Four words for this page.
One polling station's result, printed at the end of the day: registered voters, turnout, votes per candidate, blank and spoiled. Since 2015 it carries a QR code; five copies are printed, and one is posted on the station's door.
The table where the machine writes each vote into a randomly drawn row, in the clear, with nothing linking it to the voter. It is the "shuffle" that protects secrecy. It stays inside the machine.
A mathematical seal that only the machine's private key can produce and anyone can check. It is everywhere: on the software the machine agrees to run, on the ceremony's hash table, on the tally. Today it is of a kind a large quantum computer would forge.
What the voter takes home. Today, nothing. The electoral court argues that a readable paper buys votes and coerces. It is right about paper: a receipt that proves without revealing is a different object.
Custody and signatures, not cryptography over the vote.
Reading what the electoral court describes, the machine's security is a chain of custody (the machine has no network, the software is compiled and sealed in a public ceremony, the media travels by hand) and of digital signatures (the system only executes what is signed, the embedded security module holds the key, the tally leaves signed and the server discards whatever fails the check). The vote itself is never encrypted: it is written in the clear into a drawn row.
That explains why homomorphic encryption, which we sum with and sell for other elections, does not belong in the court's machine. Summing encrypted tallies solves a problem the central count does not have: it already sees only per-station aggregates, signed and public. We say this before any hook, so as not to sell a solution without a problem.
What the chain leaves open are three points, all recorded by the court itself as design choices: the voter takes no proof home; the audit tests sampled machines, not the result; and all the trust rests on signatures of a kind that already has a date to become forgeable. Those three are where the 2026 work fits.
The receipt that cannot buy a vote.
The court's argument against a paper receipt is correct: a readable paper becomes proof for whoever buys or coerces. What voting cryptography offers is a different object. The vote is encrypted at the moment of Confirm; the receipt is the fingerprint of the encrypted vote, published on a chained public board; alongside goes a proof that the content is a valid vote, without saying which. The voter checks at home that the receipt is on the board. They cannot show anyone whom they voted for, because the receipt does not say.
We made this work end to end in our lab: one credential per voter ID, receipt, chained board, proof of a valid vote, and opening of the result only by a group of custodians, three of five. The RDV already shuffles by drawing a row, but in the clear and inside the same machine. The receipt gives the voter the individual verification that today exists only collectively, through the tally.
The limit, stated plainly: receipt and proof do not zero out coercion if the voter can prove the content to a third party. The design mitigates, it does not eliminate. And it is exactly what we sell where there is no electoral court: unions, assemblies and boards, where today the alternative is somebody's spreadsheet.
Audit the result, not the machine.
The machine's audit tests machines: a batch is drawn, known ballots are cast on them, and the count is checked. It is a good equipment audit. It is not a result audit: it does not say, with a declared risk, that the proclaimed winner is the winner. The court itself calls that check a sample, and it is.
There is a family of audits designed for the other question, the risk-limiting audits: records are drawn until the chance of certifying a wrong result falls below a chosen limit. We measured two in our lab, in a simulated election with a tight 1% margin. The one that only counts ballots needed 65,415; the one that compares each drawn ballot with the machine's record needed 629, one hundred and four times fewer. At a declared 5% risk, the wrongful certification we observed was 0.43% and 1.40%, under the limit.
The condition is having a record independent of the machine to compare against. In the Brazilian machine, by design, it does not exist per voter: the tally on the station door is the only independent copy, and it is per station. This is where hook one feeds hook two: the receipt published on the board is exactly the record a comparison audit needs, with no paper in anyone's hand.
The 2028 signature does not fit the QR code.
Everything in the machine is a digital signature: the software it agrees to run, the ceremony's hash table, the security module's certificate, the tally. More than four million certificates have been issued by the electoral court's certificate authority. According to the independent verifier that reads the court's public files, the machine's hardware key is a 521-bit elliptic curve. It is strong today and it is in the family Shor's algorithm breaks. For signatures the risk is not "record now, open later"; it is that any archived tally becomes forgeable retroactively, and the comparison of door tally against portal loses its anchor.
The UE2028 model is being specified now, and a machine serves ten years: the 2015 model still votes in 2026. So we asked the most concrete question we could: if the tally were signed with the post-quantum standard, would it still fit the QR code the court's app reads? We built a municipal tally in the QR's text format and signed it with six algorithms.
| Signature | Bytes | Characters, in hex | QRs for the tally (1,100 characters each) | QRs for the signature alone | Verify 563,910 tallies, 8 cores |
|---|---|---|---|---|---|
| Ed25519 (today's QR) | 64 | 128 | 3 | 1 | 11.2 s |
| ECDSA P-256 | 72 | 144 | 3 | 1 | 9.6 s |
| RSA-2048 | 256 | 512 | 3 | 1 | 4.7 s |
| ML-DSA-44 (post-quantum, level 2) | 2,420 | 4,840 | 8 | 6 | 4.9 s |
| ML-DSA-65 (post-quantum, level 3) | 3,309 | 6,618 | 10 | 8 | 7.3 s |
| ML-DSA-87 (post-quantum, level 5) | 4,627 | 9,254 | 12 | 10 | 9.1 s |
Fictional municipal tally of 1,947 characters, 5 candidates for mayor and 150 for the council, in the key:value format of the TSE manual. Each QR carries 1,100 characters, about 934 of them usable after the header and the hash; the manual says large tallies already reach four QRs today. With the current signature the fictional tally takes three. With ML-DSA-65, ten: the signature alone is eight. The hypothesis of printing the signature as raw bytes, in symbols of the same size, gives four QRs for ML-DSA-44 and five for ML-DSA-65, because the limit is the printer, not the QR standard. The time is verification on an ordinary computer for every machine in the country: the migration costs size, not time.
The signature envelope the machine writes already has an algorithm field with three values: RSA, elliptic curve, and the armed forces' research centre's own algorithm. Adding the post-quantum standard to the envelope is a small change. The QR is not: either the tally goes from three to ten symbols printed on thermal paper, or the signature goes in separate QRs, or the app fetches the signature from the portal and the QR carries only the tally and its fingerprint. Any of the three is a specification decision for the UE2028, and it has to be made before buying the machine, not after. It is what we describe in post-quantum identity for devices and in the quantum computer's clock.
Three decisions that belong in the specification, not on election day.
Give the UE2028 a security module that can switch algorithms.
The envelope already has the field. What is missing is hardware that signs in ML-DSA and in elliptic curve at the same time during the transition, and a court certificate authority that issues hybrid certificates. Bought without that, the module is classical until 2038.
Decide where the large signature goes on the tally.
Ten QRs in sequence, separate QRs for the signature alone, or the QR carrying only the tally and its fingerprint while the signature sits on the portal. Each choice changes the app citizens use. Measuring first, as we did above, costs an afternoon.
Publish a record that lets the result be audited.
Without an independent record per voter, the risk-limiting audit is expensive or impossible. The cryptographic receipt published on a chained board is that record, with no paper. It is the only one of the three decisions that changes the voter's experience, and therefore the slowest.
Where this may be wrong.
We do not say the machine is insecure
There is no proven fraud in thirty years, and the custody-and-signature chain is a serious design. The three hooks touch windows the court itself describes as choices, not flaws.
The tally is fictional, the format is not
We use the key:value format and the 1,100-character-per-QR limit from the TSE's official manual (2024 edition), but the tally is invented, with 150 council candidates. Real sections range from one to four QRs today. The number of QRs changes with the tally; the size of the signature, which dominates the count, does not.
The cheap audit needs what the machine lacks
The 629 records hold for an election with an independent record per voter. Without it, the number does not apply to today's machine. We present the cost to show the size of the gain, not as something the court could do tomorrow.
The quantum clock is a thesis, not a date
That elliptic-curve signatures are breakable by a large quantum computer is a fact. When that computer exists is our estimate, and it may be wrong in either direction. The machine's argument does not depend on the date: it depends on the machine serving ten years.
Does this apply to your case?
If you run elections outside the electoral court, in a union, a cooperative, a board or an assembly, tell us in two lines how many people vote and who needs to trust the result. The first conversation is to see whether a receipt that cannot buy a vote solves it, and, if your spreadsheet is already enough, we say so.
← Research notebook · Locked data (FHE) · Post-quantum · stickybit.com.br
- Our measurement (Oct 5, 2026, corrected Oct 6): a fictional municipal tally of 1,947 characters signed with Ed25519, ECDSA P-256, RSA-2048 and ML-DSA-44/65/87 (circl library, FIPS 204); verification of 563,910 tallies on an ordinary 8-core computer, median of runs in the same session.
- QR format and limit: "QR Code no Boletim de Urna: manual para a criação de aplicativos de leitura", TSE, 2024. Up to 1,100 alphanumeric characters per QR because of the thermal printer, key:value format, SHA-512 hash chained across QRs, Ed25519 signature in the last QR with one key per state published by the TSE.
- Our measurement (Aug 2026): risk-limiting audit in a simulated election, 1% margin, declared risk 5%: 65,415 records by counting (BRAVO) against 629 by comparing with the machine's record; wrongful certification 0.43% and 1.40% over 1,000 audits.
- Verifiable voting lab: encrypted vote, receipt as fingerprint of the encrypted vote, chained board, proof of a valid vote and opening by three-of-five custodians; described in applications of locked data.
- How the machine works (custody, security module, system that only runs signed code, RDV, tally, QR since 2015, five copies, sampled integrity test, 563,910 machines in 2026, UE2028 under specification): "Como funciona a urna eletrônica brasileira", TabNews, Oct 2026, based on public material from the electoral court (TSE).
- Signature envelope of the result files (RSA, ECDSA and Cepesc algorithms; SHA-512 hash; hardware key on a 521-bit curve) and raw per-machine files: independent verifier var-ue (GitHub, epicleet) and the TSE's public result archives, dadosabertos.tse.jus.br.
- Why elliptic-curve and RSA signatures are forgeable by a large quantum computer, and what to do first: the clock and post-quantum identity for devices.