Electronic voting systems must balance public verifiability with voter privacy and coercion resistance. Existing cryptographic protocols typically achieve end-to-end verifiability by revealing vote distributions, relying on trusted clients, or enabling transferable receipts - design choices that often compromise trust or privacy in real-world deployments. We present ACE, a voting protocol that reconciles public auditability with strong privacy guarantees. The protocol combines a publicly verifiable, tally-hiding aggregation mechanism with an Audit-or-Cast challenge that enforces cast-as-intended even under untrusted client assumptions. Tallier-side re-randomization eliminates persistent links between voters and public records, yielding information-theoretic receipt-freeness assuming at least one honest tallier. We formalize the security of ACE and show that it simultaneously achieves end-to-end verifiability, publicly tally-hiding results, and strong receipt-freeness without trusted clients.

翻译：电子投票系统必须在公共可验证性与选民隐私及抗胁迫性之间取得平衡。现有的密码学协议通常通过揭示投票分布、依赖可信客户端或提供可转移收据来实现端到端可验证性——这些设计选择在现实部署中往往损害信任或隐私。我们提出ACE投票协议，该协议将公共可审计性与强隐私保证相结合。该协议结合了公开可验证、隐藏计票结果的聚合机制，以及“审计或投票”挑战机制，即使在不可信客户端假设下也能确保“投票与意图一致”。计票端的重随机化消除了选民与公共记录之间的持久关联，在至少存在一个诚实计票者的假设下实现信息论意义上的无收据性。我们形式化了ACE的安全性，并证明该协议同时实现了端到端可验证性、公开隐藏计票结果，以及在无信任客户端条件下的强无收据性。