How does the paper-slip voting protocol (Zettelchen-Voting) implement MPC for a yes/no vote?

Question

Accepted Answer

Each voter passes a slip in turn, adding +1 (yes) or +0 (no). The first voter starts with a large random number to hide their vote. The last value, minus the random starting number, is the total yes-count — but no voter ever sees how any other individual voted.
The protocol step by step (slide-by-slide):

Alice (the first voter) writes a random large number on the slip — say 849. She passes it secretly to Bob.
Bob adds his own vote: if Yes, +1 → 850; if No, +0 → 849. Passes secretly to Carol.
Carol does the same: +1 if Yes, +0 if No. Passes to David.
David does the same. Passes back to Alice.
Alice receives the final total (e.g. 851). She subtracts her secret random 849 → 2. That's the number of Yes-votes.
Alice publicly announces the result: "2 yes-votes out of 4."

What each voter learns:

✅ The total count of yes-votes.
❌ How anyone else voted individually — they only see the slip's value when it's their turn, which combines the random base + earlier votes (unknown to them).

What makes this work:

The random offset Alice chooses hides her own vote and everyone else's individual contributions.
Each intermediate value reveals only the partial sum plus an unknown random — no individual decoder.
The subtraction at the end is only possible by Alice, who knows the offset.

Trust assumptions (inherent to this kind of additive-sum protocol):

Each voter honestly adds 0 or 1 — no one substitutes other values.
No collusion — if Bob and David collude, they can compare their observed slips and isolate Carol's vote.

Why this is illuminating:

It demonstrates MPC without computers — the protocol is fundamentally about information flow, not cryptography.
A real e-voting system uses the same conceptual structure (homomorphic encryption replaces the random offset), but the security guarantees are provided by cryptographic hardness rather than physical envelopes.

Tip: The paper-slip protocol is exactly what's described as "secret-sharing-based MPC" in academic literature — Alice's r is a one-time pad over the sum. Real systems use Shamir secret sharing or additive secret sharing in finite fields, but the intuition is the same.