Protocol.Election

Type Encryption

data Encryption q

ElGamal-like encryption. Its security relies on the Discrete Logarithm problem.

Because (groupGen ^encNonce ^secKey == groupGen ^secKey ^encNonce), knowing secKey, one can divide encryption_vault by (encryption_nonce ^secKey) to decipher (groupGen ^clear), then the clear text must be small to be decryptable, because it is encrypted as a power of groupGen (hence the "-like" in "ElGamal-like") to enable the additive homomorphism.

NOTE: Since (encryption_vault * encryption_nonce == encryption_nonce ^ (secKey + clear)), then: (logBase encryption_nonce (encryption_vault * encryption_nonce) == secKey + clear).

Constructors

Encryption

Fields

• encryption_nonce :: G q

  Public part of the randomness encNonce used to encrypt the clear text, equal to (groupGen ^encNonce)

• encryption_vault :: G q

  Encrypted clear text, equal to (pubKey ^r * groupGen ^clear)

Instances

Eq (Encryption q)

Defined in Protocol.Election

Methods

(==) :: Encryption q -> Encryption q -> Bool

(/=) :: Encryption q -> Encryption q -> Bool

Show (Encryption q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> Encryption q -> ShowS

show :: Encryption q -> String

showList :: [Encryption q] -> ShowS

SubGroup q => Additive (Encryption q)

Additive homomorphism. Using the fact that: groupGen ^x * groupGen ^y == groupGen ^(x+y).

Defined in Protocol.Election

Methods

zero :: Encryption q

(+) :: Encryption q -> Encryption q -> Encryption q

sum :: Foldable f => f (Encryption q) -> Encryption q

Type EncryptionNonce

type EncryptionNonce = E

encrypt :: Monad m => RandomGen r => SubGroup q => PublicKey q -> E q -> StateT r m (EncryptionNonce q, Encryption q)

(encrypt pubKey clear) returns an ElGamal-like Encryption.

WARNING: the secret encryption nonce (encNonce) is returned alongside the Encryption in order to prove the validity of the encrypted clear text in proveEncryption, but this secret encNonce MUST be forgotten after that, as it may be used to decipher the Encryption without the secret key associated with pubKey.

Type Proof

data Proof q

Proof of knowledge of a discrete logarithm: (secret == logBase base (base^secret)).

Constructors

Proof

Fields

• proof_challenge :: Challenge q

  Challenge sent by the verifier to the prover to ensure that the prover really has knowledge of the secret and is not replaying. Actually, proof_challenge is not sent to the prover, but derived from the prover's Commitments and statements with a collision resistant hash. Hence the prover cannot chose the proof_challenge to his/her liking.

• proof_response :: E q

  A discrete logarithm sent by the prover to the verifier, as a response to proof_challenge.

  If the verifier observes that (proof_challenge == hash statement [commitment]) where:

  • statement is a serialization of a tag, base and basePowSec,
  • (commitment == commit proof base basePowSec == base ^ proof_response * basePowSec ^ proof_challenge),
  • and (basePowSec == base^sec),

  then, with overwhelming probability due to the hash function: (commitment == base^nonce). Therefore by expanding commitment: (proof_response == logBase base (base^nonce) - logBase basePowSec (basePowSec ^ proof_challenge)), which means that the prover must have known nonce and sec to compute proof_response efficiently with: (proof_response == nonce - sec * proof_challenge),

  The nonce is introduced to ensure each prove does not reveal any information regarding the prover's secret sec, by being randomly chosen by the prover.

Instances

Eq (Proof q)

Defined in Protocol.Election

Methods

(==) :: Proof q -> Proof q -> Bool

(/=) :: Proof q -> Proof q -> Bool

Show (Proof q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> Proof q -> ShowS

show :: Proof q -> String

showList :: [Proof q] -> ShowS

Type ZKP

newtype ZKP

Zero-knowledge proof

DOC: Mihir Bellare and Phillip Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In ACM-CCS’93, 1993.

DOC: Pierrick Gaudry. Some ZK security proofs for Belenios, 2017.

Constructors

ZKP ByteString

Type Challenge

type Challenge = E

Type Oracle

type Oracle list q = list (Commitment q) -> Challenge q

prove :: Monad m => RandomGen r => SubGroup q => Functor list => E q -> list (Commitment q) -> Oracle list q -> StateT r m (Proof q)

(prove sec commitBases oracle) returns a Proof that sec is known.

The Oracle is given the commitBases raised to the power of the secret nonce of the Proof, as those are the commitBases that the verifier will obtain when composing the proof_challenge and proof_response together (in commit).

NOTE: sec is secKey in signature_proof or encNonce in proveEncryption.

WARNING: for prove to be a so-called strong Fiat-Shamir transformation (not a weak): the statement must be included in the hash (not only the commitments).

NOTE: a random nonce is used to ensure each prove does not reveal any information regarding the secret sec.

Type Commitment

type Commitment = G

commit :: SubGroup q => Proof q -> G q -> G q -> Commitment q

(commit proof base basePowSec) returns a Commitment from the given Proof with the knowledge of the verifier.

Type Disjunction

type Disjunction = G

A Disjunction is an inversed (groupGen ^opinion) it's used in proveEncryption to generate a Proof that an encryption_vault contains a given (groupGen ^opinion),

booleanDisjunctions :: SubGroup q => [Disjunction q]

intervalDisjunctions :: SubGroup q => Opinion q -> Opinion q -> [Disjunction q]

Type Opinion

type Opinion = E

Index of a Disjunction within a list of them. It is encrypted as an Exponent by encrypt.

Type DisjProof

newtype DisjProof q

A list of Proofs to prove that the Opinion within an Encryption is indexing a Disjunction within a list of them, without revealing which Opinion it is.

Constructors

DisjProof [Proof q]

Instances

Eq (DisjProof q)

Defined in Protocol.Election

Methods

(==) :: DisjProof q -> DisjProof q -> Bool

(/=) :: DisjProof q -> DisjProof q -> Bool

Show (DisjProof q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> DisjProof q -> ShowS

show :: DisjProof q -> String

showList :: [DisjProof q] -> ShowS

proveEncryption :: forall m r q. Monad m => RandomGen r => SubGroup q => PublicKey q -> ZKP -> ([Disjunction q], [Disjunction q]) -> (EncryptionNonce q, Encryption q) -> StateT r m (DisjProof q)

(proveEncryption elecPubKey voterZKP (prevDisjs,nextDisjs) (encNonce,enc)) returns a DisjProof that enc encrypts the Disjunctions between prevDisjs and nextDisjs.

A NIZK Disjunctive Chaum Pedersen Logarithm Equality is used.

verifyEncryption :: Monad m => SubGroup q => PublicKey q -> ZKP -> [Disjunction q] -> (Encryption q, DisjProof q) -> ExceptT ErrorValidateEncryption m Bool

Hashing

encryptionStatement :: SubGroup q => ZKP -> Encryption q -> ByteString

encryptionCommitments :: SubGroup q => PublicKey q -> Encryption q -> (Disjunction q, Proof q) -> [G q]

(encryptionCommitments elecPubKey enc (disj,proof)) returns the Commitments with only the knowledge of the verifier.

The Proof comes from prove of fakeProof in proveEncryption.

Type ErrorValidateEncryption

data ErrorValidateEncryption

Error raised by verifyEncryption.

Constructors

ErrorValidateEncryption_InvalidProofLength Natural Natural

When the number of proofs is different than the number of Disjunctions.

Instances

Eq ErrorValidateEncryption

Defined in Protocol.Election

Methods

(==) :: ErrorValidateEncryption -> ErrorValidateEncryption -> Bool

(/=) :: ErrorValidateEncryption -> ErrorValidateEncryption -> Bool

Show ErrorValidateEncryption

Defined in Protocol.Election

Methods

showsPrec :: Int -> ErrorValidateEncryption -> ShowS

show :: ErrorValidateEncryption -> String

showList :: [ErrorValidateEncryption] -> ShowS

Type Question

data Question q

Constructors

Question

Fields

• question_text :: Text
• question_choices :: [Text]
• question_mini :: Opinion q
• question_maxi :: Opinion q

Instances

Eq (Question q)

Defined in Protocol.Election

Methods

(==) :: Question q -> Question q -> Bool

(/=) :: Question q -> Question q -> Bool

Show (Question q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> Question q -> ShowS

show :: Question q -> String

showList :: [Question q] -> ShowS

Type Answer

data Answer q

Constructors

Answer

Fields

• answer_opinions :: [(Encryption q, DisjProof q)]

  Encrypted Opinion for each question_choices with a DisjProof that they belong to [0,1].

• answer_sumProof :: DisjProof q

  Proofs that the sum of the Opinons encrypted in answer_opinions is an element of [mini..maxi]. , answer_blankProof ::

Instances

Eq (Answer q)

Defined in Protocol.Election

Methods

(==) :: Answer q -> Answer q -> Bool

(/=) :: Answer q -> Answer q -> Bool

Show (Answer q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> Answer q -> ShowS

show :: Answer q -> String

showList :: [Answer q] -> ShowS

encryptAnswer :: Monad m => RandomGen r => SubGroup q => PublicKey q -> ZKP -> Question q -> [Bool] -> StateT r (ExceptT ErrorAnswer m) (Answer q)

(encryptAnswer elecPubKey zkp quest opinions) returns an Answer validable by verifyAnswer, unless an ErrorAnswer is returned.

verifyAnswer :: SubGroup q => PublicKey q -> ZKP -> Question q -> Answer q -> Bool

Type ErrorAnswer

data ErrorAnswer

Error raised by encryptAnswer.

Constructors

ErrorAnswer_WrongNumberOfOpinions Natural Natural

When the number of opinions is different than the number of choices (question_choices).

ErrorAnswer_WrongSumOfOpinions Natural Natural Natural

When the sum of opinions is not within the bounds of question_mini and question_maxi.

Instances

Eq ErrorAnswer

Defined in Protocol.Election

Methods

(==) :: ErrorAnswer -> ErrorAnswer -> Bool

(/=) :: ErrorAnswer -> ErrorAnswer -> Bool

Show ErrorAnswer

Defined in Protocol.Election

Methods

showsPrec :: Int -> ErrorAnswer -> ShowS

show :: ErrorAnswer -> String

showList :: [ErrorAnswer] -> ShowS

Type Election

data Election q

Constructors

Election

Fields

• election_name :: Text
• election_description :: Text
• election_publicKey :: PublicKey q
• election_questions :: [Question q]
• election_uuid :: UUID
• election_hash :: Hash

Instances

Eq (Election q)

Defined in Protocol.Election

Methods

(==) :: Election q -> Election q -> Bool

(/=) :: Election q -> Election q -> Bool

Show (Election q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> Election q -> ShowS

show :: Election q -> String

showList :: [Election q] -> ShowS

Type Hash

newtype Hash

Constructors

Hash Text

Instances

Eq Hash

Defined in Protocol.Election

Methods

(==) :: Hash -> Hash -> Bool

(/=) :: Hash -> Hash -> Bool

Ord Hash

Defined in Protocol.Election

Methods

compare :: Hash -> Hash -> Ordering

(<) :: Hash -> Hash -> Bool

(<=) :: Hash -> Hash -> Bool

(>) :: Hash -> Hash -> Bool

(>=) :: Hash -> Hash -> Bool

max :: Hash -> Hash -> Hash

min :: Hash -> Hash -> Hash

Show Hash

Defined in Protocol.Election

Methods

showsPrec :: Int -> Hash -> ShowS

show :: Hash -> String

showList :: [Hash] -> ShowS

Type Ballot

data Ballot q

Constructors

Ballot

Fields

• ballot_answers :: [Answer q]
• ballot_signature :: Maybe (Signature q)
• ballot_election_uuid :: UUID
• ballot_election_hash :: Hash

encryptBallot :: Monad m => RandomGen r => SubGroup q => Election q -> Maybe (SecretKey q) -> [[Bool]] -> StateT r (ExceptT ErrorBallot m) (Ballot q)

(encryptBallot elec (Just secKey) opinionsByQuest) returns a Ballot signed by secKey (the voter's secret key) where opinionsByQuest is a list of Opinions on each question_choices of each election_questions.

verifyBallot :: SubGroup q => Election q -> Ballot q -> Bool

Type Signature

data Signature q

Schnorr-like signature.

Used by each voter to sign his/her encrypted Ballot using his/her Credential, in order to avoid ballot stuffing.

Constructors

Signature

Fields

• signature_publicKey :: PublicKey q

  Verification key.

• signature_proof :: Proof q

Hashing

signatureStatement :: Foldable f => SubGroup q => f (Answer q) -> [G q]

(signatureStatement answers) returns the encrypted material to be signed: all the encryption_nonces and encryption_vaults of the given answers.

signatureCommitments :: SubGroup q => ZKP -> Commitment q -> ByteString

(signatureCommitments voterZKP commitment)

Type ErrorBallot

data ErrorBallot

Error raised by encryptBallot.

Constructors

ErrorBallot_WrongNumberOfAnswers Natural Natural

When the number of answers is different than the number of questions.

ErrorBallot_Answer ErrorAnswer

When encryptAnswer raised an ErrorAnswer.

Instances

Eq ErrorBallot

Defined in Protocol.Election

Methods

(==) :: ErrorBallot -> ErrorBallot -> Bool

(/=) :: ErrorBallot -> ErrorBallot -> Bool

Show ErrorBallot

Defined in Protocol.Election

Methods

showsPrec :: Int -> ErrorBallot -> ShowS

show :: ErrorBallot -> String

showList :: [ErrorBallot] -> ShowS

Type DecryptionShare

data DecryptionShare q

A decryption share. It is computed by a trustee from his/her private key share and the encrypted tally, and contains a cryptographic Proof that he/she didn't cheat.

Constructors

DecryptionShare

Fields

• decryptionShare_factors :: [[DecryptionFactor q]]
• decryptionShare_proofs :: [[Proof q]]

  Proofs that decryptionShare_factors were correctly computed.

Instances

Eq (DecryptionShare q)

Defined in Protocol.Election

Methods

(==) :: DecryptionShare q -> DecryptionShare q -> Bool

(/=) :: DecryptionShare q -> DecryptionShare q -> Bool

Show (DecryptionShare q)

Defined in Protocol.Election

Methods

showsPrec :: Int -> DecryptionShare q -> ShowS

show :: DecryptionShare q -> String

showList :: [DecryptionShare q] -> ShowS

computeDecryptionShare :: Monad m => SubGroup q => RandomGen r => SecretKey q -> [[Encryption q]] -> StateT r m (DecryptionShare q)

decryptionFactor :: Monad m => SubGroup q => RandomGen r => SecretKey q -> Encryption q -> StateT r m (DecryptionFactor q, Proof q)

decryptionStatement :: SubGroup q => PublicKey q -> ByteString

Type DecryptionFactor

type DecryptionFactor = G

Type ErrorDecryptionShare

data ErrorDecryptionShare

Constructors

ErrorDecryptionShare_Invalid

Instances

Eq ErrorDecryptionShare

Defined in Protocol.Election

Methods

(==) :: ErrorDecryptionShare -> ErrorDecryptionShare -> Bool

(/=) :: ErrorDecryptionShare -> ErrorDecryptionShare -> Bool

Show ErrorDecryptionShare

Defined in Protocol.Election

Methods

showsPrec :: Int -> ErrorDecryptionShare -> ShowS

show :: ErrorDecryptionShare -> String

showList :: [ErrorDecryptionShare] -> ShowS

checkDecryptionShare :: Monad m => SubGroup q => RandomGen r => [[Encryption q]] -> PublicKey q -> DecryptionShare q -> ExceptT ErrorDecryptionShare m Bool

(checkDecryptionShare encTally pubKey decShare) checks that decShare (supposedly submitted by a trustee whose public key is pubKey) is valid with respect to the encrypted tally encTally.