BAVS-ZK: Hybrid Entropy-Based Credential Derivation for Anonymous Blockchain E-Voting

Abstract

Blockchain-based electronic voting systems that use zero-knowledge proofs (ZKPs) have been proposed as good candidates to provide both transparency and privacy of ballots. However, a fundamental challenge remains unmet in all existing schemes: the secure generation and protection of the voter's cryptographic secret key.In this paper, HME-KG (Hybrid Multi-Source Entropy Key Generation) is presented, a new credential derivation method which utilizes a cryptographically secure random salt, the national identity number of the voter and a per-device Client Device Secret (CDS) to derive a deterministic, brute-force-resistant secret key. HME-KG is integrated into BAVS-ZK, a complete anonymous blockchain voting framework employing AES-256-GCM encrypted credential storage, a Circom-based Groth16 zk-SNARK voting circuit, and on-chain nullifier verification via Ethereum Sepolia smart contracts. Security analysis demonstrates that HME-KG achieves voter determinism, cross-voter uniqueness, single-source failure resistance, and collision resistance under the security assumptions of SHA-256. Experimental evaluation on a 10,000-voter simulation confirms a 0.9998 scalability coefficient, 1.2-second proof generation, and 306,720 gas per vote—a 38.6% reduction compared to the Open Vote Network baseline. To the extent of current literature, BAVS-ZK is the first blockchain e-voting system to provide a complete, formally specified, and experimentally validated voter credential derivation and protection scheme.