mirror of
https://github.com/saymrwulf/swisspost-evoting-go-poc.git
synced 2026-09-05 20:30:43 +00:00
saymrwulf
ec4be74e17
Correctness/security review of the whole PoC, with fixes and regression tests.
Cryptographic soundness:
- mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was
stubbed out with an empty if — without it a malicious mixer can prove a
non-permutation shuffle.
- zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of
a biased `hash mod q` (which also capped the challenge space at 256 bits for
production-sized groups).
Verification honesty:
- protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns
the true aggregate result instead of an unconditional true.
- protocol: persist the padded mix input (event.MixInput) so the verifier checks
shuffle 0 against the same padding the tally used (fixes false INVALID for N<2).
Other correctness:
- kdf: length-prefix BuildKDFInfo parts so the info encoding is injective.
- math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could
panic in HashAndSquare); RandomGqElement samples the full canonical range.
- cmd: validate demo --voters/--options instead of panicking on degenerate values.
- protocol: use crypto/rand in the demo driver (drop the last math/rand import).
Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519
ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek),
linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust
Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the
Rust static lib before the Go binary.
Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp,
mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
83 lines
2.3 KiB
Go
83 lines
2.3 KiB
Go
package transportsec
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/ed25519"
|
|
"testing"
|
|
)
|
|
|
|
func TestEd25519RoundTrip(t *testing.T) {
|
|
seed, pub, err := Ed25519GenerateKey()
|
|
if err != nil {
|
|
t.Fatalf("keygen: %v", err)
|
|
}
|
|
msg := []byte("mixnet output, CC2 -> CC3")
|
|
sig, err := Ed25519Sign(seed, msg)
|
|
if err != nil {
|
|
t.Fatalf("sign: %v", err)
|
|
}
|
|
if err := Ed25519Verify(pub, msg, sig); err != nil {
|
|
t.Fatalf("verify: %v", err)
|
|
}
|
|
if err := Ed25519Verify(pub, []byte("tampered"), sig); err != ErrVerify {
|
|
t.Fatalf("tampered message: got %v, want ErrVerify", err)
|
|
}
|
|
sig[0] ^= 0xff
|
|
if err := Ed25519Verify(pub, msg, sig); err != ErrVerify {
|
|
t.Fatalf("corrupted signature: got %v, want ErrVerify", err)
|
|
}
|
|
}
|
|
|
|
// TestEd25519CrossVerifyWithGoStdlib proves the Rust signatures are standard
|
|
// RFC 8032 Ed25519: Go's crypto/ed25519 must accept them, and Rust must
|
|
// accept Go-produced signatures. This guards against ABI/format drift.
|
|
func TestEd25519CrossVerifyWithGoStdlib(t *testing.T) {
|
|
seed, pub, err := Ed25519GenerateKey()
|
|
if err != nil {
|
|
t.Fatalf("keygen: %v", err)
|
|
}
|
|
msg := []byte("cross-language conformance")
|
|
|
|
rustSig, err := Ed25519Sign(seed, msg)
|
|
if err != nil {
|
|
t.Fatalf("rust sign: %v", err)
|
|
}
|
|
if !ed25519.Verify(ed25519.PublicKey(pub), msg, rustSig) {
|
|
t.Fatal("Go stdlib rejected Rust-produced signature")
|
|
}
|
|
|
|
goPriv := ed25519.NewKeyFromSeed(seed)
|
|
if !bytes.Equal(goPriv.Public().(ed25519.PublicKey), pub) {
|
|
t.Fatal("Rust and Go derive different public keys from the same seed")
|
|
}
|
|
goSig := ed25519.Sign(goPriv, msg)
|
|
if err := Ed25519Verify(pub, msg, goSig); err != nil {
|
|
t.Fatalf("Rust rejected Go-produced signature: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestX25519Agreement(t *testing.T) {
|
|
aPriv, aPub, err := X25519GenerateKey()
|
|
if err != nil {
|
|
t.Fatalf("keygen A: %v", err)
|
|
}
|
|
bPriv, bPub, err := X25519GenerateKey()
|
|
if err != nil {
|
|
t.Fatalf("keygen B: %v", err)
|
|
}
|
|
s1, err := X25519SharedSecret(aPriv, bPub)
|
|
if err != nil {
|
|
t.Fatalf("dh A: %v", err)
|
|
}
|
|
s2, err := X25519SharedSecret(bPriv, aPub)
|
|
if err != nil {
|
|
t.Fatalf("dh B: %v", err)
|
|
}
|
|
if !bytes.Equal(s1, s2) {
|
|
t.Fatal("shared secrets differ")
|
|
}
|
|
// Degenerate peer key (all zeros) must be rejected.
|
|
if _, err := X25519SharedSecret(aPriv, make([]byte, 32)); err != ErrBadKey {
|
|
t.Fatalf("zero peer key: got %v, want ErrBadKey", err)
|
|
}
|
|
}
|