A UC-Secure Protocol for Privacy-Preserving Preferential Voting with Verifiable Encrypted Ballots

Preferential voting allows participants to rank multiple alternatives according to their preferences rather than being restricted to selecting a single option. Such mechanisms are used in national and local elections and, in decentralized governance, can be applied to committee selection, the prioritization of protocol upgrades or funding applications, and the choice of an electricity supplier or energy source. Of particular practical interest are systems in which participants have different stakes and their voting weights are proportional to those stakes. In the model considered in this work, each voter submits a complete ranking of the alternatives. The key technical challenge is to verify that an encrypted ballot encodes a valid ranking, that is, that exactly one rank is assigned to each alternative and each rank is used exactly once, without revealing the voter’s preferences. We propose a UC-secure protocol for privacy-preserving preferential voting with verifiable encrypted ballots. A ranking is represented as a permutation matrix whose entries are encrypted using an additively homomorphic cryptosystem. To verify ballot validity, each encrypted row of the matrix is accompanied by a non-interactive zero-knowledge proof that it is a unit vector. The encrypted rows are then homomorphically summed, and the resulting vector is checked against the all-ones vector. Together, these checks ensure that the encrypted matrix is a permutation matrix without revealing the ranking itself. Using an O(logm)-size unit-vector proof for each of the m rows yields O(mlogm) ballot-validity proof data, while the overall ballot size remains O(m2) because the encrypted matrix contains m2 ciphertexts. The protocol supports stake-weighted tallying and threshold decryption, so that only the final aggregate result is revealed. The UC security of the protocol is established in the random-oracle model under the Decisional Diffie–Hellman (DDH) assumption. The theoretical analysis shows that the computational complexity of generating and verifying a single ballot is O(m2) and that the ballot size is also O(m2), where m is the number of alternatives. The experimental results are consistent with this quadratic scaling: for 32 alternatives, the mean ballot-generation time is 87 ms, the mean verification time is 36 ms, and the reported cryptographic ballot payload is 106 KiB. These measurements indicate practical ballot-construction and verification costs for elections with a moderate number of alternatives.