Here in Romania there were cases when two or more parties agree to cancel the votes for the opposition or even count them as theirs.

We call those "allies".

The security of a digital systems is "good enough" IMO, especially if there's a public cryptographically verifiable ledger. We bank online where the banks essentially only hold cash in the form of a database entry. The benefits of digital voting means we can have more granular input in our government's operations. I don't see paper ever scaling to meet that demand.

Remember that your IMO is not what the consensus among security experts is. There are many things that you and me missed.

The worst problem with electronic internet voting is that depending on country, something like 5-40 percent of voters loses the secret ballot and the opportunity to vote independently without coercion. Husband, brother or other family member will be behind their back to watch how they vote.

Here in Finland I have a friend who has been election official and he says that it's not uncommon common for family member trying to squeeze into ballot box or try get behind. Especially if the ballot has been cast in post office with small space.

Your jurisdiction's voter registration database is (hopefully) up to date. YMMV. Note that verified reports of registration fraud are very, very few. Whereas caging, purging are fairly common.

Briefly, On election day: voter shows up to correct poll site, shows some kind of ID (YMMV), name found in that location's poll book, voter signs in, ballot is issued, voter marks ballot, voter casts ballot. If there's any error (question) during this process, voter is issued a provisional ballot, to be adjudicated out of band.

Ballots are counted before the polls open and again when the polls close. The bookkeeping is simple and easily verified.

Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc.

I don't see why this level of security couldn't be used to randomly and deterministically assign crypto keys that are used for some kind of blockchain voting scheme. Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection. Am I missing something?

Voting wallets? Assign crypto keys? You mean just like issuing a ballot? How would someone do a recount? An end-to-end audit? Keep track of who was assigned which key (thereby destroying the secret ballot)? Who voted and who didn't? How do you handle provisional ballots? Etc.

PM me once your proposal satisfies the requirements (works as a replacement) for current election administration systems.

Okay, maybe I'm being too dismissive, which I normally hate. But blockchains, crypto, signatures are not magical. Design the whole system, make it auditable while accounting for information leakage, simulate a few real world elections. Do the leg work, unlike Chaum, Rivet, others. THEN we can talk.

"Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy"

http://static.usenix.org/event/sec10/tech/full_papers/Carbac...

With the prior Punchscan system, voter privacy is accomplished thru hash collisions. Hiding your ballot in a herd of ballots cast. A trick that works only if your herd (precinct) is large enough and your ballots are simple enough. Definitely would not work (protect voter privacy) in my jurisdiction.

Side note about IRV, as used in Maryland Park: It's now a non-starter. After the handful of well-studied experiments, election administrators are dead set against it. Ballots are complicated, voter education is tough, and IRV necessitates electronic tabulation, which rules out legally required manual recounts. (My jurisdiction often gets over 500k ballots. IRV is not feasible here.)

People lose wads of cash that are valuable to them; they're going to care even less about their electronic verification file.

Might as well just vote then and there

We use this in Mexico, in addition to (non-digital) fingerprint-carrying voter ids. Historically, it has not prevented fraud in general (most of which happened due to insufficient audit procedures and rural polls not having observers from all parties, allowing for stuffed ballots and the like). It did however close that particular attack vector. My trust on the results of an individual polling station in an urban area with observers from all major and most minor parties is actually quite high, even as I know any or all of the observers involved are likely to be corrupt and have low regard for the law. The reason for this is that they are all incentivized to prevent each other from cheating and have the means to detect tampering in such setting (without needing uncommon expertise beyond observation and basic arithmetic).

https://en.wikipedia.org/wiki/Election_ink

This is a thing you actively don't want. You don't want to be able to prove to anyone else how you voted. Otherwise it would be absolutely trivial for your boss to say, "So, you voted for that anti-union candidate, right?" (Or your boss to not say that, but just happen to give promotions to people who show proof of voting the way the boss wants.)

The right to a secret ballot is demanded by the Universal Declaration of Human Rights.

Yes, this renders the electronic voting problem - and honestly the voting problem in general - very close to impossible. That's why it's hard.

I just invented a scheme to anonymize votes in 5 minutes. I'm sure if smarter people tried we could definitively solve this. I'm not convinced this is hard as much as people are saying it's hard.

You need to have deniability; I need to be able to revoke my ability to prove how I voted, and moreover I need to be required to revoke it (otherwise I can be compelled not to revoke it). Right now, I am unable to leave the voting booth with any receipt of how I voted, even if I wanted to (i.e, even if someone else wanted me to). I can see my vote, and election monitors prevent anyone else from seeing it until it leaves my hands. In most places in the US, I can't even take a cell phone photo of my votes, and that's a good thing because nobody can ask me to take a cell phone photo of my votes.

2. If they're pre-known, anonymous, single-use keys, nothing prevents a corrupt election official from keeping a copy of the key and voting before the voter gets home. The voter has no way to prove that they didn't vote and that someone stole their key.

(The other thing is that photos of ballots have only become a serious threat in the last few years, and at the moment there's not really voter coercion through those photos, as far as we know. If it becomes a problem, I expect a bigger crackdown on it.)

Tada!