Leading Cryptology Group Forced to Re-run Election After Losing Decryption Key

A prominent international cryptology organisation has been forced to abandon the announcement of its leadership election results after one of its officials misplaced a crucial piece of encrypted data needed to unlock the vote tally.

The International Association for Cryptologic Research (IACR) uses an electronic voting system that relies on cryptographic safeguards. To access election results, three designated trustees must each provide their portion of an encrypted key. Only when all three components are combined can the final vote be decrypted.

According to a public statement, one trustee accidentally lost their private key—described as an “honest but unfortunate human mistake.” Without this missing share, the results cannot be recovered, leaving the final outcome inaccessible. The organisation has therefore decided to invalidate the election and run it again, promising improved procedures to prevent future lapses.

The IACR, founded in 1982, is a non-profit dedicated to advancing the study of cryptology. Voting for three Director roles and four Officer positions opened on 17 October and closed on 16 November. The group conducted the election using Helios, an open-source, browser-based voting system that encrypts all ballots to maintain secrecy.

The three trustees selected to safeguard the decryption material were each given one-third of the key. Two successfully uploaded their portions as required, but the third never did—effectively making the results irretrievable.

The organisation expressed regret over the situation, emphasising that it takes the error “very seriously.” Security expert Bruce Schneier noted that even strong cryptographic systems remain vulnerable to human error, whether through forgotten keys, incorrect sharing, or operational mistakes.

The IACR has restarted the voting process, which will now run until 20 December. For the rerun, the trustee who lost their key has been replaced, and the organisation is implementing a new two-out-of-three threshold system for key management, supported by clearer written procedures for trustees.