We have presented seven desirable properties of polling systems, as well as the design and implementation of Sensus, a practical electronic polling system that satisfies these properties. Our system protects voter privacy, even when election authorities collude. It also allows voters to verify that their votes have been counted correctly, and anonymously challenge the results should their votes be miscounted. Sensus will not accept ballots from those not registered to vote, nor will it accept more than one ballot from each registered voter. Invalid ballots can only be introduced into the final tally by the validating authority if some voters do not submit ballots.
Mock elections conducted with Sensus indicate that the system is convenient for voters to use. Voters can generally mark a short ballot and complete all cryptographic functions and transactions with election authorities within a few minutes. Integration of the user interface with a World Wide Web browser would make Sensus even easier to use.