Applications / Policy & Governance

How can voters check that an election was counted correctly without making their individual choices public?

INTEGYRS is experimenting with an architecture that separates those two requirements. Its voting research combines locally encrypted ballots, zero-knowledge proofs, a public evidence layer and independently reproducible tally checks, while proposing a separate role for BSV Script in constraining how accepted election state can change.

The project is not offering a live election service. Its current implementation covers the ballot-proof and audit core using synthetic single-choice elections, while the proposed BSV Blockchain enforcement path still requires node-execution testing and further validation.

That distinction makes the project particularly suitable for Under the Surface: enough of the system exists to examine how the model is intended to work, while some of its most consequential security properties remain openly unresolved.

Encrypt the Choice, Prove the Ballot Is Valid

The experimental ballot system uses ElGamal encryption, allowing the voter’s selection to remain encrypted rather than being published as plaintext.

Alongside that encrypted ballot, the voter produces a zero-knowledge proof.

In simple terms, the proof is intended to show that the encrypted ballot contains an allowed choice without revealing which allowed choice was selected.

INTEGYRS says its current pilot implements this for synthetic single-choice elections using Chaum–Pedersen-style proofs. The proofs can be checked offline, allowing another verifier to determine whether the ballot satisfies the expected mathematical rules without first decrypting the individual vote.

That solves only one part of the voting problem.

A valid encrypted ballot does not prove that the person was entitled to vote, that the voting device was trustworthy, or that the encrypted choice actually reflects what the voter intended to select.

INTEGYRS treats those as separate security questions rather than allowing one successful cryptographic check to stand in for the entire election.

A Public Evidence Board Without Publishing the Vote

After a ballot passes the relevant checks, the proposed architecture places its encrypted evidence into an append-only evidence system.

The voter can receive a receipt and later check whether the accepted ballot appears in that evidence set.

The tally can then be computed using homomorphic aggregation, which allows encrypted votes to be combined mathematically before the aggregate is decrypted.

The goal is to let independent auditors reproduce and verify the count without requiring publication of each voter’s plaintext choice.

This creates several different verification questions:

• Was the submitted ballot mathematically valid?
• Was it included in the accepted set?
• Does the final tally follow from that set?
• Can the voter verify participation without gaining transferable evidence of the exact choice?

INTEGYRS explicitly separates those questions because succeeding at the first three does not automatically solve the fourth.

Where BSV Blockchain Enters the Design

The BSV Blockchain component addresses a different layer from ballot encryption.

INTEGYRS proposes using spendable outputs and Bitcoin Script to constrain permitted election-state transitions.

Rather than placing a voting record in an OP_RETURN and treating its presence on-chain as enforcement, the intended model uses locking and unlocking conditions to determine which state changes can validly spend the previous election-state output.

That could allow the election process to represent stages whose successors must satisfy predefined transaction conditions.

However, this remains a design and validation target rather than a completed BSV Blockchain implementation.

INTEGYRS states that the Script path still needs node-execution testing, negative-witness testing, transaction-policy checks and explicit rules for observing the chain before the project can claim that election-state transitions are actually being enforced by BSV Script.

Offline proof verification and blockchain enforcement therefore have different jobs.

A zero-knowledge proof may establish something about the encrypted ballot.

A Script condition may constrain whether a particular state transition can be spent.

Neither one, by itself, establishes the complete security of an election.

Verification Is Not the Same as Coercion Resistance

One of the most important limitations appears in the project’s own documentation.

The current construction does not achieve receipt-freeness or coercion resistance.

A voter who retains the randomness used during encryption can potentially demonstrate their choice to another party.

That creates a problem even if ballot secrecy against the general public remains intact.

A voting system should not only make it difficult for outsiders to discover how somebody voted. It may also need to prevent the voter from producing convincing evidence of that choice to an employer, buyer, coercer or other third party.

Otherwise a technically private ballot can still support vote buying or pressure.

INTEGYRS identifies this as an unresolved security requirement rather than presenting encrypted ballots as a complete answer to voting privacy.

Eligibility Is Another Separate Problem

The project makes a similar distinction around voter identity.

Its current tests use pseudonymous credentials rather than a production system for anonymous voter eligibility.

Future possibilities discussed by INTEGYRS include cryptographic credentials, online identity verification and remote video-assisted checks.

But the project does not claim that these have been implemented.

It also states that identity checking must remain separated from ballot observation. A person or service helping establish that somebody is eligible to vote should not thereby gain visibility into how that person votes.

Metadata linkage, duplicate credentials, compromised voting devices and trustee collusion remain part of the broader threat model that would need to be addressed before a real election system could be evaluated.

Implemented Experiment, Proposed Chain Enforcement

This distinction between implemented and proposed work is particularly important for INTEGYRS.

The current Voting page identifies the ballot proof and audit core as an implemented experiment.

That includes local encryption, proof verification, evidence handling and independent tally checks against synthetic single-choice fixtures.

The BSV spending-condition layer is listed separately as design / validation pending.

The page also states that the voting architecture is a research and engineering pilot rather than an election service. It does not collect live ballots, connect to a voting backend, claim deployment certification or assert end-to-end election security.

The wider INTEGYRS project has reported larger experimental test counts—195 offline tests and 47 isolated private-node checks—but those belong to its digital-ownership and access work rather than proving that the voting architecture has already passed BSV Blockchain node tests.

Keeping those test programs separate avoids giving the voting work evidence that was gathered for a different system.

Three Different Things a Voting System Must Prove

The useful part of the INTEGYRS experiment is that it makes several commonly blurred questions visible.

A voting system can prove that a ballot is valid without proving who was eligible to cast it.

It can prove that an encrypted ballot was counted without proving that the device faithfully represented the voter’s intent.

It can reproduce the final tally without preventing a voter from later demonstrating their choice to somebody else.

And it can record state on a blockchain without proving that every election rule was actually enforced by blockchain Script.

Those distinctions matter because “verifiable voting” can otherwise sound like one property.

In practice, it is a collection of different properties that have to work together.

Why BSV Script Could Matter

If the proposed chain component is eventually demonstrated, its role would not be to make the vote public.

The ballot itself remains encrypted.

Instead, BSV Script would participate in enforcing the allowed transitions of the election process.

That is a more specific use of blockchain than simply publishing election records for timestamping.

The blockchain could become part of the rule system governing which election state may validly follow another, while independent evidence allows participants to examine what was accepted and how the tally was produced.

Whether that architecture proves practical will depend on the next stages INTEGYRS itself identifies: defining the exact boundary between Script and external verification, executing the spending path against a BSV node, testing concurrent submissions and recovery, improving anonymous eligibility and receipt-freeness, and obtaining independent cryptographic and operational review.

For now, the project offers an interesting experimental separation of responsibilities:

encrypt the individual choice, prove allowed ballot structure, preserve independently checkable election evidence, verify the aggregate tally, and explore whether blockchain spending conditions can enforce the permitted state changes underneath the process.

The unresolved pieces are substantial, particularly coercion resistance and the untested BSV Script path.

But the project is valuable precisely because those boundaries are visible rather than hidden behind a broad claim of “blockchain voting.”

Developer Context

INTEGYRS is an experimental technology project currently focused more broadly on digital ownership, controlled access and protected-device architecture.

Its wider software alpha has tested ownership transitions, authorization boundaries, conflict and recovery behavior using offline software and an isolated BSV regtest node. Protected-device implementation, independent cryptographic review and public-network deployment remain later milestones.

The Voting project extends that research into a separate application area, using encrypted ballots and independently checkable evidence while exploring BSV Script as a possible election-state enforcement layer.

The public Voting material does not identify an individual developer responsible for this component, so the work is best attributed to INTEGYRS rather than assigning authorship without stronger evidence.

Source Links

INTEGYRS — Private, Verifiable Voting

INTEGYRS — Evidence and Experimental Results

INTEGYRS — Security and Trust Boundaries

INTEGYRS — Technology and Device Architecture

BSV TIMES – Under the Surface

Under the Surface looks at projects, standards, experiments, and community activity that may not rise to the level of a headline but are still worth noticing. Some are new, some are continuing work, and some are quieter developments that help show what is taking shape across the BSV community.

Update — November 6, 2026