Election-Tech-Initiative / Election-Tech-Initiative/electionguard

✨Verifiers should validate the Manifest, ContestDescription, and SelectionDescription crypto_hash

Open
#249 0 comments 0 reactions 1 assignee Claimed by @benaloh View on GitHub
documentation enhancement
Dominant language
Python
Stars
872
Forks
131
PR merge metrics
No merged PRs in 30d

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Suggestion

Currently, a verifier does not need to recompute the crypto_hash of Manifest, ContestDescription, or SelectionDescription. Those are not currently included in the election record, except indirectly in the SubmittedBallot objects.

It may be useful for a verifier to have the ability to recompute the crypto_hash, as a check against possible manipulation, and check those against what is explicitly included in the election record Manifest.

See Issue #243 for motivation.

### Possible Implementation

Currently a verifier not using the reference library has to reverse engineer the hash function in the reference library.

Im not sure if something better can be done about that, or if hash.py is a good enough "spec".

Similarly, there is some wiggle room about which fields are included in the hash, and their order. Again, we could just let the reference library be the spec or we could document it more formally. In either case, the reference library could only make changes to the crypto_hash on a major (breaking) version change.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.