swisspost-evoting-go-poc/pkg/hash/hash_test.go

48 lines
1.5 KiB
Go
Raw Normal View History

Due-diligence hardening + Rust transport-security layer Correctness/security review of the whole PoC, with fixes and regression tests. Cryptographic soundness: - mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was stubbed out with an empty if — without it a malicious mixer can prove a non-permutation shuffle. - zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of a biased `hash mod q` (which also capped the challenge space at 256 bits for production-sized groups). Verification honesty: - protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns the true aggregate result instead of an unconditional true. - protocol: persist the padded mix input (event.MixInput) so the verifier checks shuffle 0 against the same padding the tally used (fixes false INVALID for N<2). Other correctness: - kdf: length-prefix BuildKDFInfo parts so the info encoding is injective. - math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could panic in HashAndSquare); RandomGqElement samples the full canonical range. - cmd: validate demo --voters/--options instead of panicking on degenerate values. - protocol: use crypto/rand in the demo driver (drop the last math/rand import). Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519 ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek), linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the Rust static lib before the Go binary. Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp, mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 12:42:34 +00:00
package hash
import (
"bytes"
"math/big"
"testing"
)
func TestRecursiveHashDeterministic(t *testing.T) {
a := RecursiveHash(HashableString{Value: "x"}, HashableBigInt{Value: big.NewInt(42)})
b := RecursiveHash(HashableString{Value: "x"}, HashableBigInt{Value: big.NewInt(42)})
if !bytes.Equal(a, b) {
t.Fatal("RecursiveHash is not deterministic")
}
c := RecursiveHash(HashableString{Value: "y"}, HashableBigInt{Value: big.NewInt(42)})
if bytes.Equal(a, c) {
t.Fatal("distinct inputs produced identical hash")
}
}
// TestRecursiveHashListInjective guards the injective list-encoding property:
// nesting must matter, so (["a","b"]) and (["ab"]) must differ.
func TestRecursiveHashListInjective(t *testing.T) {
ab := RecursiveHash(HashableList{Elements: []Hashable{
HashableString{Value: "a"}, HashableString{Value: "b"},
}})
joined := RecursiveHash(HashableList{Elements: []Hashable{
HashableString{Value: "ab"},
}})
if bytes.Equal(ab, joined) {
t.Fatal("list encoding is not injective")
}
}
// TestRecursiveHashToZqRange checks the challenge derivation used by every ZK
// proof after the M1 fix: output must be a uniform-ish element of [0, q).
func TestRecursiveHashToZqRange(t *testing.T) {
q, _ := new(big.Int).SetString("89844208743431016055573512675532439356952812193549218135862349263748473368649", 10)
for i := 0; i < 100; i++ {
v := RecursiveHashToZq(q,
HashableString{Value: "challenge"},
HashableBigInt{Value: big.NewInt(int64(i))})
if v.Sign() < 0 || v.Cmp(q) >= 0 {
t.Fatalf("RecursiveHashToZq out of [0,q): %v", v)
}
}
}