mirror of
https://github.com/saymrwulf/swisspost-evoting-go-poc.git
synced 2026-09-04 20:23:55 +00:00
saymrwulf
ec4be74e17
Correctness/security review of the whole PoC, with fixes and regression tests.
Cryptographic soundness:
- mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was
stubbed out with an empty if — without it a malicious mixer can prove a
non-permutation shuffle.
- zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of
a biased `hash mod q` (which also capped the challenge space at 256 bits for
production-sized groups).
Verification honesty:
- protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns
the true aggregate result instead of an unconditional true.
- protocol: persist the padded mix input (event.MixInput) so the verifier checks
shuffle 0 against the same padding the tally used (fixes false INVALID for N<2).
Other correctness:
- kdf: length-prefix BuildKDFInfo parts so the info encoding is injective.
- math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could
panic in HashAndSquare); RandomGqElement samples the full canonical range.
- cmd: validate demo --voters/--options instead of panicking on degenerate values.
- protocol: use crypto/rand in the demo driver (drop the last math/rand import).
Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519
ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek),
linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust
Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the
Rust static lib before the Go binary.
Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp,
mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
84 lines
2.5 KiB
Go
84 lines
2.5 KiB
Go
package mixnet
|
|
|
|
import (
|
|
"math/big"
|
|
"testing"
|
|
|
|
"github.com/user/evote/pkg/elgamal"
|
|
emath "github.com/user/evote/pkg/math"
|
|
)
|
|
|
|
const (
|
|
testP = "179688417486862032111147025351064878713905624387098436271724698527496946737299"
|
|
testQ = "89844208743431016055573512675532439356952812193549218135862349263748473368649"
|
|
testG = "4"
|
|
)
|
|
|
|
func testGroup(t *testing.T) *emath.GqGroup {
|
|
t.Helper()
|
|
p, _ := new(big.Int).SetString(testP, 10)
|
|
q, _ := new(big.Int).SetString(testQ, 10)
|
|
g, _ := new(big.Int).SetString(testG, 10)
|
|
group, err := emath.NewGqGroup(p, q, g)
|
|
if err != nil {
|
|
t.Fatalf("test group: %v", err)
|
|
}
|
|
return group
|
|
}
|
|
|
|
func randomCiphertexts(t *testing.T, group *emath.GqGroup, pk elgamal.PublicKey, n, width int) *elgamal.CiphertextVector {
|
|
t.Helper()
|
|
zq := emath.ZqGroupFromGqGroup(group)
|
|
cts := make([]elgamal.Ciphertext, n)
|
|
for i := 0; i < n; i++ {
|
|
elems := make([]emath.GqElement, width)
|
|
for w := 0; w < width; w++ {
|
|
elems[w] = emath.RandomGqElement(group)
|
|
}
|
|
msg := elgamal.NewMessage(emath.GqVectorOf(elems...))
|
|
cts[i] = elgamal.Encrypt(msg, emath.RandomZqElement(zq), pk)
|
|
}
|
|
return elgamal.NewCiphertextVector(cts)
|
|
}
|
|
|
|
// TestShuffleRoundTrip verifies an honest Bayer-Groth shuffle at several sizes,
|
|
// including the dimensions that exercise the m=1 SVP path and rectangular N.
|
|
func TestShuffleRoundTrip(t *testing.T) {
|
|
group := testGroup(t)
|
|
pk := elgamal.GenKeyPair(group, 1).PK
|
|
|
|
for _, N := range []int{2, 3, 4, 6, 9} {
|
|
C := randomCiphertexts(t, group, pk, N, 1)
|
|
vs := GenVerifiableShuffle(C, pk, group)
|
|
if !VerifyShuffle(C, vs, pk, group) {
|
|
t.Fatalf("honest shuffle of N=%d rejected", N)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestShuffleTamperedOutputRejected confirms the verifier rejects a shuffle
|
|
// whose claimed output was altered (soundness smoke test).
|
|
func TestShuffleTamperedOutputRejected(t *testing.T) {
|
|
group := testGroup(t)
|
|
zq := emath.ZqGroupFromGqGroup(group)
|
|
pk := elgamal.GenKeyPair(group, 1).PK
|
|
|
|
C := randomCiphertexts(t, group, pk, 4, 1)
|
|
vs := GenVerifiableShuffle(C, pk, group)
|
|
|
|
// Replace one output ciphertext with a fresh encryption not in the input.
|
|
extra := elgamal.Encrypt(
|
|
elgamal.NewMessage(emath.GqVectorOf(emath.RandomGqElement(group))),
|
|
emath.RandomZqElement(zq), pk)
|
|
orig := vs.ShuffledCiphertexts
|
|
tampered := make([]elgamal.Ciphertext, orig.Size())
|
|
for i := 0; i < orig.Size(); i++ {
|
|
tampered[i] = orig.Get(i)
|
|
}
|
|
tampered[0] = extra
|
|
vs.ShuffledCiphertexts = elgamal.NewCiphertextVector(tampered)
|
|
|
|
if VerifyShuffle(C, vs, pk, group) {
|
|
t.Fatal("verifier accepted a tampered shuffle output")
|
|
}
|
|
}
|