基于SSH密钥的会员制社区能否实现防篡改匿名计票软件？

Absolutely—this is a perfect fit for cryptographically secure, verifiable anonymous voting systems that play nicely with your existing SSH key setup. You don’t need to trust manual counting, and we can ensure ballots stay private while being impossible to tamper with. Here’s how to make this work:

Core Cryptographic Foundations #

The two most reliable approaches for your use case are blind signatures or zero-knowledge proofs (ZKPs)—both let you validate a voter is a community member (via their SSH key) without exposing their actual vote, and guarantee votes can’t be altered after submission:

• Blind Signatures: The simpler, more accessible option. A voter "blinds" their vote (encrypts it to hide content), sends it to the system. The server uses the voter’s SSH public key to confirm membership, signs the blinded ballot, and sends it back. The voter then unblinds it to get a signed, anonymous vote they can submit. The server can later verify the signature is valid but can’t link it to the voter or see the original vote content.
• ZKPs: For ironclad privacy (like hiding even that a member voted), you could use ZK-SNARKs. This lets a voter prove they’re a valid member (using their SSH key as identity) and that their vote is legitimate, without revealing any extra details. It’s more complex but offers the strongest anonymity guarantees.

Step-by-Step Workflow with SSH Keys #

Tailored to your community’s existing SSH infrastructure:

1. Voter Prepares Ballot: The voter creates their vote (e.g., vote: "yes"), then uses a blind signature algorithm (like RSA-based blinding via OpenSSL) to obscure the content.
2. SSH Identity Check: The voter connects to the voting server via SSH using their existing private key. The server checks that their public key is in the approved community member list—no extra credentials required.
3. Blind Signature Issuance: The server signs the blinded ballot (without seeing the actual vote) and sends it back. It also records the voter’s public key as having requested a signature (to block duplicate votes, without linking the key to a vote).
4. Unblind & Submit: The voter unblinds the signed ballot to get an anonymous, authenticated vote. They submit this to a public tallying system—this can be a simple server that collects valid signed votes.
5. Verifiable Tallying: Once voting closes, the tallying system publishes all valid signed votes (no voter identifiers attached) and the final count. Any member can verify their vote is included and that the tally is accurate—no need to trust a third party.

Practical Program Options #

You have two solid paths to implement this:

• Custom Tooling: Build a lightweight server using libssh (for SSH authentication) and OpenSSL (for blind signatures). This gives you full control over the workflow—you can code it to validate SSH keys, process blind signature requests, and track used keys to prevent duplicates.
• Adapt Open Source Voting Tools: Look for open-source anonymous voting systems that can be modified to use SSH keys instead of passwords. Most include built-in verification features to ensure the tally is accurate, so you won’t have to build everything from scratch.

Critical Security Guardrails #

To ensure the system is robust:

• Block Duplicate Votes: The server must track which SSH public keys have requested a blind signature—once a key is used, it can’t request another. This stops multiple votes from the same member without linking keys to votes.
• Public Verifiability: Publish all valid signed votes after voting closes. Members can cross-check their own vote is present and verify the tally math themselves.
• Secure Key Storage: Keep the server’s private key (used to sign blinded ballots) locked down—if it’s compromised, attackers could forge valid votes.

内容的提问来源于stack exchange，提问作者Flying Jay