> For the complete documentation index, see [llms.txt](https://valargroup.gitbook.io/shielded-vote-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://valargroup.gitbook.io/shielded-vote-docs/appendices/tally.md).

# Tally & Decryption

After the voting window closes, the tally proceeds in three steps.

## Step 1: Public aggregation

For each `(proposal_id, decision)` pair, everyone can publicly sum all submitted `enc_share` ciphertexts by component-wise point addition:

```
agg_ciphertext = (sum(C1_i), sum(C2_i))
```

This is fully verifiable — anyone can replay the addition from on-chain data and confirm the aggregate. No trust is required for this step.

## Step 2: Election authority decrypts

The election authority (tallier) decrypts the aggregate ciphertext using `ea_sk`:

```
sum(C2) - ea_sk * sum(C1) = total_value * G
```

Then recovers `total_value` via bounded discrete log lookup (feasible because the total vote weight is bounded by ZEC supply).

## Step 3: Publish result with proof

The tallier publishes `total_value` along with a **proof of correct decryption** — a discrete log equality proof (Chaum-Pedersen protocol).

This proves that the same `ea_sk` used to generate the published `ea_pk` was used to decrypt the aggregate, without revealing `ea_sk`. Anyone can verify this proof against:

* The published `ea_pk`
* The on-chain aggregate ciphertext
* The claimed `total_value`

## Privacy guarantee

Individual vote amounts are never revealed — only the aggregate total per `(proposal_id, decision)`.

## Trust model

* **Aggregation** is trustless — anyone can verify
* **Decryption** requires `ea_sk` — only the election authority can perform it
* **Correctness** is verifiable — the Chaum-Pedersen proof ensures the EA decrypted honestly
* **Liveness** — the EA must cooperate to produce the tally. If the EA disappears, the encrypted votes are on-chain but cannot be decrypted. (Threshold decryption among multiple authorities could mitigate this, but is out of current scope.)