On election morning, Minh, a 26-year-old data engineer in Hanoi, queues at a polling station to hear a stranger ask whether his family trusts the machine that counts their votes. His grandfather answers first: "The machine does what its programmer says. How do we know what the programmer said?" It is the oldest question in electronic voting, asked a few blocks from the National Assembly building where lawmakers have started testing digital election tools. Bầu cử điện tử zk — electronic voting protected by zero-knowledge proofs — offers an answer that does not depend on trust: the machine can prove its tally is correct without revealing a single vote. This article explains how bỏ phiếu zero knowledge moves e-voting from "trust our software" to "check our math," what real governments have tried, and what Vietnam's digital-ID system makes possible.
Why electronic voting still has a trust problem
Three real deployments show the pattern. Estonia has run internet voting since 2005 — the world's longest continuous trial — with voters authenticating by national ID card, encrypting their ballot, and re-voting freely; only the last vote counts. But academic audits (Springall et al., CCS 2014) found the system is not end-to-end verifiable: a compromised voter device could break the "cast as intended" guarantee, and the 2024 European Parliament elections saw the first malformed ballot survive all the way to decryption — proof that nobody could yet check the ballot's content. Brazilian voters, meanwhile, cast ballots on closed, offline machines with no individual paper record at all. The machines have never been shown to lose an election, yet the system is, in the words of researchers, a black box whose post-election audit is "almost impossible" — a problem revealed brutally in 2022 when fraud claims could only be answered with authority, not arithmetic.
Switzerland took the opposite route. Since 2019 its federal rules simply forbid non-verifiable systems: only completely verifiable e-voting is legal, source code is published, a permanent bug bounty has been running since 2021, and periodic public intrusion tests (2023, 2024, 2025) have been rewarded with no confirmed findings. What separates Bern from Tallinn and Brasília is not intelligence but a legal demand for proofs. The lesson for Vietnam is that the technology matters less than the verifiability floor regulators set.
Computer scientists named this distinction. A system is software-independent when an undetected change or error in its software cannot cause an undetectable change or error in the outcome. Paper ballots are software-independent; so are cryptographic end-to-end-verifiable systems, because any mistake leaves a publicly checkable trace. Paperless direct-recording machines are not — a software bug can change the result invisibly, which is precisely the failure mode Vietnam's supervisors fear. The uncomfortable consequence: "the machine works" is not a testable claim unless the machine produces evidence anyone can inspect.
Figure 1: The e-voting trust gap across three national paths — Estonia, Brazil and Switzerland
What voters actually need: the requirements triangle
Cryptographers reduce the wishlist to four properties. Ballot secrecy: no one can link a voter to a choice. Individual verifiability: the voter can check their own ballot was recorded correctly. Universal verifiability: any observer can check the tally matches the recorded ballots. Eligibility: only registered voters vote, and each votes once.
Every conventional system trades one off. Estonia gives up universal verifiability (you must trust the server audit). Brazil gives up individual verifiability (there is nothing to check after the booth). Paper ballots give up verifiability at a distance — and give up nothing else, which is why Vietnam still uses them. The naive response — "just encrypt everything" — fails too: an encrypted ballot can still be counted wrongly or coerced into revealing its plaintext. And encrypting does not prevent an attacker from substituting one valid-looking ciphertext for another, a class of attack called ballot malleability that took the Helios project years to close. The trust gap is not solved by secrecy; it is solved by proofs about the tally that reveal nothing else.
How ZK proofs break the triangle
A zero-knowledge proof lets a party assert "this statement is true" and produce a tiny certificate that any verifier can check in milliseconds, without learning why it is true. In elections the assertion is the whole problem of trust. Four deliverables follow.
(a) Eligibility without identity disclosure
A modern system starts with a Merkle census: a single 32-byte root commits the entire list of eligible voters. A voter proves, in zero knowledge, "my key is a leaf in this tree" — and reveals only a nullifier, a one-way string derived from their key and the election ID. The nullifier is checked once and burned. The election operator learns that a valid citizen voted; it never learns which citizen. This is the same selective-disclosure pattern used in ZK identity products, and it maps cleanly onto a national digital-ID root.
(b) Ballot secrecy with a provable tally
The tally itself is the hard part. In a homomorphic system, encrypted ballots are multiplied together into one encrypted total; the outcome is then decrypted — once — by a threshold of election officials, each of whom must publish a zero-knowledge proof that the decryption is correct. Voters' choices never leave the ciphertexts, yet the sum is forced to be the true sum of valid ballots. Cryptographers have even proven the constructive version: with zero-knowledge tallying proofs, secrecy and verifiability can be satisfied at the same time (Smyth, 2015) — the triangle is broken by math, not process.
Two technical details make this practical rather than theoretical. First, ballot-validity proofs: alongside each encrypted choice, the voter's device must prove the ciphertext contains exactly one candidate from the official list — never a blank, never two marks. This is what Estonia's IVXV lacks today and what a 2025 study proposes to add with compact Bulletproofs. Second, tally-hiding: homomorphic tallies reveal the full distribution of votes, which lets an attacker coerce with an "Italian attack" — craft a ballot with a rare signature pattern and read it in the published tally. The defence is to publish only the winners, with a zero-knowledge proof that they are the correct winners, which is exactly what a state-of-the-art system like Kryvos does.
(c) Coercion and bribery resistance — with an honest ceiling
The third requirement is receipt-freeness: a voter must not be able to prove how they voted, or a briber can demand that proof. Estonia's answer is re-voting: the coercer cannot know the last ballot won. Stronger families exist — fake-credential systems like JCJ/Civitas and trapdoor-tracker schemes like Selene — but every one of them has limits the researchers themselves document: no scheme resists a camera over the shoulder or a compromised phone, and re-voting assumes the coercer stops casting ballots. The honest claim is not "coercion is impossible" but "bribery becomes mathematically hard to verify," which is exactly what a supervised ZK polling station achieves.
(d) End-to-end verifiability for voters and auditors
Put the pieces together and every link becomes checkable. Cast as intended: the voter's device issues a challenge-encrypted ballot, or a return code (Swiss style). Recorded as cast: the ballot lands on an append-only public bulletin board with a per-voter tracker. Tallied as recorded: the ZK tally proof plus an open-source verifier — the same software the election commission runs — lets anyone recount in seconds. Recountability changes meaning: a recount is no longer "re-run the black box" but "re-run the public verifier."
Figure 2: The ZK election flow — eligibility proven, ballot secret, recount public
From research to ballots: what zk voting has actually done
The technology is past the whiteboard. Helios, an open-source homomorphic system used for real academic association elections since 2009, encrypts every ballot with a zero-knowledge proof of well-formedness and publishes a proof-carrying tally; its fix family, Helios'16, closes ballot-malleability attacks. Scantegrity II ran the only binding government election with true end-to-end verifiability (Takoma Park, Maryland) by printing confirmation codes on paper ballots. Vocdoni / DAVINCI, a public-voting protocol built on a proof-carrying blockchain, chains voter, aggregation, and tally circuits so that no proof, no state update — the network simply refuses to record a result that is not mathematically forced. On the research edge, feasibility studies show Groth16 ZK-SNARKs are practical for ballot validity at national scale, and a 2025 study proposed adding Bulletproofs range proofs to Estonia's own IVXV system to close exactly the malformed-ballot gap.
A useful way to read this landscape is by threat model. Helios-style systems assume cooperative, low-coercion environments — fine for a university society, wrong for a national parliament. Scantegrity-style paper-plus-crypto systems defend against machine and software failure by keeping paper as the ground truth. Vocdoni-style chains defend against a corrupted operator by making the proof a condition of the ledger accepting anything. Vietnam's designers do not have to choose one model in advance; the requirements triangle in the previous section is precisely the tool for deciding which model fits which election.
The disagreements are equally honest. Computer-security researchers (Appel, 2026; Rivest et al., 2015) argue that no internet voting is safe for binding political elections, because a malware-infected voting device defeats cast-as-intended and no dispute-resolution protocol exists. Blockchain voting, they add, is strictly worse than internet voting. The defenders — Swiss Post, Vocdoni — publish their threat models and concede the same weakness: the voter's device is the last mile that cryptography cannot protect. This is why the practical designs discussed below are not "vote from your phone"; they are supervised booths with paper overrides and return codes.
What Vietnam can actually build
Vietnam is already walking down this road. The constitution and the Law on Election of National Assembly Deputies guarantee universal, equal, direct, and secret elections — bỏ phiếu kín is a constitutional principle, not a technical detail. Decree 13/2023/ND-CP made personal data protection law, classifying political views and biometrics as sensitive data whose processing requires consent and strict minimization. VNeID, the national digital identity app, was rolled out for the 2026 National Assembly election cycle — explicitly for checking polling places, viewing candidate lists, and registering a change of voting location, not for casting votes online. Circular 21/2025/TT-BNV pushes digital transformation across election operations while insisting on data security and testing. Read together, these three documents describe a state that wants digital election tools but has no legal lane for a ballot that leaves an identifiable trace. That is precisely the gap ZK fills: the architecture keeps identity and choice in separate compartments so that the choice is never "processed" in the sense Decree 13 regulates.
Vietnamese legal scholarship on online voting (Journal of Democracy and Law, Ministry of Justice) has already enumerated the classic objections: fraud on uncontrolled devices, unequal access between urban and rural and between generations, and — most stubbornly — the transparency problem that voters cannot see what the machine does with the ballot. Notably, every one of these objections is about the absence of proof, not the presence of computers. A supervised kiosk answers the fraud concern with a paper override, the access concern with a physical location, and the transparency concern with a published, verifiable tally. The legal literature did not anticipate a design in which the machine is required to prove what it did; that design is exactly what ZK offers.
A phased Vietnamese pilot could look like this. Phase one — supervised ZK kiosks: the voter authenticates on VNeID level 2, the kiosk proves census membership with a nullifier, and the ballot is encrypted in front of the voter with a return code printed for verification; the paper ballot still wins the day by default. Phase two — hybrid counting: encrypted kiosk ballots are tallied homomorphically and cross-checked against the paper count. Phase three — public verifier: after the election, proof files and the open-source verifier are published so citizens, press, and civil-society engineers can recount independently — no authority required. Each phase runs as a controlled pilot per the spirit of Circular 21, and each pilot publishes its own results, its own proofs, and its own failure report.
The reason to invest is not novelty; it is the recountability demonstration. A Vietnamese voter's deepest doubt is not "was my vote counted" but "can anyone ever check the count without my trust?" A supervised ZK kiosk answers both: the machine never learns the choice, and the tally comes with a certificate anyone can verify.
Figure 3: Traditional e-voting vs ZK e-voting — the check moves from trust to verification
Frequently asked questions
Is ZK e-voting the same as blockchain voting?
No. Blockchain is only useful as a tamper-evident bulletin board and proof verifier. The voting itself is done with cryptographic ballots and ZK proofs; the chain records nullifiers and proof hashes. Rivest and colleagues argue persuasively that "blockchain voting" without ZK is worse than ordinary internet voting — so the ZK proof is the whole point.Does a ZK ballot prove what I voted?
It proves the opposite: the proof certifies the ballot is well-formed (one valid candidate) while revealing nothing about the choice. The verifier checks validity, not content. That distinction is the entire basis of ballot secrecy.Can the government still know how I voted?
Only if a threshold of officials collude to decrypt during the tally — and even then, the published decryption proofs let auditors recompute the result. A single official, the machine, and the tally software can never link a ballot to a voter, because the ballot never carries the identity.How does this fit Vietnamese law?
Decree 13/2023 requires data minimization for sensitive personal data; ZK is the only practical design in which the ballot choice is never associated with identity at all. VNeID provides the census root. Circular 21 provides the controlled-pilot framework. Nothing in current law forbids proof-carrying tallies.Does coercion resistance really work?
Receipt-freeness makes it mathematically hard for a briber to verify how anyone voted, because voters cannot produce a credible receipt. Physical threats — a camera over the shoulder, a compromised phone — remain outside cryptography's reach, which is why supervised kiosks and paper overrides stay part of the design.When could Vietnam actually use this?
Not for a nationwide election soon, and no honest engineer should promise otherwise. The realistic horizon is supervised kiosk pilots with paper overrides in selected districts, then hybrid counting with published verifier outputs — the same trajectory Switzerland, Estonia, and Takoma Park each took over a decade.Conclusion
Minh's grandfather asked the right question: how do we know what the machine was told? Bầu cử điện tử zk answers it with a certificate instead of a promise. Zero-knowledge proofs let an election prove its own honesty — the tally is forced, the ballots are secret, the eligibility is real, and any citizen can check the math. Bỏ phiếu zero knowledge is not a futuristic voting machine; it is a change in what an election is asked to prove. Estonia proved the procedure works, Brazil proved the audit gap is real, and Switzerland proved regulators can demand proofs and get them. Vietnam has the identity infrastructure, the data-protection law, and the appetite for digital elections — what it needs is the first supervised pilot whose tally anyone can verify. The machine does what its programmer says; the question is whether the programmer can be checked. With zero knowledge, the answer is yes — by everyone.
Quick Reference
| Property | Traditional E-Voting | ZK E-Voting |
|---|---|---|
| Ballot secrecy | Trusted staff and software | Mathematical proof, threshold decrypt |
| Voter check | Usually impossible after the booth | Return code / challenge ballot (cast-as-intended) |
| Tally check | Trust the software or re-run a black box | Anyone runs the open verifier |
| Eligibility | Verified at registration | Merkle census + nullifier, identity never transmitted |
| Coercion resistance | Possible (proof of vote exists) | Receipt-free — no credible proof to give |
| Recount | Re-run the machine | Re-run the public verifier, seconds |
| Real deployments | Estonia, Brazil, US DREs | Helios, Scantegrity II (Takoma Park), Vocdoni pilots |
| Legal fit (VN) | No verifiability lane | Decree 13 minimization + Circular 21 pilots |
| Best fit | Any election today | Supervised kiosks with paper override, hybrid counting |