Page 153 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

An Implementation of a Mix-Net Based Network Voting Scheme
The voting center will verify that the voter is eligible to vote. It will verify
that the proof satisfies
c i = H(p, q, g, Y, G i ,α i ,ID i ) 145
[t i ]g − [c i ]G i = α i
and that the elements G i and M i are both in E. If everything is verified, then
it can optionally send back a receipt of acceptance. Such a receipt cuts in two
ways: it will add confidence to the voter that the center indeed accepted his vote
and will be an evidence for any disputes on vote delivery. On the other hand, it
will serve as a receipt in vote-buying or coercing scenario.

Tallying
The voting center will send the list of accepted votes from each voters
(G i ,M i ) i=1,···,n to the shuffling management center. The shuffling management
center will verify that all of each component is in E, and rename them to be
(1) (1)
(G i ,M i )=(G i ,M i ) for all i, which will be the input to the first shuffling
center SC1.
(j) (j)
The list (G i ,M i ) i will be sent to SC j . His response will be verified by the
(j+1) (j+1)
shuffling management center and will be renamed to (G i ,M i ) i and sent
to the next shuffling center. The response from the last shuffling center, SC m
will be verified and sent back to the voting center.
Below, we describe the procedures of each shuffling center.

(j) (j)
1. SC j will receive the list (G i ,M i ) i . He will choose a random permutation
(j) (j) (j) ¯ (j) ¯ (j)
π and permute the input list (G i ,M i ) i and achieve the list (G i , M i ) i
as follows:
¯ (j) ¯ (j) (j) (j)
(G i , M i ) i =(G π (j) (i) ,M π (j) (i) ) i
2. The above permutation only changes the order of the ciphertexts, so it is
easy to trace the permutation. In order to hide the permutation, we need to
change the look of the ciphertext. The following procedure changes the look
without changing the message hidden in the ciphertext.
First, SC j combines the public keys of the subsequent shuffling centers as
m

Y j = y .
=j
¯ (j) ¯ (j) (j) mod q and obtains
For each of (G i , M i ), he chooses a random element s i
(j) (j)
(G i ,M i ) i by

(j) ¯ (j) (j)
i i i
G = G +[s ]g
(j) ¯ (j) (j)
M i = M i +[s i ]Y j