Arcaunt: Voter-Initiated Anonymous Credential Recovery for Revote-Based Remote E-Voting

Remote voting lets a coerced voter override a supervised ballot only while the voter keeps exclusive control of the credential. When the credential is captured, by malware, theft or observation, existing systems offer no remedy short of an identity-linked re-registration, which forces a choice between ballot secrecy and the voter's ability to undo the theft. Who may revoke a credential, and through which institutions, is a question of electoral trust as well as of cryptography. We present Arcaunt, a revote-based remote voting protocol in which a voter revokes a captured credential and obtains a replacement through a pre-registered e-mail recovery channel, without disclosing their civil identity and without the compromised device. Credentials are bearer tokens drawn at random in person, so no record links a voter's civil identity to a credential, and recovery addresses are stored only as keyed blind indices. A voter can cast and revise a ballot from any place, including abroad, at any time within the election window and from any device, including assistive technology; the last ballot cast under a valid credential is counted. Since ballots can be revised unobserved and remote ballots belong to no polling station, buyers cannot verify a seller's final vote. Ballots are encrypted under a non-malleable threshold key, optionally audited on a second device, and recorded in two public hash-chained ledgers that carry no voter identifiers and are replicated to independent observers, so anyone can audit the ledgers. Hashing, signatures, replication and external anchoring give tamper evidence comparable to that sought from blockchains, without a consensus protocol. A hardware security module derives keyed credential tags and signs every ledger record. We specify the protocol, state a trust model in which every party is trusted for a named property or not, and prove structural identity-vote unlinkability and game-based bounds for selector integrity, recovery anonymity and unforgeability, a bounded credential-compromise window after recovery, and episodic corrective revoting. The contribution is a recovery mechanism for captured credentials, a lifecycle guarantee rather than coercion resistance in the sense of Juels, Catalano and Jakobsson, and a discussion of its implications for electoral trust.