  Collecting anonymous opinions finds various applications ranging from simple
whistleblowing, releasing secretive information, to complex forms of voting,
where participants rank candidates by order of preferences. Unfortunately, as
far as we know there is no efficient distributed solution to this problem.
Previously, participants had to trust third parties, run expensive
cryptographic protocols or sacrifice anonymity. In this paper, we propose a
resilient-optimal solution to this problem called AVCP, which tolerates up to a
third of Byzantine participants. AVCP combines traceable ring signatures to
detect double votes with a reduction from vector consensus to binary consensus
to ensure all valid votes are taken into account. We prove our algorithm
correct and show that it preserves anonymity with at most a linear
communication overhead and constant message overhead when compared to a recent
consensus baseline. Finally, we demonstrate empirically that the protocol is
practical by deploying it on 100 machines geo-distributed in 3 continents:
America, Asia and Europe. Anonymous decisions are reached within 10 seconds
with a conservative choice of traceable ring signatures.
