This protocol [1] implements the task of quantum E-voting. The participants in this family of protocols are one or more election authorities, the tallyer, and the voters. The election authorities are only trusted for the purpose of eligibility, and the voters do not share any entangled states with either the election authority (EA) or Tallier (T) to cast their ballots.

Quantum Voting Scheme Based on Conjugate Coding

• In the beginning, the election authority chooses a vector for encoding ballots which will be kept secret from the tallier until the end of the ballot casting phase.
• Then the EA prepares $w=polynomial(n)$ fragments that constitute a blank ballot and sends them to voters by an authenticated channel.
• After reception of the blank ballot, each voter re-randomises it and then applies a unitary to the blank ballot fragment and encodes the candidate of choice in the (n + 1)th-qubit of the last blank ballot fragment.
• Finally, she sends the ballot to the tallier over an anonymous channel.
• Once the ballot casting phase ends, the election authority announces the vector to the tallier so the tallier can decode each cast ballot by measuring it in the correct basis and announces the election result.

• The election authorities need to be trusted only for the purpose of eligibility; privacy should be guaranteed by the protocol against malicious parties.
• Existence of an anonymous channel and an authenticated channel.
• Computational hardness of a quantum problem, named one-more-unforgeability for QPT adversaries.

• A quantum anonymous channel between voters and tallier
• An authenticated channel between voters and the election authority.
• Measurement Device for the tallier.

• $V_{i}$: $i^{\text{th}}$ voter
• $c$: number of possible candidates
• $N$: number of voters
• $v_{i}$: vote of $i^{\text{th}}$ voter
• $T$: tallier
• $n$: security parameter
• $EA$: election authority

Verifiability: An adversary can change the vote of an eligible voter when the corresponding ballot is cast over the anonymous channel.
Privacy: EA can introduce a “serial number” in a blank ballot to identify a voter and therefore violate privacy.

Security: The security of the protocol relies on a quantum problem, named one-more-unforgeability, and the assumption that it is computationally hard for a quantum adversary.

• Setup phase:
  1. EA picks a vector $\bar{b} = (b_1, \ldots, b_{n+1}) \in \{0,1\}^{n+1}$ that will be kept secret from $T$ until the end of the ballot casting phase.
  2. For each $V_k$, EA prepares $w = \mathrm{poly}(n)$ blank ballot fragments, each of the form
     $$ |\phi_{\bar{a}_j, \bar{b}} \rangle = |\psi_{a_j^1, b_1} \rangle \otimes \cdots \otimes |\psi_{a_j^{n+1}, b_{n+1}} \rangle,\quad j \in \{1, \ldots, w\}$$
     where $\bar{a}_j = (a_j^1, \ldots, a_j^{n+1})$
     such that $(a_j^1, \ldots, a_j^n) \in \{0,1\}^n$ and $a_j^{n+1} = a_j^1 \oplus \cdots \oplus a_j^n$.
     The encoding states are defined as:
     $$|\psi_{0,0}\rangle = |0\rangle,\quad
     |\psi_{1,0}\rangle = |1\rangle,\quad
     |\psi_{0,1}\rangle = \frac{1}{\sqrt{2}}(|0\rangle + |1\rangle),\quad
     |\psi_{1,1}\rangle = \frac{1}{\sqrt{2}}(|0\rangle – |1\rangle)$$
  3. EA sends one blank ballot to each $V_k$ over an authenticated channel.
• Casting phase:
  1. Each $V_k$ picks, for each blank ballot fragment, a vector $\bar{d}_j = (d_j^1, \ldots, d_j^{n+1})$ such that
     $(d_j^1, \ldots, d_j^n) \in \{0,1\}^n$, and $d_j^{n+1} = d_j^1 \oplus \cdots \oplus d_j^n$.
     1. For all $j \in \{1, \ldots, w\}$, $V_k$ applies the unitary
        $$U_j^{\bar{d}_j} = Y^{d_j^1} \otimes \cdots \otimes Y^{d_j^{n+1}}$$
        to the blank ballot fragment $|\phi_{\bar{a}_j, \bar{b}} \rangle$, where:
        $$Y^1 = \begin{bmatrix} 0 & -1 \\\ 1 & 0 \end{bmatrix}, \quad Y^0 = I$$
        $V_k$ encodes the candidate of choice in the $(n+1)$-th qubit of the last blank ballot fragment.
  2. $V_k$ sends the resulting ballot to $T$ over an anonymous channel.
• Tally phase:
  1. EA announces $\bar{b}$ to $T$.
  2. $T$ decodes each ballot fragment by measuring it in the basis described by vector $\bar{b}$ and XORs the resulting bits. This is repeated for each ballot fragment, yielding a bitstring representing the actual vote cast.
  3. $T$ announces the election result.

1. Okamoto, Koutarou Suzuki Tatsuaki, and Yuuki Tokunaga. “Quantum voting scheme based on conjugate coding.” NTT Technical Review 6, no. 1 (2008): 1-8.