  To preserve voter secrecy on untrusted voter devices we propose to use short
voting codes. This ensures voting codes remain practical even if the voter is
able to select multiple voting choices. We embed the mechanism in a protocol
that avoids complex cryptography in both the setup and the voting phase and
relies only on standard cryptographic primitives. Trusting the setup, and one
out of multiple server components, the protocol provides vote secrecy,
cast-as-intended, recorded-as-cast, tallied-as-recorded, eligibility and
universal verifiability.
