The 2024 Senate Selection Case Study on heain-core A New Idea: Blind-Signature Tokens The Voter's Device Blinds the Token Before the Roll Signs It, per RFC 9474, So the Roll and the Voting Machines Together Still Cannot Link Voters to Ballots

Abstract Volume 1 [1] applied the HEAIN Framework to the existing Senate selection system and separated the identity lane from the vote lane with heain-core's mechanisms. But the token that grants the right to vote was still issued the simple way: the roll created the token itself and saw both the requester and the token at the moment of issue. If the roll kept that pair, it could link voters to ballots, every one. The secrecy of the ballot therefore rested on reviewing the app's code. This volume proposes a new idea: the voter's device creates the token itself, blinds it with the roll's public key, and has the roll sign it after registration. The roll sees who asks but never sees the token; the voting machine sees the token but not who asked. It uses RSA blind signatures per RFC 9474 [3], variant RSABSSA-SHA384-PSS-Randomized, with keys per group and round, and publishes the key set as a signed statement on the public log, so the roll cannot use a per-person key to tag a voter. On one machine (HP Z840) the results match every value of the RFC's test vectors. Putting together everything the rolls of all 6 districts saw (289 blinded requests) and everything every voting machine saw (288 tokens), no value appears in both. A roll that signed one voter's request with an unpublished key was caught by that voter's device. Rounds 0–5 and 2b of the case study, rerun on blind tokens, passed all 155 checks with no change to core. What the token still reveals is the occupational group, which at district level has about 2.5 voters on average, so anonymity is bounded by the group, the same scope as ballots sealed per group. All figures come from a simulation. Keywords: HEAIN Framework, heain-core, Senate Selection, Blind Signatures, RFC 9474, RSA-PSS, Unlinkability, Key Transparency, Tagging Attack, Anonymous Credentials, Electronic Voting