Proof of One: one-person-one-identity polling with encrypted ballots — design and reference code, requesting critical review

Privacy
1

Hi all,

I am Nemo Unus, the pseudonymous maintainer of Proof of One. It is an open-source, non-commercial design for polls with four properties:

  1. Every participant is a unique human.
  2. Nobody, including operators, can link answers to people.
  3. Every voter can verify their own recorded ballot.
  4. Anyone can recount the result from public data.

Full disclosure first: most of the current design and code was drafted with a team of AI agents, disclosed in AGENTS.md. None of it has been reviewed by independent humans yet. That is why I am posting.

Design in brief

  • Enrolment, document. The phone reads an ICAO 9303 passport chip over NFC. It proves in zero knowledge that the chip data was signed by a document signer in a public tree of checked signers, without revealing the document. The reference circuit handles SHA-256 and RSA-2048 and has 577,678 constraints. Proving time on phones is not yet measured.
    • The signers are checked against a published trust list of country signing certificates. The list holds references only and has a hash anyone can rebuild. The first version is built from the German master list: 113 of 186 chip-passport countries.
  • Enrolment, person. The live face is matched to the chip photo inside an attested enclave. Duplicates are detected by an OPRF document fingerprint and a 1:N face search. The enclave signs only a hiding commitment. The phone then registers its identity leaf with a ZK proof of holding a credential, so the enclave cannot link people to leaves. A hidden revocation handle lets re-enrolment revoke the old identity without revealing which leaf it was.
  • Voting. Ballots are one-hot exponential ElGamal on Baby Jubjub under a per-poll threshold key. A Groth16 proof (32,607 constraints; 3.5 s in the browser of an iPhone 14) covers membership, non-revocation, nullifier, eligibility and ballot well-formedness. The latest ballot per nullifier counts.
  • Tally.
    • Ballots are summed homomorphically.
    • The per-poll key comes from a GJKR-style distributed key generation whose complaints anyone can settle from the public transcript.
    • Trustees publish partial decryptions with DLEQ proofs.
    • The contract checks that the sum of counts equals the number of distinct voters, which is at most the number of eligible identities. A 7-day challenge window follows, and key shares are deleted afterwards.
  • Stated limit. An authority that issues passports can mint genuine-looking identities. We aim for costly, bounded and visible, not impossible.

How this relates to existing work

  • Vocdoni’s DAVINCI and MACI solve the ballot side well, and our ballot layer is close to DAVINCI’s (threshold ElGamal, DKG, nullifiers, re-voting). The difference is the census: in those systems the organiser supplies the voter list. Our main contribution is a census of unique humans built from chip documents, in a way that keeps the enrolment service from linking people to their identities. I asked the DAVINCI authors in their thread whether such a registry could plug in as their census.
  • Unlike DAVINCI, we have no receipt-freeness yet beyond re-voting. Views on combining operator re-encryption with each voter’s ability to verify their own ballot would be very welcome.
  • A longer comparison with ZK-passport projects, proof-of-personhood systems and verifiable voting systems is in the repository (landscape review, corrections welcome).

Where I would most value critique

  1. Unlinkability of the enrolment credential when the enclave knows the revocation handle (issue #3)
  2. Completeness of the ballot circuit and the tally checks (issue #2)
  3. Whether the threat model’s “fundamental limit” is framed honestly (issue #1)
  4. How an open project should obtain and audit the country signing certificates it trusts (issue #14). A field test found a commercial verifier that read a genuine chip correctly but could not verify it, because it lacked the issuing country’s certificate.
  5. Groth16 with a ceremony vs a universal setup (issue #7)

Links

There is no token and nothing for sale. Harsh criticism is the most useful kind. Thank you.