MAYA: A Short Shuffle Argument With Fast Verification

Paper

Mon, 01 Jan 0001 00:00:00 +0000

MAYA: A Short Shuffle Argument With Fast Verification

Authors: Thi Van Thao Doan, Olivier Pereira, and Thomas Peters

Affiliation: UCLouvain, B-1348 Louvain-la-Neuve, Belgium

Published at: 33rd ACM Conference on Computer and Communications Security (CCS'26), to appear.

Abstract

Shuffle arguments dominate the audit data in end-to-end verifiable elections when homomorphic tallying is not applicable. Deployed mixnets in countries like Australia, Estonia, Israel, Norway, Spain, and Switzerland produce proofs that scale linearly, reaching gigabytes for millions of ciphertexts. MAYA achieves O(log n) communication complexity with a transparent setup requiring no trusted parameters.

Verifier Specification

Mon, 01 Jan 0001 00:00:00 +0000

The MAYA Verifier Specification is a complete, language-agnostic verification procedure. Together with the election record, it enables an independent developer to write a working verifier from scratch, in any programming language, without access to the MAYA source code or the research paper.

Specification Documents

Version	Specification	Date
1.0	Download	September 2026

The specification defines the exact binary format of all data, the deterministic derivation of public parameters, the hash-based Fiat–Shamir transcript protocol, and the step-by-step verification algorithm.

What the Specification Covers

Group and scalar arithmetic for Ristretto255 (Section 3)
Data formats and serialization (Section 4)
Deterministic generator derivation / CRS (Section 5)
Hash computation and Fiat–Shamir transcript (Section 6)
Challenge vector derivation (Section 7)
Complete verification algorithm in 6 steps (Section 8)
IPA and eCP sub-protocols (Sections 9–10)
Test vectors for every intermediate computation (Section 11)

Test Vectors

Section 11 of the specification provides reference values for every intermediate computation a verifier performs, so that each stage can be validated independently before moving to the next. A mismatch at any stage pinpoints the module that needs fixing.

MAYAsk: Swiss-Knife Extensions

Mon, 01 Jan 0001 00:00:00 +0000

Real-world election systems rarely fit the standard cryptographic model of a single list of ciphertexts encrypted under one public key. In practice, ciphertexts may need to remain grouped by precinct or municipality, different groups may use different encryption keys, and shuffling may be combined with partial decryption or secret exponentiation.

MAYAsk — MAYA Swiss-Knife — is the extended construction that accommodates these settings while preserving the properties of the base protocol. Specifically, it gives logarithmic-size arguments for block-respecting shuffles, shuffles of ciphertexts encrypted under different public keys, shuffles combined with partial decryption using a mixer’s secret-key share, and shuffles combined with secret exponentiation of selected ciphertext components. In all cases the resulting arguments retain logarithmic size in the number of ciphertexts, require a transparent setup, and have verification dominated by a single multi-scalar multiplication.

Getting Started: Build Your Own Verifier

Mon, 01 Jan 0001 00:00:00 +0000

The MAYA verifier can be built and tested incrementally. Each step below produces a testable output that can be validated against the test vectors in the specification before moving to the next. You can implement the verifier in any programming language.

Where the Proof Comes From

A verifier reads two inputs:

The input ciphertexts file, taken from the bulletin board or from the previous mix layer. It carries the number of ciphertexts n, the two coordinate vectors of the input ciphertexts, and the public key (g, f, h).
The proof bundle, produced by the mix server that performed the shuffle. It carries the serialized proof, the vector commitment V, and the coordinate vectors of the output ciphertexts.

Both files are plain binary with the layout fixed in Section 4 of the specification, and both must have exactly the length implied by their declared counters. An implementation may read the same fields from a database or a network API instead, as long as every field is present and every structural check is applied.

Code & Repositories

Mon, 01 Jan 0001 00:00:00 +0000

MAYA is implemented in Rust with two curve instantiations. The source code accompanies the research paper.

The current artifact reproduces the performance measurements reported in the paper. A public API for allowing users to shuffle their own ciphertexts is still under development. Once available, this page will be updated with the corresponding usage instructions and commands.

Repositories

Repository	Contents
maya_shuffle_proof	The code evaluated in the paper, as `maya_ristretto` (Ristretto255, curve25519-dalek) and `maya_p256` (NIST P-256, arkworks)
maya_extensions	The current implementation, together with the MAYAsk protocols

See the Changelog for what changed between them. The commands below are for maya_shuffle_proof.

Changelog

Mon, 01 Jan 0001 00:00:00 +0000

Two versions of the MAYA implementation are public.

Version 2 — current (August 2026)

uclcrypto/maya_extensions

One hash function. Version 1 used three primitives: a Merlin transcript for Fiat–Shamir, SHA3-512 for the Pedersen generators, and SHAKE256 for the Bulletproof generators. Version 2 uses HMAC-SHA-256 for all three. HMAC-SHA-256 is in the standard library of every mainstream language, so a verifier can be written in any of them without reproducing a Rust-specific transcript construction.

Team

Mon, 01 Jan 0001 00:00:00 +0000

MAYA is developed at UCLouvain (Université catholique de Louvain), Louvain-la-Neuve, Belgium.

Thi Van Thao Doan — Researcher, UCLouvain
Olivier Pereira — Professor, UCLouvain
Thomas Peters — Professor, UCLouvain

Contact

For questions about the MAYA specification, implementation, or to report issues, please open an issue on the GitHub repository or contact the team at UCLouvain.

Acknowledgments

This work has been funded in part by the Walloon Region through the project CyberExcellence (convention number 2110186).

FAQ

Mon, 01 Jan 0001 00:00:00 +0000

What is MAYA?

MAYA is a shuffle argument with O(log n) communication complexity and a transparent setup. It proves that a mix server correctly permuted and re-randomized a list of ElGamal ciphertexts without altering, adding, or dropping any vote.

What curves does MAYA support?

MAYA is instantiated on two curves: Ristretto255 (Curve25519, via curve25519-dalek) and NIST P-256 (via arkworks). The protocol is algebraically generic and can be adapted to other prime-order groups.