# Practical I-Voting on Stellar Blockchain
## 3 System Proposition
### Architecture of I-Voting on Stellar Platform  
Ethereum provides high flexibility, mainly because of its fully-fledged smart contracts ecosystem, especially its Turing-complete Ethereum Virtual Machine (EVM), which allows it to run any domain-specific scripts. On the other hand, Stellar is a blockchain platform specializing just in one of infinite many Ethereum applications--asset tokenization [36]. Those tokens can represent almost everything, company shares, stocks, national currencies, commodities, personal tokens [37], or even other tokens or cryptocurrencies. For us, the token represents vote-ballots. Issuing a token on Ethereum requires preparing and publishing a smart contract, which can be relatively expensive and error-prone [38]. Since tokens are first-class citizens of the Stellar network, they can be easily issued, managed, and optimized. The most important advantage over Ethereum in large-scale elections is the transaction fees, which in Stellar are nearly free. At the time of writing, USD 0.0000008 per operation. In Stellar, we distinguish transaction and operation. Each transaction holds up to 100 operations. All operations within a transaction are executed atomically, while Ethereum consumes (depending on the smart contract) about USD 0.5 per transaction. Additionally, Stellar allows specifying a source account that will pay a transaction fee--in our case, voting organizers. We leverage this functionality to create user-friendly voting flow, abstracting users from used blockchain technology. In this section, we describe our approach to the implementation of the voting system on the Stellar public network. Based on our framework, we demonstrate how it can be used to implement an i-voting system for making e.g., presidential elections. The proposed system consists of three parties shown in Figure 2: Government, Electoral, and Blockchain. Both Government and Electoral distrust each other because they have an interest in manipulating the process of election. Electoral demand from Government to be as transparent as possible. The government performs the authentication and authorization process to prevent unauthorized votes or double vote token issuance. Transparency and Verifiability are achieved by storing votes in the Stellar blockchain. The blockchain's openness allows the votes to be audited and counted by anyone, either by querying public nodes or joining the network with its own node. Voter Privacy is achieved by breaking the link between authentication and authorization using the blind signature technique (discussed in Section 3.4). As a result, the voter who gets authorized can not be linked with its identity used in the authentication process. Authorized voters receive from TDS the vote token to their temporary wallet created on the client-side app. The vote token is then sent to the ballot-box account, where the election results are counted. The transaction is submitted directly to the public blockchain nodes or nodes hosted by organizers (in the next section we describe, why the fact that transaction goes through organizer nodes does not break the voter privacy). When any of the blockchain nodes receives the transaction, it gets validated and is included in the next block (Stellar uses the notion of ledger instead of block). Since the Stellar blockchain is public, everyone can query the blockchain node and count the transactions that were sent to the ballot-box. The ballot option is stored in the transaction's extra field (in Stellar transaction, the extra field is called \"memo\"). This field must be encrypted, preventing preliminary results, which are illegal in most countries. We will discuss the encryption method in Section 3.3. To ensure maximum confidentiality, Identity Provider (IdP), and Token Distribution Server (TDS) should be separate entities. However, in our framework, we assume the pessimistic scenario, where they both cooperate to manipulate election results. In such, we can not base the voter privacy on the assumption that the IdP will not reveal the voter identity.