The Math Is The Guarantee
FOLKMOOT uses the same cryptographic foundations as Estonia's national voting system. Every claim on this page is verifiable. The code is open source.
Blind Signatures
When you get a voting credential, the authority signs it without seeing your identity. Like putting your ballot in an envelope, getting it officially stamped through the paper, then removing it. The stamp is valid but the authority never saw what was inside.
Homomorphic Tallying
All encrypted ballots can be mathematically combined without decrypting any individual vote. Imagine locked boxes where you can shake them and count the total weight without ever opening a single one.
Zero-Knowledge Proofs
You prove your ballot contains a valid choice (yes or no) without revealing which one. Like proving you know a password without ever typing it — the math guarantees validity without disclosure.
Threshold Decryption
The decryption key is split among 5 trustees. At least 3 must cooperate to decrypt the final tally. No single trustee, no administrator, and no government can unilaterally access results.
End-to-End Verifiability
After voting, you receive a receipt. You can verify your encrypted ballot appears on the public tally. Anyone can verify the tally was computed correctly from the encrypted ballots.
Coercion Resistance
You can re-vote at any time before polls close. Only your last ballot counts. If someone coerces you, vote under duress, then re-vote privately. The coercer sees a valid receipt — for a vote that no longer counts.
Passive Network Attacker
Observes all traffic between voter and server
TLS 1.3 + encrypted ballots. Traffic analysis reveals nothing about vote content.
Malicious Administrator
Has full server access
Cannot decrypt individual votes (threshold). Cannot forge credentials (blind sig). Cannot modify tally (hash chain).
State Actor / Server Seizure
Physical access to all hardware
Encrypted data at rest (AES-256-GCM). Threshold keys on separate devices. Public tally is independently verifiable.
Sybil Attack
Creates fake voter identities
Community vouching requires 2 real humans. Web of trust graph analysis detects clustering.
Coercion Attack
Forces voter to vote a certain way
Re-voting mechanism. Old receipt shown to coercer. Only last ballot counts.
Container Escape
Breaks out of Docker isolation
Distroless images. Read-only root. No capabilities. Custom seccomp + AppArmor profiles.
Folkmoot is the Federation’s designated voting platform under Article IV of the WOPR Constitution — cryptographically secure, community-governed, built on the Swiss direct democracy model.
Switzerland has run direct democracy since 1848. The canton of Geneva conducted binding e-voting referendums starting in 2003 — over 20 years of cryptographic democracy research. The Landsgemeinde (people’s open assembly) has existed in Alpine communities since the 14th century. The Old English word for it is Folkmoot.
We did not invent this. We built the cryptographic version of something that has worked for 700 years.
Responsible Disclosure
Found a vulnerability? We want to hear about it. Report security issues to [email protected]
See also: /.well-known/security.txt