# Privacy-Preserving E-Voting System Supporting Score Voting Using Blockchain
## 5 The Proposed Voting Scheme
### Voting Phase  
During the _Vote_ phase, each voter \(\mathcal{V}_{i}\) sends his/her encrypted vote to the Blockchain as well as a proof that the submitted score falls within a publicly defined range \([0,P]\). To do this, we use a ZKP to prove that this condition is met. In order to accomplish this, we utilize a zero-knowledge set membership proof for each score to show that the score falls within the range without disclosing the assigned score.  
Before submitting the vote to the Blockchain, the voter first authenticates each element in \(\phi\) by using the election authority's public key. The main goal of this phase is to allow voters to verify that their votes will be submitted to the elections they belong to. This verification is useful especially when elections are held on different states and each state has a corresponding election authority's public key. In that case, the voter will verify that his vote is added to the state where he belongs. The verification is done by checking the following equality [34]:  
\[e(\mathcal{A}_{i},y\cdot g^{p_{i}})\stackrel{{?}}{{=}}e(g,g)\]  
The voter needs to prove in zero-knowledge that the score he/she selected lies in the set, as follow:  
1. The voter picks \(v\in_{R}\mathbb{Z}_{p}\) and computes \(V=\left(\mathcal{A}_{p_{o}^{(r)}}\right)^{p}\), where \(A_{p_{o}^{(r)}}\) is the election authority' signature on \(p_{o}^{(r)}\);
2. The voter picks random numbers \(t,m\in_{R}\mathbb{Z}_{p}\) and computes \[a=e(V,g)^{-s}e(g,g)^{t},\text{and }Q=g^{s}h^{m}.\]  
However, the underlying ZKSM [35] needs an interactive session between both the prover and the verifier and thus will lead to extra communication overheads due to multiple rounds of communication. Our solution is to leverage the Fiat-Shamir heuristic [36], to convert the interactive zero-knowledge scheme to a non-interactive protocol. Using the Fiat-Shamir heuristic, a challenge \(c\) can be calculated from public parameters as follows  
\[c=\mathcal{H}(\mathcal{M})\]  
where the \((\mathcal{M})\) is the smart contract address that holds the election.  
Then, he/she computes \(z_{p}=s-\left(p_{o}^{(r)}\right)c\), \(z_{v}=t-vc\) and \(z_{t}=m-vc\). Then, the proof of ZKSM is denoted as \(\pi=C\|c\|a\|Q\|z_{p}\|z_{v}\).  
Then, the voter needs to send a vote for each candidate by using the committed value and masks it with the shared secret \(\mathcal{S}_{v_{i}}\) as follows.  
\[\mathcal{V}_{v_{i}}^{c_{i}}=\mathcal{S}_{v_{i}}-P^{c_{j},c} \tag{1}\]  
where \(c\) is the challenge, and \(P^{c_{j}}\) is the score value. For example, assuming an election with two candidates and a voter \(v_{1}\), selecting a score of 2 for the first candidate and a score 4 for the second candidate, two votes will be submitted, as follows.  
\[\mathcal{V}_{v_{1}}^{c_{1}}=\mathcal{S}_{v1}-2.c\]  
\[\mathcal{V}_{v_{1}}^{c_{1}}=\mathcal{S}_{v1}-4.c\]  
Finally, he/she sends \(\pi\|\mathcal{V}_{v_{i}}^{c_{i}}\) as a transaction to the Blockchain.
3. Once the contract \(\mathcal{T}\) receives the proof \(\pi\), the Blockchain checks if it is from the registered voters, and the time of receiving the proof lies in the election interval window.  
The proof that \(C\) is a commitment to an element in \(\phi\) can be validated by the following statement [35].  
\[\mathbf{PK}\bigg{\{}(p_{o}^{(r)},\iota,v):C=g^{p_{o}^{(r)}}h^{\prime}\wedge V =g^{\frac{-\pi}{s+p_{o}^{(r)}}}\bigg{\}} \tag{2}\]Proving that the statement in (2) is done in the Blockchain by checking the following conditions:  
\[\mathcal{Q}\overset{?}{=}C^{t}h^{z_{t}}g^{z_{p}} \tag{3}\]  
\[a\overset{?}{=}e(V,y)^{c}\cdot e(V,g)^{-z_{p}}\cdot e(g,g)^{z_{o}} \tag{4}\]  
Once the two conditions in 3 and 4 are verified by the Blockchain, the vote will be added permanently to the Blockchain. The Blockchain will accept the authorized voters' vote if it is correctly constructed by the driver Due to the _Soundness_ and _Completeness_ property of ZKSM [35].