mirror of
https://github.com/saymrwulf/swisspost-evoting-go-poc.git
synced 2026-09-04 20:23:55 +00:00
saymrwulf
ec4be74e17
Correctness/security review of the whole PoC, with fixes and regression tests.
Cryptographic soundness:
- mixnet: enforce the multi-exponentiation c_{B_m}=commit(0;0) check that was
stubbed out with an empty if — without it a malicious mixer can prove a
non-permutation shuffle.
- zkp: derive all four Fiat-Shamir challenges via RecursiveHashToZq instead of
a biased `hash mod q` (which also capped the challenge space at 256 bits for
production-sized groups).
Verification honesty:
- protocol: VerifyTally now actually calls zkp.VerifySchnorrProof and returns
the true aggregate result instead of an unconditional true.
- protocol: persist the padded mix input (event.MixInput) so the verifier checks
shuffle 0 against the same padding the tally used (fixes false INVALID for N<2).
Other correctness:
- kdf: length-prefix BuildKDFInfo parts so the info encoding is injective.
- math: GqElementFromSquareRoot accepts the valid root q (off-by-one that could
panic in HashAndSquare); RandomGqElement samples the full canonical range.
- cmd: validate demo --voters/--options instead of panicking on degenerate values.
- protocol: use crypto/rand in the demo driver (drop the last math/rand import).
Transport security (new): pkg/transportsec exposes Ed25519 signatures and X25519
ECDH — implemented in Rust (rust/transportsec: ed25519-dalek, x25519-dalek),
linked into Go via cgo. No RSA. Cross-language conformance test proves the Rust
Ed25519 signatures interoperate with Go's crypto/ed25519. Makefile builds the
Rust static lib before the Go binary.
Tests: added unit/round-trip/tamper coverage for math, hash, elgamal, zkp,
mixnet, kdf, returncodes, protocol (end-to-end), and the Rust FFI bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
77 lines
2.6 KiB
Go
77 lines
2.6 KiB
Go
package zkp
|
|
|
|
import (
|
|
"github.com/user/evote/pkg/hash"
|
|
emath "github.com/user/evote/pkg/math"
|
|
)
|
|
|
|
// GenExponentiationProof generates a proof that all exponentiations
|
|
// share the same exponent: y_i = bases_i^x for all i.
|
|
func GenExponentiationProof(bases *emath.GqVector, x emath.ZqElement, exponentiations *emath.GqVector, group *emath.GqGroup, auxInfo ...hash.Hashable) ExponentiationProof {
|
|
zqGroup := emath.ZqGroupFromGqGroup(group)
|
|
|
|
// 1. Sample random b
|
|
b := emath.RandomZqElement(zqGroup)
|
|
|
|
// 2. Commitment: c_i = bases_i^b
|
|
c := bases.ExpScalar(b)
|
|
|
|
// 3. Compute challenge
|
|
e := exponentiationChallenge(group, bases, exponentiations, c, zqGroup, auxInfo)
|
|
|
|
// 4. Response: z = b + e*x
|
|
z := b.Add(e.Multiply(x))
|
|
|
|
return ExponentiationProof{E: e, Z: z}
|
|
}
|
|
|
|
// VerifyExponentiationProof verifies an exponentiation proof.
|
|
func VerifyExponentiationProof(bases *emath.GqVector, exponentiations *emath.GqVector, proof ExponentiationProof, group *emath.GqGroup, auxInfo ...hash.Hashable) bool {
|
|
zqGroup := emath.ZqGroupFromGqGroup(group)
|
|
|
|
// Reconstruct commitments: c'_i = bases_i^z * y_i^(-e)
|
|
basesZ := bases.ExpScalar(proof.Z)
|
|
yNegE := exponentiations.ExpScalar(proof.E.Negate())
|
|
cPrime := basesZ.Multiply(yNegE)
|
|
|
|
// Recompute challenge
|
|
ePrime := exponentiationChallenge(group, bases, exponentiations, cPrime, zqGroup, auxInfo)
|
|
|
|
return proof.E.Equals(ePrime)
|
|
}
|
|
|
|
// exponentiationChallenge computes the Fiat-Shamir challenge for exponentiation proofs.
|
|
// Hash order: (p, q, [bases]), [exponentiations], [commitments], h_aux
|
|
func exponentiationChallenge(group *emath.GqGroup, bases, exponentiations, commitments *emath.GqVector, zqGroup *emath.ZqGroup, auxInfo []hash.Hashable) emath.ZqElement {
|
|
// f = (p, q, [bases])
|
|
fElems := []hash.Hashable{
|
|
hash.HashableBigInt{Value: group.P()},
|
|
hash.HashableBigInt{Value: group.Q()},
|
|
}
|
|
basesHashable := gqVectorToHashableList(bases)
|
|
fElems = append(fElems, basesHashable)
|
|
f := hash.HashableList{Elements: fElems}
|
|
|
|
// y = [exponentiations]
|
|
y := gqVectorToHashableList(exponentiations)
|
|
|
|
// c = [commitments]
|
|
c := gqVectorToHashableList(commitments)
|
|
|
|
// h_aux
|
|
hAux := buildAuxHash("ExponentiationProof", auxInfo)
|
|
|
|
// Uniform Z_q challenge via oversample-then-reduce (Swiss Post spec).
|
|
eVal := hash.RecursiveHashToZq(zqGroup.Q(), f, y, c, hAux)
|
|
e, _ := emath.NewZqElement(eVal, zqGroup)
|
|
return e
|
|
}
|
|
|
|
// gqVectorToHashableList converts a GqVector to a HashableList of BigInts.
|
|
func gqVectorToHashableList(v *emath.GqVector) hash.HashableList {
|
|
elements := make([]hash.Hashable, v.Size())
|
|
for i := 0; i < v.Size(); i++ {
|
|
elements[i] = hash.HashableBigInt{Value: v.Get(i).Value()}
|
|
}
|
|
return hash.HashableList{Elements: elements}
|
|
}
|