mirror of
https://github.com/saymrwulf/swisspost-evoting-go-poc.git
synced 2026-07-21 19:19:01 +00:00
saymrwulf
ec4be74e17
Correctness/security review of the whole PoC, with fixes and regression tests.
Cryptographic soundness:
- mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was
stubbed out with an empty if — without it a malicious mixer can prove a
non-permutation shuffle.
- zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of
a biased `hash mod q` (which also capped the challenge space at 256 bits for
production-sized groups).
Verification honesty:
- protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns
the true aggregate result instead of an unconditional true.
- protocol: persist the padded mix input (event.MixInput) so the verifier checks
shuffle 0 against the same padding the tally used (fixes false INVALID for N<2).
Other correctness:
- kdf: length-prefix BuildKDFInfo parts so the info encoding is injective.
- math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could
panic in HashAndSquare); RandomGqElement samples the full canonical range.
- cmd: validate demo --voters/--options instead of panicking on degenerate values.
- protocol: use crypto/rand in the demo driver (drop the last math/rand import).
Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519
ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek),
linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust
Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the
Rust static lib before the Go binary.
Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp,
mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
96 lines
3 KiB
Go
96 lines
3 KiB
Go
package protocol
|
|
|
|
import (
|
|
"math/big"
|
|
|
|
"github.com/user/evote/pkg/elgamal"
|
|
emath "github.com/user/evote/pkg/math"
|
|
"github.com/user/evote/pkg/mixnet"
|
|
"github.com/user/evote/pkg/returncodes"
|
|
"github.com/user/evote/pkg/zkp"
|
|
)
|
|
|
|
// ControlComponent represents one of the 4 control components.
|
|
type ControlComponent struct {
|
|
ID int
|
|
ElectionKeyPair elgamal.KeyPair
|
|
ReturnCodeSecret emath.ZqElement
|
|
SchnorrProofs []zkp.SchnorrProof
|
|
}
|
|
|
|
// ElectoralBoard holds the electoral board's key material.
|
|
type ElectoralBoard struct {
|
|
Passwords []string
|
|
SK elgamal.PrivateKey
|
|
PK elgamal.PublicKey
|
|
}
|
|
|
|
// VotingCard holds a voter's credentials.
|
|
type VotingCard struct {
|
|
VoterID string
|
|
VerificationCardID string
|
|
StartVotingKey string // SVK for authentication
|
|
ChoiceReturnCodes []string // Expected choice return codes
|
|
VoteConfirmCode string // Expected vote cast return code
|
|
BallotCastingKey string // BCK for confirmation
|
|
}
|
|
|
|
// EncryptedVote holds a voter's encrypted ballot and proofs.
|
|
type EncryptedVote struct {
|
|
VoterID string
|
|
VerificationCardID string
|
|
Ciphertext elgamal.Ciphertext
|
|
ExponentiatedCT elgamal.Ciphertext // E1_tilde (size 1)
|
|
EncryptedPCC elgamal.Ciphertext // E2 (encrypted partial choice return codes)
|
|
ExpProof zkp.ExponentiationProof
|
|
EqProof zkp.PlaintextEqualityProof
|
|
}
|
|
|
|
// BallotBox holds all confirmed encrypted votes.
|
|
type BallotBox struct {
|
|
Votes []EncryptedVote
|
|
}
|
|
|
|
// ElectionEvent holds the entire election state.
|
|
type ElectionEvent struct {
|
|
Config *Config
|
|
CCs []*ControlComponent
|
|
EB *ElectoralBoard
|
|
ElectionPK elgamal.PublicKey // Combined election public key
|
|
ReturnCodesPK elgamal.PublicKey // Combined return codes public key
|
|
Primes []*big.Int // Small primes for vote encoding
|
|
VotingCards []*VotingCard
|
|
BallotBox *BallotBox
|
|
MappingTable *returncodes.MappingTable
|
|
// Tally results
|
|
MixInput *elgamal.CiphertextVector // Padded ballot ciphertexts fed to shuffle 0 (persisted so the verifier uses the SAME padding)
|
|
ShuffleResults []mixnet.VerifiableShuffle
|
|
PartiallyDecrypted []*elgamal.CiphertextVector // Partially decrypted ciphertexts after each CC
|
|
DecryptionProofs [][]zkp.DecryptionProof // Per-CC decryption proofs (one slice per shuffle stage)
|
|
DecryptedVotes []*emath.GqVector
|
|
FinalResult map[int]int // option index → vote count
|
|
}
|
|
|
|
// NewBallotBox creates an empty ballot box.
|
|
func NewBallotBox() *BallotBox {
|
|
return &BallotBox{Votes: []EncryptedVote{}}
|
|
}
|
|
|
|
// AddVote adds a vote to the ballot box.
|
|
func (bb *BallotBox) AddVote(vote EncryptedVote) {
|
|
bb.Votes = append(bb.Votes, vote)
|
|
}
|
|
|
|
// Size returns the number of votes.
|
|
func (bb *BallotBox) Size() int {
|
|
return len(bb.Votes)
|
|
}
|
|
|
|
// GetCiphertexts returns all vote ciphertexts as a CiphertextVector.
|
|
func (bb *BallotBox) GetCiphertexts() *elgamal.CiphertextVector {
|
|
cts := make([]elgamal.Ciphertext, len(bb.Votes))
|
|
for i, v := range bb.Votes {
|
|
cts[i] = v.Ciphertext
|
|
}
|
|
return elgamal.NewCiphertextVector(cts)
|
|
}
|