Update file/LOC counts (52→~94 files, ~10.5K LOC), add the Rust transport-security
crate and Ed25519/X25519 (no RSA) to the comparison table, add the party-isolation
row and netdemo mode, and point the presentation links at the served web/ decks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ARCHITECTURE: replace the "return codes simulated" scope limit with the
cast-as-intended design (E2 + plaintext-equality proof, CC exponentiation +
decryption, voter check, substitution-attack test) and document the remaining
honest limits (single-选option; return-code lookup lets the server infer the
selection — a privacy simplification that does not affect tally secrecy).
README: note that netdemo return codes are cast-as-intended.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
README: add pkg/transport + pkg/party to the component table and project tree,
document `evote netdemo` alongside `demo`, point to ARCHITECTURE.md.
ARCHITECTURE: document the implemented message flow per phase; the design
decision (ciphertexts cross the signed transport, proofs go to the bulletin-board
transcript); which due-diligence findings were folded in (M4/F6/F7/F8/F12); and
honest scope limits (F5 not reimplemented; return codes derived, not homomorphic
over the ciphertext, per F16 — but with the F1 derivation mismatch fixed).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Correctness/security review of the whole PoC, with fixes and regression tests.
Cryptographic soundness:
- mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was
stubbed out with an empty if — without it a malicious mixer can prove a
non-permutation shuffle.
- zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of
a biased `hash mod q` (which also capped the challenge space at 256 bits for
production-sized groups).
Verification honesty:
- protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns
the true aggregate result instead of an unconditional true.
- protocol: persist the padded mix input (event.MixInput) so the verifier checks
shuffle 0 against the same padding the tally used (fixes false INVALID for N<2).
Other correctness:
- kdf: length-prefix BuildKDFInfo parts so the info encoding is injective.
- math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could
panic in HashAndSquare); RandomGqElement samples the full canonical range.
- cmd: validate demo --voters/--options instead of panicking on degenerate values.
- protocol: use crypto/rand in the demo driver (drop the last math/rand import).
Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519
ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek),
linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust
Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the
Rust static lib before the Go binary.
Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp,
mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
