine from voting a million times

Homomorphic tallying opens a new hole. If nobody ever looks inside a ballot, a compromised voting device could encrypt the value 1,000,000 instead of 1 and vote yes a million times, and the encrypted ballot would look like any other.

The defence is a zero-knowledge proof attached to every encrypted ballot. It is a short piece of math that anyone can check, and it proves that each encrypted value is a 0 or a 1, without revealing which. A ballot whose proof fails is rejected.

Real ballots have more than one question and limits on how many choices a voter may make. ElectionGuard handles limits with placeholder selections: extra encrypted values that pad each contest so the total always equals the limit. The proofs then show that every value, real or placeholder, is a 0 or a 1 and that they add up to exactly the limit, which proves the voter did not exceed it without revealing whether they undervoted.

Note what the proof does not show. It shows the value is 0 or 1. It cannot show that the 0 or 1 is the choice the voter actually made. That gap is the subject of the next two sections, and it is why paper stays.

What the math cannot see: a voting machine that lies

A compromised device could record a different choice than the one the voter selected, encrypt that, and attach a perfectly valid proof. Both Helios and ElectionGuard use Benaloh's challenge against this. The video left it out for length.

When the device encrypts your ballot, it shows you a commitment to the encrypted ballot before it knows what you will do next. You can then either cast it or challenge it. A challenged ballot is opened (spoiled), you check that it contains your real choices and matches the commitment, and you vote again. Because the device cannot know in advance which ballots will be challenged, a device that cheats on many ballots will be caught by some of them. The order matters: if the device learned about the challenge first, it could show an honest commitment only when it was going to be checked. Voters also need an independent way to confirm that the opened ballot matches the commitment, or the device could simply lie about that too.

The protection is statistical. Trail of Bits gives an example: if a device tampers with 1,000 votes and voters challenge one ballot in a hundred, the chance that no tampered ballot is challenged is 0.99 to the power 1,000, about 4.3 in 100,000. That only works if enough voters actually challenge, and if a voter who finds tampering has somewhere to report it and a reason to. It also does nothing against a device that quietly sends your plaintext choice to a third party.

Checking the server: the public record

Encryption protects privacy but does not stop a server from dropping, changing or inserting ballots. So the encrypted ballots are published to a public bulletin board, which becomes the election record. Each voter keeps their commitment and can look up their own encrypted ballot to confirm it was included and not altered, without anyone learning how they voted.

ElectionGuard goes further by chaining the commitments made on each device: each ballot's commitment is a hash of the previous commitment and the new encrypted ballot, roughly c2 = H(c1, B2). The chain is published too, so tampering with any earlier ballot from that device changes every commitment after it, and a later voter can notice.

Two limits remain. Detection again depends on many voters checking. And a server that adds ballots for people who never voted is hard to catch from the record alone; that takes outside data such as voter participation records. Once the record is trusted, anyone can recompute the encrypted total from it, and the officials publish a zero-knowledge proof that they decrypted that exact total correctly.

End-to-end verifiability, and why paper still stays

Together these give end-to-end verifiability: each voter can check that their choice was recorded as cast, and anyone can check that the published result was computed correctly from the record. Paper on its own cannot offer the first part without trusting people, because protecting secrecy deliberately breaks the link between you and your ballot once it leaves your hand.

What cryptography does not remove is the risk unique to electronic systems. A supply-chain compromise or an unknown vulnerability in one model of voting machine can reach every jurisdiction that runs it, potentially letting one person change an outcome without being detected. The design principle the post emphasises is software independence: a change or error in the voting software must be detectable, and in practice that means evidence the software cannot rewrite, such as a paper ballot that can be audited.

Trail of Bits notes widespread agreement among election security experts that paper ballots are essential and are not going away soon. Helios explicitly targets low-stakes, low-coercion settings like the IACR's elections and advises against high-stakes public use. ElectionGuard is built as a layer on top of an existing paper-based system, not a replacement for it. Neither claims to make purely electronic voting as secure as paper.

Where ElectionGuard has actually been used

ElectionGuard is an open source project started by Microsoft. It has been tested in a small number of real elections, each time alongside paper ballots: Fulton, Wisconsin in February 2020, where the official count was still done on paper as usual; Franklin County, Idaho in the 2022 midterms; and College Park, Maryland in its November 2023 municipal election, according to Microsoft and local reporting.

It is not how most votes were counted on 3 November 2026. Most were cast on paper, read by optical scanners and, in many places, checked by post-election audits. That reading is ours, based on the post's own description of the midterms; this page makes no claim about any particular race.

Terms

Ballot secrecy: The guarantee that nobody can learn how a voter voted, including when the voter wants to prove it.
End-to-end verifiability: A voter can check their ballot was recorded as cast, and anyone can check the result was computed correctly from the published record.
Homomorphic encryption: Encryption where operations on ciphertexts correspond to operations on the hidden values. Additively homomorphic means you can add encrypted numbers without decrypting them.
Exponential ElGamal: A variant of ElGamal encryption that puts the message in an exponent, so multiplying ciphertexts adds the messages. Used by Helios and ElectionGuard.
Threshold decryption: A private key split among several parties so that only a set number of them together can decrypt. ElectionGuard calls the key holders guardians.
Zero-knowledge proof: A proof that a statement about hidden data is true (here, that an encrypted value is 0 or 1) which reveals nothing else about the data.
Placeholder selection: An extra encrypted value ElectionGuard adds to a contest so the total always equals the selection limit, letting a proof show the limit was respected.
Benaloh's challenge: A cast-or-challenge step in which a voter can open (spoil) an encrypted ballot to check the device recorded their choice honestly, then vote again.
Bulletin board: The public election record of encrypted ballots that voters and observers check against.
Software independence: The property that an undetected error or change in voting software cannot cause an undetectable change in the outcome; in practice achieved with auditable paper records.
Write-in: A vote for a name not printed on the ballot. ElectionGuard counts how many write-ins a contest received but not what was written.

Questions

Did ElectionGuard count the votes in the 2026 midterms?

No. ElectionGuard has run in a few pilots, always alongside paper ballots. In the 2026 midterms most votes were cast on paper and counted by optical scanners, with post-election audits in many places. The video describes how verifiable systems work, not how any particular race was counted.

Why don't we just vote online?

The National Academies' 2018 report, which Trail of Bits cites, concluded that no known technology guarantees the secrecy, security and verifiability of a marked ballot sent over the internet, and recommended against it for general elections. A flaw in an online system can scale to every voter at once, while tampering with paper at the same scale is costly and visible.

If every ballot stays encrypted, how is the result ever read?

The encrypted ballots are combined into one encrypted total, and only that total is decrypted. Decryption needs a threshold of key holders working together, so no single official can decrypt anything, including an individual ballot.

Could a hacked voting machine cast a million votes in one ballot?

Not undetected in these systems. Every encrypted ballot carries a zero-knowledge proof that each value is a 0 or a 1, and a ballot that encrypts a larger number cannot produce a valid proof. What the proof cannot catch is a machine that records a valid 0 when you chose 1, which is why voters can challenge ballots and why paper is kept.

What happens to write-in votes?

In ElectionGuard a write-in is just another selection, so the encrypted tally shows how many people wrote someone in for a contest, not who. The names are read from the paper ballots. Helios's homomorphic mode does not support write-ins; the proposed workaround is a different technique called a mixnet, which shuffles encrypted ballots and decrypts them individually so free text can be read without linking it to a voter.

How would I check that my own vote was counted?

In an end-to-end verifiable election you keep a commitment (a tracking code) for your encrypted ballot and look it up on the public bulletin board after the election. In an ordinary paper election there is no equivalent: once your ballot is in the box, you rely on officials, chain of custody and audits.

Why did the IACR have to rerun an election?

Its Helios election split the decryption key between three trustees and required all three. One trustee irretrievably lost their share, so the result could not be decrypted, and the IACR voided the election and ran it again from 21 November to 20 December 2025.

// further reading

The cryptography behind electronic voting (and why paper ballots are still essential) ↗: Trail of Bits' full walk-through, with the math and the footnotes this page draws on.
ElectionGuard: Structure and Processes ↗: how ElectionGuard encrypts ballots, uses placeholders, handles write-ins and decrypts with guardians.
IACR notice on its 2025 election ↗: the association's own account of the lost key share and the rerun.
The inside story of Microsoft's ElectionGuard pilot in Wisconsin ↗: the first real-world test, in Fulton in February 2020.

// transcript

You file your taxes online, so why is your ballot still paper? On Tuesday most Americans voted on a paper ballot, and it isn't because nobody has worked out how to count votes with cryptography. The obvious design encrypts each ballot with the election's public key, so only the matching private key can read it, and lets the server decrypt them all and add them up, but then whoever holds that private key can read every single vote. So systems like ElectionGuard, which has been tried alongside paper in a handful of local elections, use encryption you can do arithmetic on. A yes goes in as an encrypted one and a no as an encrypted zero, and because of how the math is built, multiplying two of them gives you their sum, still encrypted, so thousands of ballots collapse into one encrypted total without anyone opening a single one. Only that total is ever decrypted, and the key that opens it is split between several election officials, so none of them can open anything alone. Hiding every ballot does open a new hole, though, because a tampered machine could encrypt 1,000,000 instead of a one, and nobody would see it, so every encrypted ballot carries a zero-knowledge proof, a bit of math anyone can check, showing it holds a zero or a one without revealing which. The encrypted ballots are published too, so you can look up your own and check it was counted, which a paper ballot can't tell you once it leaves your hand. Even so, election security experts say the paper stays, because the math proves the ballots were added up correctly, not that the machine encrypted what you actually picked, and in a purely electronic system, one flaw in one model of machine could reach every county that runs it without leaving a trace. That's why ElectionGuard runs on top of paper ballots, never instead of them. The math lets you check your vote, and the paper lets everyone check the computer.

// source

This explainer is based on The cryptography behind electronic voting (and why paper ballots are still essential) by Trail of Bits ↗. The original reporting and technical work belong to its publisher.