Consider using third-party ballot updating

[AaronFeickert]

Consider using third-party ballot updating

[AaronFeickert]

Note that in the current design, it is not possible for a coercer to see if its voter updated its ballot during the election, but the coercer learns this after the election ends.

In the updated design, provided the updater performs its updates sufficiently, it is never possible for a coercer to learn this information. However, there are failure modes if the updater is dishonest or corrupted:

• If the updater does not perform ballot updates, a coercer can assert that its voter's ballot was not updated.
• If the updater colludes with the coercer during or after the election, the coercer learns if/when its voter's ballot is updated.

Effectively, the only new failure mode arises if the updater colludes with the coercer during the election.

[AaronFeickert]

The above failure mode is mitigated if multiple entities act as updaters and do not fully collude. In this case, the disjunctive proof needs to be modified to account for the presence of multiple valid updater verification keys.