Blockchain-based Economic Voting with Posterior Security from Lattices

Blockchain-based Economic Voting with Posterior Security from Lattices Navid Abapour1Amir Goharshady2Catalin Dragan1 Mahdi Mahdavi3 1Surrey Centre for Cyber Security, University of Surrey {n.abapour,c.dragan}@surrey.ac.uk 2Department of Computer Science, University of Oxford [email protected] 3K-ryptography and Information Security for Open Networks, Universitat Oberta de Catalunya [email protected] September 2025 Abstract Electronic voting has demonstrated that it streamlines the democratic process, making it more convenient for citizens and enhancing the accuracy and speed of election results in real-world scenarios in the US, Estonia, Switzerland, and many other countries. One major challenge for e-voting, especially online voting, is ensuring that voting and tallying devices behave honestly, particularly in cases involving monetary transactions. These are addressed by economic voting, where everything is on-chain; in essence, voters utilize smart contracts to conduct all voting stages. There are very few results on economic voting, and none post-quantum secure. The challenge comes from having the entire voting system run by smart contracts. In this work, we propose the first postquantum economic voting scheme, which combines hybrid onand off-chain operations, called the Post-Quantum Blind Vote (PQBV). The core idea is to utilize smart contracts that enable blind signatures during the voting process. We enhance our contribution by introducing a post-quantum blind signature with Posterior Security, as proposed by Yuen et al. (CCS 2025), which retroactively enhances the privacy of already generated signatures. This has a significant impact on PQBV, as it is able to satisfy formal cryptographic privacy definitions, including ballot privacy. Our efficiency analysis reveals competitive 1 performance compared to existing state-of-the-art post-quantum e-voting systems, such as Epoque (EuroS&P 2021), which is done without blockchain. Keywords: Electronic Voting, Lattice-based Cryptography, Economic Voting, Blind Signature, Posterior Security 1 Introduction Electronic voting is considered an outstanding step towards modern democracies, as it enhances accessibility, security, and efficiency in elections, driven by a growing interest among citizens in integrating technology into government affairs [1], as they represent a firmly established and expanding component of electoral infrastructure, demonstrably employed for a spectrum of elections—from country-wide polls to local contests—in numerous countries, including, but not limited to, the US, Estonia, India, Switzerland, France, and Australia [2]. In some real-world financial scenarios where an election takes place (e.g., an auction), the voting process happens off-chain, and then the transaction happens separately on-chain using cryptocurrency. This separation in the process is inefficient, as it requires additional time and energy. This challenge can be addressed by utilizing e-voting schemes based on smart contracts, which are referred to as Economic Voting 1 [3]. For example, in an online casino or an auction [4], it is more efficient to conduct part/or all of the procedure on-chain because the entire transaction, including the money and voting, will be processed directly on the same route, and provides better transparency on the money flow [4,5]. Additionally, it has been demonstrated that blockchain provides a reliable foundation for implementing a public bulletin board, offering a proactive approach to ensuring the integrity of published records by preventing retroactive modifications [6,7]. However, not only are there a few promising results on blockchain-based voting, but also limitations occur as basing the voting system fully on-chain can fail to address core vulnerabilities like device compromise and network attacks [8] while introducing additional risks such as complexity, weak ballot secrecy, key management issues, scalability problems, and dependency on unproven technologies, and offer limited security benefits over simpler alternatives like traditional databases or paper ballots [9] and complicates governance and rapid vulnerability response. The existing economic approaches for voting are not cryptographically sufficient; for example, the Blind Vote lacks formal definitions of key terminology, such as secrecy and anonymity. Not only is this scheme not formalized, but it also lacks a formal proof of privacy and does not provide provable security guarantees [5]. It is based on classical computational assumptions, such as RSA, that, apart from its conventional vulnerabilities [10], is vulnerable to quantum attacks [11–13]. Despite the absence of post-quantum economic voting systems, from the postquantum side, there has been substantial work on lattice-based non-economic e1 Economic voting, where voting processes are integrated with financial transactions on a blockchain, offers advantages in scenarios requiring both democratic decision-making and monetary flows. For instance, in Decentralized Autonomous Organizations (DAOs), stakeholders vote on funding proposals using governance tokens, where the voting outcome directly triggers on-chain fund allocation (see https://ethereum.org/en/dao/). 2 voting [14 – 16]. However, it is not straightforward to integrate a smart contract into this approach, as it requires compatible assumptions and primitives. For example, Epoque [14] is a significant result in post-quantum non-economic voting; but, Epoque ’s utilization of multiple components, such as identity-based encryption with complex non-interactive zero-knowledge proofs, cannot be efficiently implemented or verified within the computational and gas constraints of current smart contract platforms. In addition, as a recently presented concept, Posterior Security enables the enhancement of privacy properties for already-generated standard signatures without requiring access to the original signing keys [17], allowing applications to retroactively gain stronger anonymity and message hiding guarantees. This capability is particularly valuable in our blockchain voting context, as it permits the upgrading of deployed systems with enhanced privacy features while maintaining compatibility with existing signature infrastructure and enabling voters to obtain unlinkable ballots from standard blind signatures. So, the problem is how to achieve a posterior-secure voting scheme that can support economic operations and be securely used in the post-quantum era? Contributions. In this work, we use the potential of blockchain to design postquantum economic voting with lattices, then we embed this variant into an efficient structure of Blind Vote [5], along with achieving ballot privacy. Our contributions include: – presenting the first provable ballot-private voting system based on smart contract; a step towards bridging the gap between cryptographers and the cryptocurrency communities’ idea on blockchain-based voting. – constructing a Post-Quantum version of Blind Vote (PQBV) using lattices. – demonstrating the first formalization and application of Posterior Security in blockchain, enabling anonymity and message hiding for an already generated standard signature, even by someone who has no access to the signing key. Organization. Section 3 establishes the notation and building blocks necessary for our construction. Section 4 introduces the concept of posterior security and formalizes our blind signature scheme. Section 5 presents the complete construction of our postquantum blockchain voting system PQBV , detailing the integration of functions with smart contracts. Section 6 presents a formal security proof that demonstrates our scheme achieves ballot privacy and unforgeability, while also analyzing its computational complexity and comparing our scheme’s performance with Epoque [14]. Finally, Section 7 summarizes our contributions and discusses future research directions. 2 Related Works To the best of our knowledge, no post-quantum economic voting scheme has been presented that has been proven to be ballot-private. Therefore, in this section, we highlight the need for such a scheme by examining the most similar schemes to ours, as presented from both cryptographic and cryptocurrency perspectives. 3 2.1 The Existing Lattice-based E-voting Schemes To highlight the gap mentioned in the previous section, due to not considering economic operations and inheriting a high computational cost, these lattice-based schemes [14–16] cannot easily be transformed into variants with blockchain. 2.1.1 Epoque [14] In this system, each voter Vi encodes their vote as v i =( vi,j ) ncand j=1 ∈{ 0 , 1 }ncand and secret shares each component among nT trustees as vi,j =( vi,j 1, ...,vi,j nT ), then commits to each share using a homomorphic commitment scheme ci,j k←Com ( prmcom,vi,j k ; ri,j k )and encrypts the opening values under trustee Tk ’s IBE master public key using identity i : ei k←Enc ( prmk,i ;( vi,j k,ri,j k ) ncand j=1 ). During tallying, each trustee Tk uses master shortcut decryption to verify ballot validity and publishes vj k←PnV i=1vi,j k and rj k←PnV i=1ri,j k for each candidate j , with correctness verified via Open ( prmcom,vj k,cj k,rj k )=1 where cj k←PnV i=1ci,j k using the homomorphic property. If a trustee claims a ballot is invalid, they must publish the voter’s individual IBE secret key mski k←Extr ( prmk,mskk,i ) to prove the claim. 2.1.2 Lattice-Based Electronic Voting from NTRU [15] This schme works using NTRU encryption combined with threshold blind signatures, where each voter Vi encrypts their vote v∈Rp as c = p ( hs + e ) + v∈Rq using NTRU public key h = g/f and encryption randomness ( s,e ) ∈S2 ν , then obtains a threshold blind signature σ from at least t signing authorities on the ciphertext c . The ballot b =( c,σ )undergoes verifiable shuffling through ξ1 mix servers using NTRU-based mix-nets with zero-knowledge proofs πSmall and πShuf to prove correct re-randomization and permutation, followed by threshold distributed decryption where each of ξ2 decryption servers computes shares dsi,j = dkj·ci + p·Ei,j with noise drowning Ei,j ←SBDrown and provides exact zero-knowledge proofs πLin and πBnd of correct computation and boundedness. Finally, the votes are recovered by combining decryption shares as vi=(Pj∈[ξ2]dsi,j mod q) mod p. 2.1.3 Post-quantum E-voting Scheme from Ring-LWE [16] The voting protocol operates in three phases: first, each voter Vi encrypts their vote v∈{ 0 , 1 }∗ using a Ring-LWE-based encryption scheme to produce ciphertext c = PK.Encrypt ( v,mk )where mk is the public election key. Second, the voter obtains a threshold blind signature σ = BS.Sign ( {Aj ([ sk ] j ) }j∈T,Vi ( pk,c )) from at least t signing authorities on the ciphertext c , where the blind signature scheme is based on lattice trapdoors and provides perfect blindness. Finally, the ballot b = ( c,σ ) is posted to the bulletin board, and after the election closes, at least t authorities reveal their decryption key shares [ ek ] j to reconstruct the full decryption key ek , allowing anyone to verify signatures and decrypt ballots to compute the election result r={vi:PK.Decrypt(ci,ek)=vifor valid (ci,σi)∈BB}. 4 2.2 Economic E-voting Systems These blockchain-based schemes [3,5] lack long-term privacy and a post-quantum level of security, and their structures make it difficult to achieve posterior security with them. What makes it even harder is that putting lattice structures on-chain can consume a huge amount of gas on the smart contract, so a hybrid approach can be more effective, which we will present in Section 5 how we did it. 2.2.1 Tornado Vote [3] This system combines Tornado Cash cryptocurrency mixing with zero-knowledge proofs, where voters deposit ERC-20 voting tokens into a vault with Pedersen hash HPed ( sect||k )(where sect is a random secret and k is a nullifier), then commit to their vote v by sending the first 20 bytes of HSHA ( secc||v )along with HPed ( k )and a ZK proof of secret knowledge to achieve anonymity before voting. During the reveal phase, voters disclose v and secc through relayers to the smart contract, which verifies HSHA ( secc||v )against stored commitments and transfers voting tokens to unowned addresses representing each vote choice, with nullifiers preventing double voting and final tallies determined by token balances at outcome addresses. 2.2.2 Blind Vote [5] In this scheme, voters generate RSA key pairs ( Ni,ei,di )and obtain blind signatures from the administrator on their public key hash hi = hash ( Ni,ei )through the protocol h′ i = hi·re imod N→s′ i = ( h′ i ) dmod N→si = s′ i·r−1 i , then commit to their vote by submitting ( Ni,ei,si,ci,sci )where ci = hash ( vi,xi )and scei i = cimod Ni proves knowledge of the vote commitment. During the reveal phase, voters disclose ( ci,vi,xi ) through relays for contract verification of hash ( vi,xi ) = ci , enabling anonymous vote tallying while maintaining complete blockchain verifiability through the blind signature protocol that decouples voter identity from vote content. 3 Preliminaries Let λ∈R denote the security parameter. Given positive integers m,n ∈N , we define [ m ] := { 1 , 2 ,...,m} and [ n,m ] := {n,n + 1 ,...,m} . We denote by Zm the quotient ring of integers modulo m , where elements are represented using the interval [ −m/ 2 ,m/ 2) ∩Z , and by Z∗ m its group of units. For any vector x ∈Rm , the notation ∥x∥represents the Euclidean norm ∥x∥2, while ∥x∥∞denotes the maximum norm. 3.1 Computational Assumptions We recall a set of hard mathematical problems required by the security proof for our construction. 5 Randomized One-More Inhomogeneous Short Integer Solution (rOM-ISIS) [18] Let n,m,q ∈N and let β > 0. In the random oracle model, given A ←$Zn×m q and access to a random oracle H : { 0 , 1 }∗→Zn q , the rOM-ISIS ( n,m,q,β )problem asks an adversary to output ℓ +1 pairs { (z i, t i ) }ℓ i=0 such that Az i =t i ( mod q ), ∥ z i∥≤β , and zi=0, after making at most ℓqueries to H. Module Short Integer Solution (MSIS)[19] Let n,k,m∈N , q∈N , and let Rq = Zq [ X ] / ( Xn +1). Let β> 0. Define MSIS ( n,k,m,q,β ) as the problem of finding a non-zero vector z ∈Rm q such that Az=0( mod q )and ∥z∥∞≤β, where A←$Rk×m q. Module Learning with Errors (MLWE)[19] Let n,k,m∈N,q∈N, and let Rq=Zq[X]/(Xn+1). Let χbe a distribution over Rq. Consider D0 :=(A , A T s+e)and D1 :=(A , u), where A ←$Rk×m q ,s ←$Rk q ,e ←$χm , u ←$Rm q . The MLWE ( n,k,m,q,χ )problem is to decide between the distributions D0 and D1. 3.2 Building Blocks Non-Interactive Blind Signature (NIBSrOM) [20] This signature, which is based on Randomized One-More Inhomogeneous Short Integer Solution, utilizes a CPA-secure public key encryption scheme 2PKE = ( PKE.KeyGen,PKE.Enc,PKE.Dec ), and a non-interactive zero-knowledge proof NIZK = ( NIZK.Setup,NIZK.Prove,NIZK.Verify )for linear relations over Zq , lattice trapdoors bLT=(bLT.TrapGen,bLT.SamplePre), and hash function H:{0,1}∗→Zn q. Definition 1. For parameters n = poly ( λ ), m>nlogq + λ , prime q , Gaussian parameter of ς = Ω( m ), and norm bound as β = ς√m , the scheme NIBSrOM = (Setup,KeyGenS,KeyGenR,Issue,Obtain,Verify)operates as: –pp←Setup(1λ) : Outputs the public parameters pp=(A,B,pke.pk,NIZK.crs) where A , B R ←Zn×2m q ,( pke.pk,· ) ←PKE.KeyGen (1 λ ), and the setup of NIZK.crs← NIZK.Setup (1 λ )for language L1 = { (C , A , B ,pke.pk,ct, w ,δ ): ∃ (x , y , z ,r )satisfying the relation}. – ( sk,vk ) ←KeyGenS ( pp ): Gives secret key sk =T C , vk =Cwhere (T C, C) ← bLT.TrapGen(1λ,n,2m,q). – ( skR,pkR ) ←KeyGenR ( pp ): Outputs skR = (x ,δ ), pkR =A · x+ H ( δ )where x←DZ2m,ς/m,δR ←{0,1}λ. 2 The choice of IND-CPA security (rather than CCA) is sufficient because the PKE is only used to encrypt the witness for the ZKP proof, and the ZKP provides the necessary non-malleability guarantees. 6 – ( psig,nonce ) ←Issue ( sk,pkR ): For y R ←{− 1 , +1 }2m , outputs psig =z, nonce =y where z←bLT.SamplePre(C,TC,pkR−B·y,ς). – ( µ,σ ) ←Obtain ( skR,vk,psig,nonce ): Verifies validity conditions. If valid, outputs µ = (w ,δ ), σ = ( π,ct )where w=A · [x T ⊥∥ z T ⊥ ] T , and the chiphertext ct ←PKE.Enc ( pke.pk, x ∥ y ∥ z), and π is the NIZK proof for instance (C , A , B,pke.pk,ct,w,δ)∈L1. –b←Verify ( vk,µ,σ ): This sub-procedure outputs the result of verification by using zero-knowledge NIZK.Verify(NIZK.crs,(C,A,B,pke.pk,ct,w,δ),π). The scheme achieves one-more-unforgeability under the rOM−ISISq,n,2m,ς,3√2β and receiver blindness under ZKP zero-knowledge and PKE semantic security. Polynomial Commitment (PC) The scheme from [21], based on Module Short Integer Solution, enables a prover to commit to a polynomial h ( X ) ∈Zp [ X ]and later prove evaluations h ( x )= y with square-root-sized proofs. The construction utilizes a modified Ajtai commitment [22] Com =( Setup,Com,Open )with randomized encoding R.Ecd : Zd/r p×R>0→R mapping large prime field elements to small-coefficient ring elements, where R = Z [ X ] / ( Xd +1) and p=br+1. Definition 2. For polynomial degree bound N = nm and security parameter λ , the polynomial commitment scheme PC=(Setup,Com,Open,Eval,Verify)consists of: –ck ←Setup (1 λ,N ): Outputs commitment key ck = ( A0,A1 )where A0← U(Rµ×ℓ q),A1=[A′ 1|Iµ]∈Rµ×(µ+ν) qwith A′ 1←U(Rµ×ν q), for n=dℓ/r. – (  h,δ ) ←Com ( ck,h ( X )): For h ( X )= PN−1 i=0 hiXi∈Zp [ X ], outputs commitment  h= h0∥···∥ hm+1 ∈Rµ(m+2) qand opening δ=( h,η)where: ◦ hi←R.Ecd( hi;s1),ηi←Dµ+ν,σ1 Zd, hi=A0 hi+A1ηi(mod q)for i≤m ◦ hm+1 ←R.Ecd( hm+1;√m+2·s3),ηm+1 ←Dµ+ν,√m+2·σ3 Zd –b←Open ( ck, h,h ( X ) ,δ ): Outputs 1iff ∥ 2  hi∥ 2 ηi∥2≤ 2 dβOpen for all i and polynomial reconstruction holds. – ( y,ρ ) ←Eval ( x,δ ): Computes e = Pm−1 i=0 Ecd ( xni ) · hi + Ecd ( x ) · hm +  hm+1 , outputs y=⟨Dcd(e),(1,x,...,xn−1)⟩(mod p)and proof ρ=(e,ε). –b←Verify(ck, h,x,y,ρ): Accepts iff ∥e∥ε∥2≤βEval and consistency checks pass. The scheme satisfies computational hiding under MLWER,ν,q,σ1 ,binding under MSISR,µ,q,4βPC , and evaluation binding under MSISR,µ,q,2βEval , where βPC = βEval+(b+1)(m+1)dr 2·βOpen. 7 Blockchain Operations We model the general blockchain as a system Blockchain =( Deploy,Submit,GetDecoys ) with the following operations: –contract←Deploy ( code,params ): Deploys smart contract code with parameters to the blockchain, returning contract address. –tx←Submit ( contract.function ( args ) ,value ): Submits a transaction calling contract function with arguments and optional payment value. –keys←GetDecoys ( contract,k ): Retrieves k dummy verification keys from the blockchain to create an anonymity set that will hide the actual signer’s verification key during the posterior security conversion. 3.3 Ballot Privacy Proving a voting scheme secure against ballot privacy (BPRIV) means that ballots do not leak information on votes. As formalized in Definition 3 by [23], it should be impossible, even for active adversaries who can submit arbitrary ballots. Definition 3. A voting scheme V has ballot privacy if there exists a simulator Sim such that no efficient adversary A can distinguish between the games ExpBPRIV,0 A,V,Sim,I ( λ ) and ExpBPRIV,1 A,V,Sim,I(λ)defined in Figure1. That is, the expression   PrhExpBPRIV,0 A,V,Sim,I(λ)=1i−PrhExpBPRIV,1 A,V,Sim,I(λ)=1i   is negligible in λ, for any set of voters I. An experiment is shown in Figure 1; in the experiments Expbpriv,β A,V,I , the adversary A = ( A1,A2 )has access to the set of oracles O = {Ocast,Ovote,Otally, Oboard} . The adversary is allowed to call the Otally oracle at most once. In this model, the adversary tries to distinguish between two worlds. 4 Intuition on Posterior Security 4.1 Syntax and Security Properties Posterior Security addresses a gap by enabling stronger privacy features to be applied to standard signatures after they are generated, allowing applications like two-tier Central Bank Digital Currencies [17] to gain further post-hoc privacy guarantees without any changes to existing signing algorithms. From [17], in Definition 4, we formalize the concept of posterior security 3. Definition 4. Given a signature scheme Σ=( Setup,KeyGen,Sign,Verify ), a posterior security transformation Π=( PS.Setup,PS.Convert,PS.CVerify )enhances signatures with additional security properties post-generation, where 3 It provides two properties: posterior anonymity (via incognito signature) and message hiding (via concealed signature). For additional information, refer to Appendix A.2. 8 Expbpriv,β A,V,Sim,I(λ) 1:BB0,BB1←[] 2:cL,uL←empty 3: (pk,sk)←Setup(1λ) 4:∀id. id∈Ido uL.[id]←Register(id) 5:L←A1(I) 6:coL←{id|id∈I∧id∈L} 7:∀id. id∈coL do cL.[id]←uL.[id] 8:β′←AO 2(pk,cL) 9:return β′ Ocast(id,b) 1:if id∈coL∧Valid(BBβ,b,pk)then 2:BB0←BB0+[b]; BB1←BB1+[b] Otally() for β=0 1: (r,Π)←Tally(BB0,sk) 2:return (r,Π) Otally() for β=1 1: (r,Π)←Tally(BB0,sk) 2: Π′←Sim(pk,Publish(BB1),r) 3:return (r,Π′) Ovote(id,v0,v1) 1: (upk,usk)←uL[id] 2:if id∈I∧id /∈coLthen 3:b0←Vote(id,v0,pk,usk) 4:b1←Vote(id,v1,pk,usk) 5:if Valid(BBβ,bβ,pk)then 6:BB0←BB0+[b0] 7:BB1←BB1+[b1] Oboard() 1:return Publish(BBβ) Figure 1: Ballot Privacy Experiment and Oracles [23] –PS.Setup(1λ,param)→paramPS –PS.Convert(σ,m,pk∗,aux)→σPS∪{⊥} outputs ⊥⇔Verify(σ,m,pk∗)=0 –PS.CVerify(σPS,stmt,aux)→{0,1} have correctness: ∀(sk,pk)←KeyGen(),σ←Sign(m,sk): PS.CVerify(PS.Convert(σ,m,pk,aux),stmt,aux)=1. Posterior Anonymity. Let the Incognito Signature to be Π IS = ( IS.Setup,IS.Convert,IS.CVerify )where aux=pk={pk1,...,pkn},pk∗∈pk, and stmt=m. We define Exps−anon A,ΠIS (λ)by:            (ski,pki)i∈[n]←KeyGen(ωi);paramI←IS.Setup() (m∗,i0,i1,pk∗,σ∗ 0,σ∗ 1)←A1(paramI,{pki,ωi}i∈[n]) b$ ←−{0,1};σ∗ I←IS.Convert(σ∗ b,m∗,pkib,pk∗) b′←A2(σ∗ I);return b′? =b where pki0,pki1∈pk∗ and σ∗ j = Sign ( m∗,skij ). For the adversary’s advantage in strong anonymity we have Advs−anon A:=|Pr[Exps−anon =1]−1/2|≤negl(λ). 9 some key observations: I) The challenge point x is chosen after the commitment phase via the random oracle H , making it unpredictable during commitment. II) The blinding factor ri is chosen uniformly at random and independently for each voter. III) The term ri·x is uniformly distributed in Zp since ri is uniform and x is independent of ri . Therefore, for any fixed vote value vi , the distribution of yi = vi + ri·x is uniform over Zp . In G3 , we replace each yi with a uniformly random value y′ i←$Zp . Since both distributions are uniform over Zp , they are statistically identical |Pr[G2=1]−Pr[G3=1]|=0. Lemma 6. |Pr[G3=1]−Pr[G4=1]|≤negl(λ) Proof of Lemma 6. This follows from the zero-knowledge property of the aggregation proof system. In G3 , the tally oracle computes r = Pn i=1yimod p(yi∼U(a,b)) and Π←ZK.Prove(sk:correct aggregation of {yi}). In G4 , the tally oracle uses the simulator for r = same result as in G3 as Pi′←Sim ( pk,BB1, r ). The simulator Sim works by computing the difference ∆= r−Pjy(1) jmod p where {y(1) j} are the values from world β =1, and using the zeroknowledge simulator: Π ′←ZK.Sim ( pk,r,{y(1) j}, ∆). By the zero-knowledge property: {Π:Π←ZK.Prove(sk:statement)}≈c{Π′:Π′←ZK.Sim(pk,statement)} Therefore, |Pr[G3=1]−Pr[G4=1]|≤negl(λ). Combining all Lemmas 3, 4, 5, 6 we have the final bound:   Pr[ExpBPRIV,0 A,PQBV,Sim,I(λ)=1]−Pr[ExpBPRIV,1 A,PQBV,Sim,I(λ)=1]   =|Pr[G0=1]−Pr[G4=1]| ≤ 3 X i=0|Pr[Gi=1]−Pr[Gi+1 =1]|≤4·negl(λ)=negl(λ) Therefore, PQBV achieves ballot privacy BPRIV according to Definition 3. 6.2 Efficiency Analysis of PQBV In [5], it has been demonstrated that Blind Vote outperforms other known economical blockchain-based e-voting schemes, including Boardroom Voting [24], Tornado Vote [3], and Metamask [25]. Here, we examine the post-quantum variant of Blind Vote, and among other schemes, Epoque [14] is the most similar to the structure of PQBV . As a result, PQBV achieves better efficiency than Epoque in the tally phase due to eliminating homomorphic decryption, while maintaining comparable or better performance in other phases. In the Setup phase of PQBV , the PS-NIBS signer key generation needs O ( m2· poly ( λ )) for lattice trapdoor generation, polynomial commitment setup O ( N·poly ( λ )) where N is the degree bound. Then, in the Voting phase PS-NIBS Issue / Obtain takes O ( m2·poly ( λ )), polynomial commitment for degree-1 polynomial O ( poly ( λ )), 16 Setup Phase Vote Phase Tally Phase Verification Phase PQBV (Ours) O(m2·poly(λ)+N·poly(λ)) O(k·m2·poly(λ)) O(n·poly(λ)) O(n·k·m2·poly(λ)) Epoque [14] O(n· t ·m3·log2q)O( v · c · t ·m·n·log2q)O( v · t ·m·n·log2q)O( v + c · t ) Table 1: Cumulative time complexity of schemes in each phase, assuming c , t , and v be the number of candidates, trustees, and voters, respectively, in Epoque. PS.Convert with k decoys needs O ( k·m2·poly ( λ )), on-chain commit O (1), PC.Eval takes O ( poly ( λ )), and on-chain reveal with PS.CVerify and PS.Decom verification O ( k·m2·poly ( λ )). In Tally, collecting n revealed vote values takes O ( n ), aggregating by simple summation O ( n ), generating proof for correct aggregation O ( n·poly ( λ )), and publishing result O (1). Finally, in global verification, it verifies all n reveals with PS.CVerify at cost O(k·m2·poly(λ)) each. 7 Conclusion In this work, we took a step toward bridging the gap between cryptographic security requirements and the cryptocurrency community’s aspirations for blockchain-based voting by presenting PQBV , the first provably secure post-quantum blockchain voting system, along with addressing quantum threats through lattice-based primitives. The integration of posterior-secure blind signatures enables enhanced privacy guarantees, allowing for both voter anonymity and message hiding capabilities that can be applied retroactively to already-generated signatures. Through our analysis, we showed that PQBV offers promising efficiency compared to other schemes, such as Epoque , while maintaining formal security proofs for ballot privacy. As future directions, we aim for the realistic implementation of PQBV for demonstrating feasibility and discussing practical deployment. 8 Acknowledgment N. Abapour was funded by the Computer Science Research Centre (Grant No. AB8031) and FEPS (Grant No. TB8071), both from UniOfSurrey. C. C. Drăgan is partially supported by TrustVote – EPSRC grant EP/Y020529/1, AP4L - EPSRC grant EP/W032473/1, CONNECT - Horizon Europe Guarantee 10043730 and EU Horizon grants 101069688, REWIRE - Horizon Europe Guarantee 10043743 and EU Horizon grants 101070627. M. Mahdavi was supported by the Spanish Ministry of Science and Innovation through the PID2021-125962OB-C31 “SECURING” project, along with the ARTEMISA International Chair of Cybersecurity (C057/23) and the DANGER Strategic Project of Cybersecurity (C062/23), both funded by the Spanish National Institute of Cybersecurity through the European Union — NextGenerationEU and the Recovery, Transformation, and Resilience Plan. 17 A Appendix A.1 On-chain Operations of Smart Contract According to Figure 5 and Figure 4, the smart contract operations enforce timing constraints, verify posterior-secure signatures using Π PS-NIBS.PS.CVerify , validate decommitments via Π PS-NIBS.PS.Decom , and confirm polynomial evaluations through PC.Verify. A.2 Concealed and Incognito Signatures As Figure 6 shows, the incognito signature transformation enhances blind signatures with posterior anonymity by encrypting the signer’s identity with signature components. A verifier receiving ( πI,ctI )can confirm that some authorized signer from VK produced a valid signature without learning the specific signer. This leverages encryption, semantic security, and NIZK zero-knowledge to keep the encrypted identity computationally hidden, while πI proves the ciphertext contains a valid signature from an authorized party.   1pragma solidity ^0.8.19; 2contract PosteriorSignatureCommitment { 3// commitment structure for posterior signatures 4struct PosteriorCommitment { 5bytes32 sigHash; // H(\ sigma_PS ) 6uint256 timestamp; 7bool revealed ; 8} 9// commitment storage 10 mapping(bytes32 => PosteriorCommitment )public commitments; 11 // protocol parameters 12 uint256 public t_commit_end; 13 uint256 public relay_reward; 14 // events 15 event CommitmentSubmitted (bytes32 indexed sigHash); 16 // batch commit posterior signatures with relay incentive 17 function batchCommitPS(bytes[] memory signatures_PS) external payable { 18 require (block.timestamp <= t_commit_end ,"Commitment period ended"); 19 for (uint i = 0; i < signatures_PS.length; i++) { 20 bytes32 h = keccak256(signatures_PS[i]); 21 require(commitments[h].timestamp == 0, "Duplicate commitment "); 22 commitments [h] = PosteriorCommitment({ 23 sigHash: h, 24 timestamp:block.timestamp, 25 revealed : false 26 }); 27 emit CommitmentSubmitted(h); 28 } 29 // single relay payment for batch submission 30 payable(msg.sender). transfer ( relay_reward ∗signatures_PS.length); 31 } 32 }   Figure 4: Signature Commitment   1pragma solidity ^0.8.19; 2contract PosteriorSignatureReveal { 3// reveal function for posterior signatures with vote extraction 4function revealPS( 5bytes memory sigma_PS, 6bytes memory aux, 7uint256 com_vote, 8bytes32 voter_hash, 9uint256 y, 10 bytes memory rho 11 )external { 12 require(block.timestamp >= t_reveal_start, "Reveal not started "); 13 bytes32 h = keccak256(sigma_PS); 14 PosteriorCommitment storage pc = commitments[h]; 15 require(pc.timestamp > 0 && !pc.revealed, "Invalid commitment "); 16 // Parse \ sigma_PS components 17 (bytes memory pi_PS, bytes32 C_mu, address[] memory decoys) = 18 parsePosteriorSig (sigma_PS); 19 // Verify posterior - secure signature 20 require(PS_NIBS.PS_CVerify (sigma_PS, decoys), "Invalid PS sig"); 21 // Decommit message 22 bytes memory mu_com =abi.encode(com_vote, voter_hash); 23 require(PS_NIBS.PS_Decom(mu_com , sigma_PS, aux), "Decommit failed"); 24 // Derive and verify challenge 25 uint256 x = uint256(keccak256(abi .encode(block.number, "challenge"))); 26 require(PC.verify(ck, com_vote , x, y, rho), " Invalid eval "); 27 // Mark as revealed and store vote 28 pc. revealed = true; 29 votes .push(y); 30 emit VoteRevealed(h, y); 31 } 32 }   Figure 5: Posterior Signature Reveal 18 IS.Convert(σ,µ,VK) 1: (π,ct)←σ 2: (w,δ)←µ 3:{C1,...,Cn}←VK 4:i∗←{i∈[n]:Verify(Ci,µ,σ)=1} 5:ctI←PKE.Enc(pke.pk,i∗∥σ∥µ) 6:Lanon :={(VK,ctI):∃(i,σ,µ)s.t. Verify(Ci,µ,σ)=1∧ctI=PKE.Enc(pke.pk,i∥σ∥µ)} 7:πI←NIZK.Prove(nizk.crsanon,(VK,ctI),(i∗,σ,µ)) 8:σI:=(πI,ctI) 9:return σI IS.CVerify(σI,µ′,VK) 1: (πI,ctI)←σI 2: (w′,δ′)←µ′ 3:if w′=w∨δ′=δ: 4:return 0 5:return NIZK.Verify(nizk.crsanon,(VK,ctI),πI) Figure 6: Incognito Signature (Posterior Anonymity) Unlike the incognito variant that hides the signer’s identity, concealed signature transformation (Figure 7) focuses on hiding the signed message content while maintaining verifiability. The commitment com serves as a public binding to the hidden message, and the zero-knowledge proof πCS demonstrates that the encrypted data contains a valid signature on the committed message. The decommitment CS.Decom allows authorized parties to reveal the message. The scheme Π PS−NIBS is a single unified construction that supports both posterior security properties through the mode parameter. The party can generate standard blind signatures using original algorithms, convert them to incognito signatures using PS.Convert ( ·,·,anon,· ), and convert them to concealed signatures using PS.Convert ( ·,·,hide,· ). This modular design allows the same base signature to achieve different posterior security properties as needed. We investigate the security of ΠPS−NIBS in Section 6. 19 CS.Convert(σ,µ,C) 1: (π,ct)←σ 2: (w,δ)←µ 3: (com,r)←Com(µ) 4:ctCS ←PKE.Enc(pke.pk,σ∥µ∥r) 5:Lhide :={(C,com,ctCS):∃(σ,µ,r)s.t. Verify(C,µ,σ)=1∧com=Com(µ;r)} 6:πCS ←NIZK.Prove(nizk.crshide,(C,com,ctCS),(σ,µ,r)) 7:σCS :=(πCS,ctCS,com) 8:auxCS :=(µ,r) 9:return (σCS,auxCS) CS.CVerify(σCS,C) 1: (πCS,ctCS,com)←σCS 2:return NIZK.Verify(nizk.crshide,(C,com,ctCS),πCS) CS.Decom(µ′,σCS,auxCS) 1: (µ,r)←auxCS 2: (πCS,ctCS,com)←σCS 3:return (µ′=µ)∧(Decom(com,µ,r)=1) Figure 7: Concealed Signature (Posterior Message Hiding) References [1] Josh Benaloh, Matthew Bernhard, J. Alex Halderman, Ronald L. Rivest, Peter Y. A. Ryan, Philip B. Stark, Vanessa Teague, Poorvi L. Vora, and Dan S. Wallach. Public evidence from secret ballots. CoRR, abs/1707.08619, 2017. [2] Rihab H Sahib and Eman S. Al-Shamery. A review on distributed blockchain technology for e-voting systems. Journal of Physics: Conference Series, 1804(1):012050, feb 2021. [3] Robert Muth and Florian Tschorsch. Tornado vote: Anonymous blockchainbased voting. In ICBC, pages 1–9, 2023. [4] Noemi Glaeser, István András Seres, Michael Zhu, and Joseph Bonneau. Cicada: A framework for private non-interactive on-chain auctions and voting. [5] Amir Kafshdar Goharshady and Zhaorun Lin. Blind vote: Economical and secret blockchain-based voting. In IEEE Blockchain, pages 46–53, 2024. 20 [6] Patrick Mccorry, Maryam Mehrnezhad, Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. On secure e-voting over blockchain. Digital Threats, 2(4), October 2021. [7] Securing the Vote: Protecting American Democracy. National Academies Press, August 2018. [8] MIT News. Mit researchers identify security vulnerabilities in voting app. https://news.mit.edu/2020/voting-voatz-app-hack-issues-0213 , 2020. Accessed: 2025-01-26. [9] U.S. Vote Foundation. The blockchain threat to democracy. https://www.usvotefoundation.org/blockchain-threat-to-democracy . Accessed: 2025-01-26. [10] Mahdi Mahdavi, Navid Abapour, and Zahra Ahmadian. Trustworthy approaches to RSA: Efficient exploitation strategies based on common modulus. Cryptology ePrint Archive, Paper 2024/1903, 2024. [11] Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson, and David Cooper. Transition to post-quantum cryptography standards. NIST Internal Report 8547, National Institute of Standards and Technology, November 2024. Initial Public Draft. [12] Craig Gidney and Sophie Schmieg. Tracking the cost of quantum factoring. Google Security Blog, May 2025. [13] Craig Gidney. How to factor 2048 bit rsa integers with less than a million noisy qubits, 2025. [14] Xavier Boyen, Thomas Haines, and Johannes Müller. Epoque: Practical end-toend verifiable post-quantum-secure e-voting. In EuroS&P, pages 272–291, 2021. [15] Patrick Hough, Caroline Sandsbråten, and Tjerand Silde. More efficient lattice-based electronic voting from NTRU. IACR Communications in Cryptology, 1(4), 2025. [16] Guillaume Kaim, Sébastien Canard, Adeline Roux-Langlois, and Jacques Traoré. Post-quantum Online Voting Scheme. In FC 2021 - Financial Cryptography and Data Security. International Workshops, volume Lecture Notes in Computer Science, pages 290–305, Virtual event, France, March 2021. [17] Tsz Hon Yuen, Ying-Teng Chen, Shimin Pan, Jiangshan Yu, and Joseph K. Liu. Posterior security: Anonymity and message hiding of standard signatures. Cryptology ePrint Archive, Paper 2025/855, 2025. [18] Shweta Agrawal, Elena Kirshanova, Damien Stehlé, and Anshu Yadav. Practical, round-optimal lattice-based blind signatures. In CCS, CCS ’22, page 39–53, New York, NY, USA, 2022. Association for Computing Machinery. 21 [19] Angèle Langlois and Damien Stehlé. Worst-case to average-case reductions for module lattices. Designs, Codes and Cryptography, 75:565–599, 2015. [20] Foteini Baldimtsi, Justin Cheng, Rachit Goyal, and Ayush Yadav. Noninteractive blind signatures: Post-quantum and stronger security. In Kai-Min Chung and Yuichi Sasaki, editors, ASIACRYPT, volume 15485 of Lecture Notes in Computer Science. Springer, Singapore, 2025. [21] Intak Hwang, Jinyeong Seo, and Yongsoo Song. Concretely efficient lattice-based polynomial commitment from standard assumptions. In CRYPTO, page 414–448, Berlin, Heidelberg, 2024. Springer-Verlag. [22] M. Ajtai. Generating hard instances of lattice problems (extended abstract). In STOC, STOC ’96, page 99–108, New York, NY, USA, 1996. Association for Computing Machinery. [23] David Bernhard, Véronique Cortier, David Galindo, Olivier Pereira, and Bogdan Warinschi. Sok: A comprehensive analysis of game-based ballot privacy definitions. In S&P, pages 499–516, 2015. [24] Patrick McCorry, Siamak F. Shahandashti, and Fang Hao. A smart contract for boardroom voting with maximum voter privacy. In Aggelos Kiayias, editor, FC, volume 10322 of Lecture Notes in Computer Science. Springer, Cham, 2017. [25] Deni Pramulia and Bayu Anggorojati. Implementation and evaluation of blockchain based e-voting system with ethereum and metamask. In ICIMCIS, pages 18–23, 2020. 22