Landing cards now mention the multi-party re-architecture, Rust transport layer,
and cast-as-intended, with corrected slide counts. Operations manual: replace
the 'no network / same machine' framing with the netdemo trust-boundary
explanation, update prerequisites (Go 1.25 + Rust, make build), and fix the
'no network access required' line (netdemo's signed transport runs in-process).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New Part IV½ shows the return-code cast-as-intended mechanism (E2 + plaintext-
equality proof, CC exponentiation + joint decryption) and the transport-security
layer (Ed25519/X25519, Ed25519 X.509 PKI, implemented in Rust) — so the deck's
existing "cast-as-intended" claim is now backed by the actual construction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New section covers splitting the parties, the Rust transport-security layer
(Ed25519/X25519 over cgo, no RSA), the validated wire boundary, and cast-as-
intended return codes. Also corrects the error-handling slide (the netdemo mode
does cross a real trust boundary) and notes the Rust dependency on the deps
slide. Verified: deck serves 200 and the script balances.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New subcommand runs the entire election as separate parties over the
Rust-signed transport, printing per-phase progress and the verified message
count. --verbose logs every signed envelope (from -> to : type, signature OK).
--voters/--options are validated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Correctness/security review of the whole PoC, with fixes and regression tests.
Cryptographic soundness:
- mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was
stubbed out with an empty if — without it a malicious mixer can prove a
non-permutation shuffle.
- zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of
a biased `hash mod q` (which also capped the challenge space at 256 bits for
production-sized groups).
Verification honesty:
- protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns
the true aggregate result instead of an unconditional true.
- protocol: persist the padded mix input (event.MixInput) so the verifier checks
shuffle 0 against the same padding the tally used (fixes false INVALID for N<2).
Other correctness:
- kdf: length-prefix BuildKDFInfo parts so the info encoding is injective.
- math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could
panic in HashAndSquare); RandomGqElement samples the full canonical range.
- cmd: validate demo --voters/--options instead of panicking on degenerate values.
- protocol: use crypto/rand in the demo driver (drop the last math/rand import).
Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519
ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek),
linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust
Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the
Rust static lib before the Go binary.
Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp,
mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Proof-of-concept reimplementation of the Swiss Post e-voting
cryptographic protocol in Go. Single binary, 52 source files,
2 dependencies. Covers ElGamal encryption, Bayer-Groth verifiable
shuffles, zero-knowledge proofs, return codes, and a full
election ceremony demo.
