{"_id":"@condorcet.vote/crypto-vote","_rev":"10-0f75efbc314385cd721b1092c48ebb87","name":"@condorcet.vote/crypto-vote","dist-tags":{"latest":"1.0.0"},"versions":{"0.0.7":{"name":"@condorcet.vote/crypto-vote","version":"0.0.7","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.0.7","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"dist":{"shasum":"fbe247da1289b13c5f5516e0e75cb073ebabff2e","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.0.7.tgz","fileCount":7,"integrity":"sha512-wszE66Xk0s2QuFGgQ1NYs9YhpGxsJlL5z+v0Sq3fv4K+wdTsssd3z/PzxN+QYTj1grSmbuQqNs0PCBtTQtaolQ==","signatures":[{"sig":"MEUCIGglOVLMJwYLgtSsLez8w8fCJB7o973EqWRoSpnmUzqBAiEAnbbpsgvjOprfEjeXX+hyUMGkIQ51BQINNURMdtPCoTg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":293024},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","gitHead":"be3ec1e89bf36277cbab029ecda9790d6af32512","_npmUser":{"name":"julien-boudry","email":"julien.boudry@proton.me"},"_npmVersion":"11.12.1","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./crypto_vote.js","./snippets/*"],"_nodeVersion":"25.9.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.0.7_1782203886648_0.6575601771245989","host":"s3://npm-registry-packages-npm-production"}},"0.0.9":{"name":"@condorcet.vote/crypto-vote","version":"0.0.9","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.0.9","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"e6056eba2fa774f38a931425614ac1f4ee1230dc","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.0.9.tgz","fileCount":7,"integrity":"sha512-vTwIbq1A5xzWt/lgexpLTNRd9UvL17EZr/wPhMcOrLNUDOhz/+zEl3vjmx7tI1xn3vgZ6CK6Ksxg8/2B1QoxkA==","signatures":[{"sig":"MEUCIQCanOQI9pH57ijT/r5MJpG2GRK1jLYRJxdNIlKda3z7FQIge/nkK2pVg8cvbC3YiOHI/gu2hPaN1ks0Vy3luARmArw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.0.9","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":294311},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.13.0","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./crypto_vote.js","./snippets/*"],"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.0.9_1782207908623_0.451505732628412","host":"s3://npm-registry-packages-npm-production"}},"0.0.10":{"name":"@condorcet.vote/crypto-vote","version":"0.0.10","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.0.10","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"ef0e6f57ef02eee3d49f63943cf186b66091fca1","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.0.10.tgz","fileCount":6,"integrity":"sha512-AYVNPiq/w+xwcWfaQYAc06rLwUqzv3G6TytKzSyK/C5zFgATP1PoH4P2qv6pM8s1lPTfH0aMAU8wy476Z7Ik3g==","signatures":[{"sig":"MEUCIFxqgNRAd0TKVqLLa2aBXnMiC38vkKx6AmwGJ0GQTuSRAiEA4juVGCo0/GBncNRZW9/QFNahK2SBzlQALTjZjB2L2Pw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.0.10","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":299995},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.13.0","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.0.10_1782210530074_0.5582759915812612","host":"s3://npm-registry-packages-npm-production"}},"0.1.0":{"name":"@condorcet.vote/crypto-vote","version":"0.1.0","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.1.0","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"93a2f4bb04d397ebeb2154bf1ba89ec332e3b563","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.1.0.tgz","fileCount":6,"integrity":"sha512-lCl1PY4wtVmG1k9AROEP+6eI48jIdrxcQEC2Mkz7tAzRb+vUvoOPHjlQqUUJDDF4p016LZUPCJn/DtcKtgF42Q==","signatures":[{"sig":"MEUCIAneLvwmwOH1cnPrX+IerjqVgyjLvPazKeDhhSliloygAiEAivqzVDqayrxpsFomFM2zX9O3sSYkLISVrz47WJ+quow=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":319447},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.13.0","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.1.0_1782222675910_0.397594562419614","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@condorcet.vote/crypto-vote","version":"0.1.1","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.1.1","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"cac4af6acb501ca7942b1ca602c5724284e0a4e0","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.1.1.tgz","fileCount":6,"integrity":"sha512-nzr2A8qnzobGA5v5tdeyjApKOMrLjYx9Gbc1nmEXQIamwTIhG3ZWNX7zs0RAfPelodkYQdPRnLlfTaUuElrGPQ==","signatures":[{"sig":"MEYCIQDwnixTqXrCzjtKD8wN15WdF8eXFI2nx5zCO+IZYgg6AAIhANIZydfqbXnKH8o/A3nifMAEqvwEiLOJVHOqrq6OlvQ4","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.1.1","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":319447},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.13.0","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.1.1_1782223129093_0.21035748569154555","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@condorcet.vote/crypto-vote","version":"0.2.0","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.2.0","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"d2f7bee3394705e89ef1880d824ae2ac19aa9ec4","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.2.0.tgz","fileCount":6,"integrity":"sha512-eXCDo1QYaDnjEmfqrjanB1cx0qcJZFeLzjsGYAafan7HRZIl8wfZ1E/CgCDf1Bua9tyk2eX/OQOFrvyhnbI4Ow==","signatures":[{"sig":"MEUCIGeSruNH1GEgdk9+m6+Dx2J2EgwHcrQzSxVCPH4GcwfwAiEAnJeXt2Gh3+M4BkF6wWyKNoTgXv+kZA9oDv1HfRR1jU8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.2.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":330628},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.13.0","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.2.0_1782224048732_0.7848765661284223","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"@condorcet.vote/crypto-vote","version":"0.3.0","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.3.0","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"1b89d66b20a329679652083595cbf4492dfdfe3c","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.3.0.tgz","fileCount":6,"integrity":"sha512-x7A6HWkTGULQcVUGSNc2hJrlRDyTb7y0LZG0A3ooYDvnZsHk3XH+4vbB25OwOVQQF0p2CrMhOCi+p2SAp8oLqQ==","signatures":[{"sig":"MEUCIBcUrmp135ELwDrfNVbHfYj/FvXuUVz9pXLZxUQ3gkKvAiEA5MATJTYHWhXJpPDo63mVWMhKAigAZ1Jf3TBY8ms6hnI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.3.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":350714},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.13.0","description":"An agnostic cryptographic oracle for verifiable voting using linkable ring signatures (BLSAG) over Ristretto255, with Blake2b-512 as the hash function.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.3.0_1782228909124_0.16872315795186488","host":"s3://npm-registry-packages-npm-production"}},"0.4.0":{"name":"@condorcet.vote/crypto-vote","version":"0.4.0","keywords":["voting","vote","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.4.0","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"c189b9238ed6ba128658893882811421e911558e","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.4.0.tgz","fileCount":6,"integrity":"sha512-PhSDLui/ID9OsAXIrn0kXjIlOlmXH4BK3Kcyu/8mSQbB3F7N2a907CWr/luw2Wde/6ORxDDyaezI1XB6Ycbxkg==","signatures":[{"sig":"MEUCIQCN0VkANL/TTvQuxNQdWFiCVLKfAcX6GCJBjL89+28zKAIgHVHii6nJGexOJR0lIkPePY+mJO0vEPjkBBmpR30jZyY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.4.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":350263},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.16.0","description":"Sign and verify anonymous, double-vote-resistant ballots with linkable BLSAG ring signatures over Ristretto255 + Blake2b-512. Native CLI and WebAssembly (browser + WASI) builds.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.18.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.4.0_1786256157801_0.25091762343059276","host":"s3://npm-registry-packages-npm-production"}},"0.4.2":{"name":"@condorcet.vote/crypto-vote","version":"0.4.2","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"license":"AGPL-3.0-or-later","_id":"@condorcet.vote/crypto-vote@0.4.2","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"2cf0d7a41d5d73e88b562f45db73bf1486afc30e","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-0.4.2.tgz","fileCount":6,"integrity":"sha512-/wQPe0RiJMCCre+oO1z69brrW3zf+bUHZSy0u5SaZEtv6DV89zkeu8ul+n8EAiD90wZa3/HEZjZ41zzsq+lPEQ==","signatures":[{"sig":"MEQCIH82gGY8JhxypI7EoKVRRrTT620JEkoL1NVbX432y9QyAiBQFqs0bWl0Bcs/v/4aOXu0bv6ekVLVdVK08NkrthAp0w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@0.4.2","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":350755},"main":"crypto_vote.js","type":"module","types":"crypto_vote.d.ts","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.16.0","description":"Sign and verify anonymous, double-vote-resistant ballots with linkable BLSAG ring signatures over Ristretto255 + Blake2b-512. Native CLI and WebAssembly (browser + WASI) builds.","directories":{},"sideEffects":["./snippets/*"],"_nodeVersion":"24.18.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/crypto-vote_0.4.2_1786258117795_0.7606415854658732","host":"s3://npm-registry-packages-npm-production"}},"1.0.0":{"_id":"@condorcet.vote/crypto-vote@1.0.0","bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"dist":{"shasum":"20c4cd63dcfbc107d8cc8d3c4d7be00258d0cfe4","tarball":"https://registry.npmjs.org/@condorcet.vote/crypto-vote/-/crypto-vote-1.0.0.tgz","fileCount":6,"integrity":"sha512-QFcePKdwdPoVPY3s58kyIA3thsYMSpl23jQi/zV5+ZA9szwomMUp7lGTfXQ5REjYbiFRfonsp5YKjTwVRxwbPQ==","signatures":[{"sig":"MEUCIQCFk/Cf/aO318Y0oeo0TKQ/sJwcIXhzOPZ20mVre47+pgIgIJ0pWE+3BoTJQMgkau2PV4v0LHH64xw4+RbIDHukWTU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIAsQbzI4R+c3MeiWNUbQIdjdKw67ioyyMn2tyxBu1ef5AiEA10Qv9DdGYV5xnyeFls+VQSyPVazarD1KJvOP1AgZjKM="}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@condorcet.vote%2fcrypto-vote@1.0.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":368601},"main":"crypto_vote.js","name":"@condorcet.vote/crypto-vote","type":"module","types":"crypto_vote.d.ts","license":"AGPL-3.0-or-later","version":"1.0.0","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9792b1f2-584c-417d-886e-302382d3b459"}},"homepage":"https://github.com/CondorcetVote/cryptoVote#readme","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"_npmVersion":"11.19.0","description":"Sign and verify anonymous, double-vote-resistant ballots with linkable BLSAG ring signatures over Ristretto255 + Blake2b-512. Native CLI and WebAssembly (browser + WASI) builds.","directories":{},"maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"sideEffects":["./snippets/*"],"_nodeVersion":"24.21.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/crypto-vote_1.0.0_1790342861976_0.6553816221491717"}}},"time":{"created":"2026-06-23T08:38:06.469Z","modified":"2026-09-25T13:27:42.400Z","0.0.7":"2026-06-23T08:38:06.779Z","0.0.9":"2026-06-23T09:45:08.799Z","0.0.10":"2026-06-23T10:28:50.201Z","0.1.0":"2026-06-23T13:51:16.066Z","0.1.1":"2026-06-23T13:58:49.286Z","0.2.0":"2026-06-23T14:14:08.979Z","0.3.0":"2026-06-23T15:35:09.285Z","0.4.0":"2026-08-09T06:15:58.000Z","0.4.2":"2026-08-09T06:48:37.945Z","1.0.0":"2026-09-25T13:27:42.056Z"},"bugs":{"url":"https://github.com/CondorcetVote/cryptoVote/issues"},"license":"AGPL-3.0-or-later","homepage":"https://github.com/CondorcetVote/cryptoVote#readme","keywords":["voting","cryptography","ring-signature","blsag","blake2"],"repository":{"url":"git+https://github.com/CondorcetVote/cryptoVote.git","type":"git"},"description":"Sign and verify anonymous, double-vote-resistant ballots with linkable BLSAG ring signatures over Ristretto255 + Blake2b-512. Native CLI and WebAssembly (browser + WASI) builds.","maintainers":[{"name":"julien-boudry","email":"julien.boudry@proton.me"}],"readme":"# cryptoVote\n\n[![crates.io](https://img.shields.io/crates/v/crypto-vote?logo=rust&label=crates.io)](https://crates.io/crates/crypto-vote)\n[![docs.rs](https://img.shields.io/docsrs/crypto-vote?logo=docsdotrs&label=docs.rs)](https://docs.rs/crypto-vote)\n[![npm](https://img.shields.io/npm/v/@condorcet.vote/crypto-vote?logo=npm&label=npm)](https://www.npmjs.com/package/@condorcet.vote/crypto-vote)\n[![license](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)](LICENSE)\n\n> [!NOTE]\n> **Not independently audited.** The implementation, its test surface and\n> its threat model have been reviewed by the author with AI assistance,\n> and are backed by unit and integration tests, fuzz targets and frozen\n> protocol vectors that pin the wire format across versions. No outside\n> cryptographer has examined them yet. The linkable ring signature is\n> standard BLSAG; the only deviation is that the linking tag's base is\n> scoped by the election identifier, `I_e = x · H_p(domain ‖ election_id ‖ P)`,\n> which is the *event-oriented linkability* notion from the linkable ring\n> signature literature (Liu–Wei–Wong 2004; Tsang–Wei 2005 for e-voting)\n> applied to the per-key base. For an election with a motivated adversary\n> or legal weight, read the [threat model](#threat-model) and commission a\n> review first.\n\nA pure-Rust cryptographic oracle for **verifiable, anonymous, double-vote-resistant** ballots.\n\nThe crate is a minimal building block that offers a small set of\noperations and refuses to take part in anything else.\n\n| # | Operation | Where it runs | Function |\n|---|-----------|---------------|----------|\n| A | Generate identity | Either side | `generate_identity()` |\n| B | Sign a ballot | Voter's device (WebAssembly in the browser) | `sign_vote(secret, vote, election_id, ring)` |\n| C | Validate a proof | Host / server | `verify_vote(vote, election_id, signature, key_image, ring)` |\n| D | Prove ownership of a key image | Voter's device (prove) / anyone (verify) | `prove_ownership(secret, election_id, context)` / `verify_ownership(public, key_image, election_id, context, proof)` |\n\nOperations A–C are the core anonymous-voting flow. **Operation D is\noptional and opt-in** — it is the deliberate *inverse* of the ring\nsignature's anonymity. See [Proving ownership of a\nvote](#proving-ownership-of-a-vote-operation-d).\n\n## Cryptographic choices\n\n- **Curve**: Ristretto255 (`curve25519-dalek`). Prime-order, constant-time, pure Rust.\n- **Ring signature scheme**: BLSAG (Back's Linkable Spontaneous\n Anonymous Group) implemented locally from the LSAG/BLSAG equations,\n with election-scoped key images. The signer's randomness is *hedged*:\n derived from the secret key, the message and fresh CSPRNG output\n together, so a faulty RNG cannot repeat a nonce and leak the key.\n- **Hash**: Blake2b-512 (`blake2` crate). Natively 64-byte output, fed\n directly into `Scalar::from_hash`.\n- **CSPRNG**: `SysRng`, which on `wasm32` delegates to `Crypto.getRandomValues`\n through the `getrandom` crate's `wasm_js` feature.\n\n## Threat model\n\nThe library is a mathematical oracle. It guarantees exactly three things,\nand each one rests on an assumption the host must uphold:\n\n| Guarantee | Holds against | Assumes |\n|---|---|---|\n| **Unforgeability** — no valid proof without a secret key from the ring | anyone, including the host | discrete log on Ristretto255, Blake2b as a random oracle |\n| **Linkability** — one key image per `(secret key, election_id)` | anyone, including the host | the registrar enrolled **one identity per person** |\n| **Anonymity** — a proof does not reveal which ring member signed | the public, other voters, auditors | the host served **every voter the same ring and `election_id`** |\n\nWhat this means in practice:\n\n- **The host is trusted for anonymity, not just for eligibility.** A\n ballot is anonymous within *the ring it was signed under*. A host that\n hands each voter a slightly different ring (one decoy swapped, one\n member missing) or a slightly different `election_id` (trailing space,\n different suffix) can later tell whose ballot is whose by checking which\n variant verifies. The cryptography cannot detect this; publication can.\n Publish the frozen ring's [`ring_digest`](#checking-the-ring-you-were-served)\n where voters can see it, and have the voting page refuse to sign when\n the ring it fetched does not match.\n- **Not receipt-free, not coercion-resistant.** Any voter can prove how\n they voted — with [Operation D](#proving-ownership-of-a-vote-operation-d),\n or simply by handing over their secret key — and ballots are stored in\n clear next to their key image. This is inherent to linkable ring\n signatures and to verifiable receipts in general: vote buying and\n coercion are *possible* by design. Use this scheme where verifiability\n matters more than receipt-freeness (associations, boards, proxy votes),\n not where voters may be pressured.\n- **One identity per person is the registrar's job.** A person enrolled\n with two keys votes twice with two distinct key images and the library\n cannot tell. Sybil resistance lives entirely in the enrolment process.\n- **Bound the ballot size.** Verification hashes the full ballot once\n per ring member, so its cost is `O(ring size × ballot size)`. The\n library imposes no limit; the host must (a few kilobytes is plenty for\n any realistic ballot), otherwise an attacker can submit oversized\n invalid ballots to burn verifier CPU.\n- **Use globally unique election identifiers.** If identities are reused\n across organisations and two elections share an `election_id` string,\n their key images coincide. A UUID avoids the question.\n- **What is *not* hidden:** the ring (who was allowed to vote), the number\n of ballots cast, and every ballot's content. Only the mapping from\n ballot to voter is.\n\n## Anti-double-vote contract\n\nThe module never tells the host whether a voter has already voted.\nThat decision belongs to the host. The protocol gives the host one\ndeterministic identifier per `(secret key, election_id)` pair — the\n**key image** — which it must store and de-duplicate against:\n\n1. Retrieve the key image returned by `sign_vote`.\n2. Look it up in the host's storage.\n3. Reject the transaction if it already exists.\n4. Otherwise ask `verify_vote` whether the proof is mathematically valid,\n and on success store the key image.\n\n### Election binding\n\nThe key image is a function of both the secret key and the\n`election_id`. The same voter using the same secret key twice in one\nelection produces the same tag, so double voting is detectable; the\nsame voter using that key in another election produces a different tag,\nso public proofs are not linkable across elections just by comparing\nkey images.\n\nEvery call to `sign_vote` and `verify_vote` also mixes the same\n`election_id` byte string into the BLSAG challenge chain. The host\nshould pass a stable per-election identifier (UUID, slug, hash of the\nevent configuration, …) on both sides.\n\nThis gives two election-context checks:\n\n- The **key image** is itself scoped by `election_id`.\n- The **signature** itself only validates against the `election_id`\n it was produced with.\n\nThe library normalises `election_id` to **Unicode NFC** before\nhashing, on both the signing and the verification side. Callers can\ntherefore pass the same logical identifier in any Unicode form\n(NFC, NFD, mixed) without breaking verification — the typical case\nwhere a server stores the ID in one normalisation and the voter's\npage receives it in another no longer silently invalidates every\nballot. ASCII identifiers are NFC by definition, so UUIDs and slugs\nare unaffected.\n\n### Ring size and the anonymity set\n\nThe cryptography guarantees the verifier cannot tell **which** member of\nthe ring produced a given signature — but the anonymity set is exactly\nthe ring. A ring of size *n* gives a `1/n` chance of guessing the signer\nuniformly at random, and **no more**:\n\n- **n = 2**: the protocol still validates, but the \"anonymity\" is\n binary — every ballot leaks down to \"voter A or voter B\". The\n library accepts it because cryptographically it is sound, not\n because it is privacy-meaningful. Treat it as a debugging\n configuration, not a production one.\n- **n < 8**: real-world side-channels (registration order, login\n timing, IP correlation on the host) usually let an observer narrow\n the set further. Treat anything below 8 as practically\n de-anonymising.\n- **n ≥ 16**: a reasonable floor for a real ballot. Larger rings cost\n more (`O(n)` for both signing and verification, plus signature size\n of `32 * (1 + n)` bytes), so pick the largest ring your latency\n budget allows.\n\nThe minimal `n = 2` floor is enforced inside the library; **picking a\nuseful n is the host's responsibility**.\n\n### Ring lifecycle: freeze before voting opens\n\nThe full set of authorised public keys (the \"ring\") is mixed into the\nhash chain of every signature, the same way `election_id` and the\nballot bytes are. As a consequence, the ring **must be frozen before\nthe first ballot is cast** and stay composition-identical for the\nwhole duration of the election. In practice:\n\n- **All voter identities must be generated and registered before\n voting opens.** The natural moment is during the election's\n enrolment window, which closes when voting opens.\n- Once voting opens, the host serves the same ring to every voter and\n uses that same ring at `verify_vote` time. Adding, removing, or\n swapping a member instantly invalidates every signature produced\n under the previous ring — there is no migration path.\n- Ring **order** does not matter (both sides canonicalise it\n internally by sorting lexicographically on the compressed point\n encoding), so the host is free to return it in any order over the\n wire. Only the *set* of members matters.\n- If a voter is added later, treat it as a new election: new\n `election_id`, fresh ring, fresh key-image store. Ballots from the\n old election remain verifiable as long as the host keeps a snapshot\n of the old ring.\n\nFor the same reason, the host should persist the ring it used to\nverify each ballot (or at least the election's frozen ring) alongside\nthe ballot itself, so audits later on can rerun `verify_vote`\ndeterministically.\n\n### Checking the ring you were served\n\nBecause anonymity is exactly \"which ring did I sign under\", the voter's\ndevice should verify that the ring it fetched from the host is the ring\nthe election published. `ring_digest` gives a canonical fingerprint of a\nring: a pure function of the *set* of members (order does not matter,\nduplicates and rings of fewer than two keys are rejected, exactly like\nsigning).\n\n```rust\nuse crypto_vote::{generate_identity, ring_digest, RingDigest};\n\nlet ring = vec![generate_identity().public_key, generate_identity().public_key];\n\n// The host publishes this next to the frozen ring (bulletin board,\n// election page, signed announcement …):\nlet published = ring_digest(&ring).unwrap().to_prefixed(); // \"ring_…_…\"\n\n// The voter's device recomputes it from the ring it fetched and refuses\n// to sign on a mismatch.\nlet fetched = ring.iter().rev().cloned().collect::>(); // any order\nassert_eq!(ring_digest(&fetched).unwrap(), RingDigest::from_prefixed(&published).unwrap());\n```\n\nThe digest is `Blake2b-512(domain ‖ n ‖ sorted keys)[..32]`, published in\nthe prefixed form `ring_<64 hex>_<8 hex checksum>`. Every front end exposes\nit: `ring_digest_wasm(ring)` and `ring_matches_digest_wasm(ring, expected)`\nin the browser, the `ring_digest` Extism function, and `cryptovote\nring-digest --ring ring.txt` on the CLI.\n\n## Proving ownership of a vote (Operation D)\n\nThe ring signature deliberately hides *which* authorised voter cast a\nballot. Operation D is the **opt-in inverse**: it lets the holder of a\nsecret key prove to a third party that a given key image — and therefore\nthe ballot next to it in the public registry — is theirs, **without\nrevealing the secret key**.\n\nThe intended use case is **mandated / proxy voting**: a voter (or a\nmandate-holder voting on someone's behalf) must be able to demonstrate,\nafter the fact, how a ballot was cast.\n\n```rust\nuse crypto_vote::{\n generate_identity, sign_vote, generate_nonce, prove_ownership, verify_ownership,\n};\n\nlet voter = generate_identity();\nlet other = generate_identity();\nlet ring = vec![voter.public_key, other.public_key];\nlet election_id = \"550e8400-e29b-41d4-a716-446655440000\";\n\n// The voter casts a ballot as usual.\nlet vote = sign_vote(&voter.secret_key, b\"option-A\", election_id, &ring).unwrap();\n\n// Later, a verifier (possibly external to the election) generates a fresh\n// nonce and sends it to the voter, who proves the registry's key image is\n// theirs. `context` is opaque bytes — here, the nonce's raw bytes.\nlet nonce = generate_nonce();\nlet proof = prove_ownership(&voter.secret_key, election_id, nonce.as_bytes());\n\n// The verifier checks it with public data only — the voter's public key,\n// the key image from the registry, the election id and the same nonce.\nassert!(verify_ownership(\n &voter.public_key,\n &vote.key_image,\n election_id,\n nonce.as_bytes(),\n &proof,\n));\n```\n\n### What it is\n\nA non-interactive **Chaum–Pedersen proof of equality of discrete\nlogarithms**. The key image is `I = x·B`, where `B = H_p(election_id || P)`\nis the same election-scoped base the key image was built from and\n`P = x·G` is the voter's public key. The proof demonstrates knowledge of\na single scalar `x` satisfying **both** `P = x·G` and `I = x·B` — which\nonly the true owner of `I` knows — while revealing nothing else about `x`.\nOn the wire it is 64 bytes (`own_<128 hex>_<8 hex checksum>` in the\nprefixed format), independent of the ring size.\n\n### The verifier can be anyone, with their own nonce\n\nVerification needs **only public data**: the voter's public key, the key\nimage, the `election_id` and the proof. No cooperation from the\norganisers and no secret are required, so a party completely external to\nthe election can check a proof on its own.\n\nEverything the verifier wants the proof bound to goes into `context`. The\nrecommended pattern is a **verifier-chosen nonce**:\n\n1. the verifier picks a fresh random nonce and sends it to the prover;\n2. the prover calls `prove_ownership` with `context = nonce` (the service\n may also append the ballot bytes);\n3. the verifier checks with the same `context`.\n\nThe nonce is folded into the proof's challenge, so the prover could not\nhave precomputed it — the proof is **fresh** and cannot be replayed.\n\n`generate_nonce()` is provided as a verifier-side convenience: it returns\na `Nonce` (32 fresh bytes) from the same platform CSPRNG (`SysRng`; Web\nCrypto in the browser). The organisation requesting the proof calls it,\nsends the nonce to the prover, and both pass its bytes as `context`. Using\nit is optional — any unpredictable, single-use value works.\n\nLike every other public value, a `Nonce` has the full encoding surface,\nincluding the self-describing, checksum-protected prefixed form\n(`nonce__`). On the high-level bindings the nonce travels\n**exclusively** in that form (validated on the way in), exactly like keys,\nsignatures and the proof itself — the prefix is transport only, the proof\nbinds the nonce's raw bytes. The pure-Rust API stays fully general: it\ntakes opaque `context: &[u8]`, so a richer context (e.g. the nonce with\nthe ballot bytes appended) is always available there.\n\n### Properties and limits\n\n- **No secret key is revealed.** The proof is zero-knowledge for `x`.\n- **Sound.** A third party cannot prove ownership of a key image that is\n not theirs (they would have to know the matching secret scalar).\n- **De-anonymising by design.** Producing a proof intentionally ties\n `P ↔ I`; it is the opt-in opposite of the ring signature's anonymity.\n- **Transferable, *not* designated-verifier.** A Chaum–Pedersen proof is\n publicly checkable, so the nonce gives *freshness* but **not**\n non-transferability: whoever holds `(context, proof)` can convince\n anyone else too. For ordinary mandate scenarios this is fine. If you\n need a proof that convinces *only* the designated verifier, you need a\n different (designated-verifier) construction — this crate does not\n provide one.\n- **It does not consult any registry.** `verify_ownership` answers exactly\n \"does the holder of this public key vouch for this key image, under this\n election and context?\" Tying the key image to a specific ballot is the\n registry's job (the vote signature binds ballot + key image, and the\n host de-duplicates on the key image); the caller does that lookup.\n- **Coercion note.** This makes the \"prove how I voted\" capability\n concrete and transferable. It is the right tool for mandated voting, but\n by the same token it means a coercer who can compel a proof (or the\n secret key) can learn how someone voted. This is an inherent property of\n *verifiable* receipts, not a flaw in the proof.\n\n### From JavaScript / Extism\n\nEvery value crossing these boundaries — including the nonce and the proof\n— uses the prefixed, checksum-protected form (`nonce_…`, `own_…`, `pk_…`,\n`ki_…`), validated on input.\n\n- **wasm-bindgen:** `generate_nonce_wasm()` returns a fresh prefixed nonce\n string (`nonce_…`); `prove_ownership_wasm(secret, electionId, nonce)`\n returns the prefixed `own_…` proof; `verify_ownership_wasm(publicKey,\n keyImage, electionId, nonce, proof)` returns a `bool`.\n- **Extism:** `generate_nonce` takes no input and returns\n `{\"nonce\": nonce_…}`; `prove_ownership` takes\n `{\"secret\": sk_…, \"election_id\": str, \"nonce\": nonce_…}` and returns\n `{\"proof\": own_…}`; `verify_ownership` takes\n `{\"public\": pk_…, \"key_image\": ki_…, \"election_id\": str, \"nonce\": nonce_…, \"proof\": own_…}`\n and returns `{\"valid\": bool}`.\n\nFor a custom or binary context (e.g. nonce + ballot bytes), use the\npure-Rust API, which takes opaque `context: &[u8]`.\n\n## Build matrix\n\nThe release workflow produces eight artefacts; the same commands work\nlocally. Pick the triple/flavour that matches your need, install its\none-off prerequisite, then run the matching build command. Edition 2024\nimplies Rust ≥ 1.85; CI tracks `stable`.\n\n| Triple — flavour | Build host | One-off setup | Output |\n|---|---|---|---|\n| `x86_64-unknown-linux-gnu` | Linux x64 | system C linker (any dev box has one) | dynamic ELF, ~700 KB |\n| `x86_64-unknown-linux-musl` | Linux x64 | `musl-tools` (provides `musl-gcc`) | **static ELF**, ~800 KB |\n| `aarch64-unknown-linux-gnu` | Linux x64 or arm | `gcc-aarch64-linux-gnu` cross-toolchain | dynamic ELF |\n| `aarch64-unknown-linux-musl` | Linux x64 or arm | none — uses `rust-lld` | **static ELF** |\n| `riscv64gc-unknown-linux-gnu` | Linux x64 or arm | `gcc-riscv64-linux-gnu` cross-toolchain | dynamic ELF |\n| `aarch64-apple-darwin` | macOS arm (M-series) | Xcode Command Line Tools | Mach-O |\n| `wasm32-unknown-unknown` — wasm-bindgen | any | `cargo install wasm-pack` | ES-module bundle for browsers |\n| `wasm32-wasip1` — **Extism plugin** | any | none — uses `rust-lld` | single `.wasm` for every Extism host SDK |\n\n> Install commands below are **Debian/Ubuntu** (`apt`); adapt to your\n> distribution (`dnf`, `pacman`, `zypper`, `brew`, …) or use\n> [`cross`](https://github.com/cross-rs/cross) for a Docker-based path\n> that needs nothing on the host. CI runs on `ubuntu-latest`, which is\n> why the upstream pipeline uses apt.\n\n### Build commands\n\nStandard template — works as-is for `x86_64-unknown-linux-gnu`,\n`x86_64-unknown-linux-musl` (after `apt install musl-tools`) and\n`aarch64-apple-darwin` (on a macOS host):\n\n```bash\ncargo build --release --locked --target --bin cryptovote\n# → target//release/cryptovote\n```\n\nThree cross-Linux rows need a linker selector — set it in the\nenvironment, then run the same command:\n\n```bash\n# aarch64-unknown-linux-gnu (after `apt install gcc-aarch64-linux-gnu`)\nexport CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc\n\n# aarch64-unknown-linux-musl (no apt package needed)\nexport CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=rust-lld\n\n# riscv64gc-unknown-linux-gnu (after `apt install gcc-riscv64-linux-gnu`)\nexport CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_LINKER=riscv64-linux-gnu-gcc\n```\n\nBrowser WASM uses `wasm-pack` (which wraps `cargo build` and emits JS\nglue alongside the `.wasm`). The `wasm-release` profile is the\nWebAssembly-tuned variant defined in `Cargo.toml`: same size knobs as\n`release`, plus `panic = \"abort\"` (see Cargo.toml's `[profile.release]`\ncomment for why panic strategy is kept out of the default release\nprofile):\n\n```bash\nwasm-pack build --profile wasm-release --target web --out-dir pkg-browser \\\n -- --no-default-features --features wasm --locked\n# → pkg-browser/{crypto_vote.js, crypto_vote_bg.wasm, …}\n```\n\n`--target web` emits a self-contained ES module you can `import` from a\nstatic page, a bundler (Vite, Rollup, esbuild), Bun, or Node — it\ninstantiates the WASM itself via an async `init()`, so no bundler plugin\nis required anywhere. This is the build published to npm.\n`--no-default-features` drops `clap`; `--features wasm` enables\n`wasm-bindgen`, `js-sys`, and the `getrandom/wasm_js` backend so\nrandomness comes from `Crypto.getRandomValues`.\n\nServer-side WASM uses the Extism flavour — the same `.wasm` is then\nloadable by every Extism host SDK (browser, Node, Python, Go, Rust, …).\n`getrandom` autoselects WASI's `random_get` on this target, so no extra\nbackend wiring is needed:\n\n```bash\ncargo build --profile wasm-release --locked --target wasm32-wasip1 --lib --no-default-features --features extism\n# → target/wasm32-wasip1/wasm-release/crypto_vote.wasm (~360 KB)\n```\n\nSee [Extism plugin](#extism-plugin) for the host-side usage from JS,\nNode, and other Extism SDKs.\n\n## Using the library\n\n```rust\nuse crypto_vote::{generate_identity, sign_vote, verify_vote};\n\nlet alice = generate_identity();\nlet bob = generate_identity();\nlet charlie = generate_identity();\n\nlet ring = vec![alice.public_key, bob.public_key, charlie.public_key];\nlet election_id = \"550e8400-e29b-41d4-a716-446655440000\"; // any stable string (UUID, slug, …)\n\n// Bob signs \"option-A\" — `bob.secret_key` never leaves Bob's device.\nlet proof = sign_vote(&bob.secret_key, b\"option-A\", election_id, &ring).unwrap();\n\n// The host: first dedup `proof.key_image`, then verify.\nassert!(verify_vote(\n b\"option-A\",\n election_id,\n &proof.signature,\n &proof.key_image,\n &ring,\n));\n```\n\n## Encoding formats\n\nEvery value the API exchanges as text — public keys, secret keys, key\nimages, signatures — has **two interchangeable string encodings**. They\ncarry the exact same bytes; nothing about the cryptography changes\nbetween them.\n\n| Format | Example | Methods |\n|---|---|---|\n| **Bare hex** | `e2f2ae0a…2d76` | `to_hex()` / `from_hex(..)` |\n| **Prefixed** | `pk_e2f2ae0a…2d76_bfb1c73d` | `to_prefixed()` / `from_prefixed(..)` |\n\nThe **prefixed** format wraps the same lowercase hex body with two\nconveniences:\n\n```text\n pk_e2f2ae0a…e08d2d76_bfb1c73d\n │ │ │\n │ │ └ checksum: 4 bytes (8 hex chars)\n │ └ body: identical to to_hex()\n └ tag: pk | sk | ki | blsag | own | nonce | ring\n```\n\n- a **tag** up front (`pk_`, `sk_`, `ki_`, `blsag_`, `own_`, `nonce_`,\n `ring_`) says what kind of\n value it is, so a public key pasted where a key image was expected is\n caught immediately instead of failing deep in verification;\n- a **checksum** at the end (a 4-byte BLAKE3 digest, hex-encoded) catches\n the overwhelming majority of single-character typos, transpositions and\n truncated pastes. The tag is folded into the checksum, so relabelling a\n `pk_…` value as `ki_…` is also detected.\n\nThe checksum is an **integrity / typo guard only — never a security\nprimitive**. Anyone can compute a valid checksum for any bytes;\nauthenticity comes solely from the BLSAG proof.\n\n| Type | Tag | `from_prefixed` signature |\n|---|---|---|\n| `PublicKey` | `pk_` | `PublicKey::from_prefixed(s)` |\n| `SecretKey` | `sk_` | `SecretKey::from_prefixed(s)` |\n| `KeyImage` | `ki_` | `KeyImage::from_prefixed(s)` |\n| `Signature` | `blsag_` | `Signature::from_prefixed(s, ring_size)` |\n| `OwnershipProof` | `own_` | `OwnershipProof::from_prefixed(s)` |\n| `Nonce` | `nonce_` | `Nonce::from_prefixed(s)` |\n| `RingDigest` | `ring_` | `RingDigest::from_prefixed(s)` |\n\n```rust\nlet id = crypto_vote::generate_identity();\nlet pretty = id.public_key.to_prefixed(); // \"pk_…_…\"\nassert!(pretty.starts_with(\"pk_\"));\nlet back = crypto_vote::PublicKey::from_prefixed(&pretty).unwrap();\nassert_eq!(back, id.public_key);\n\n// Wrong tag is rejected even though the bytes would decode fine as hex:\nassert!(crypto_vote::KeyImage::from_prefixed(&pretty).is_err());\n```\n\n`from_prefixed` returns `Error::InvalidPrefix` (missing/wrong tag) or\n`Error::InvalidChecksum` (mistyped or corrupted value), in addition to\nthe usual length / encoding errors. The error only ever echoes one of\nthe crate's own tags back, never an arbitrary first segment, so a secret\npasted in the wrong slot cannot end up in a log line.\n\n**The WASM, Extism and CLI front ends speak the prefixed format\n*exclusively*** — it is all they emit and all they accept; bare hex is\nrejected at those boundaries. The bare-hex `to_hex`/`from_hex` pair is\nreserved for the **pure-Rust library API**, where the caller is trusted\nto know what it is decoding. This keeps every value that crosses a\nhigh-level boundary self-describing and checksum-protected.\n\n## Private key format and properties\n\nA secret key is a **uniformly random scalar in the Ristretto255 scalar\nfield** — mathematically an integer in `[1, ℓ)`, where ℓ is the prime\norder of the group (`ℓ = 2^252 + 27742317777372353535851937790883648493`,\n≈ 2²⁵². So roughly 2²⁵² distinct keys exist). The crate ships two\ninterchangeable encodings; pick the one that matches your transport:\n\n| Encoding | Shape | Where it's used |\n|---|---|---|\n| **Raw bytes** | `[u8; 32]` little-endian | `SecretKey::{to,from}_bytes`, `sign_vote_*_wasm` and `is_valid_secret_key_wasm` secret inputs |\n| **Hex** | 64 lowercase characters | `SecretKey::{to,from}_hex` — pure-Rust library API only |\n| **Prefixed** | `sk_<64 hex>_<8 hex>` | `SecretKey::{to,from}_prefixed`, Extism plugin, CLI (see [Encoding formats](#encoding-formats)) |\n\nAll three encodings carry the same value bit-for-bit. The prefixed form\nis the **only** one the Extism and CLI front ends accept (bare hex is\nrejected there — it is reserved for the pure-Rust library API); raw\nbytes is the only\nformat the wasm-bindgen flavour accepts for secret material, because a\n`Uint8Array` is mutable and the JS caller can wipe it with `.fill(0)`\n— a JS `String` (and therefore a hex string) cannot be erased from the\nheap on demand.\n\n### Validity rules\n\nEvery parser (`SecretKey::from_bytes`, `from_hex`, and the WASM /\nExtism entry points) enforces three checks. A key that fails any of\nthem is rejected, never silently coerced:\n\n1. **Length.** Exactly 32 decoded bytes — `Error::InvalidLength`.\n Hex input must therefore be 64 characters.\n2. **Canonical encoding modulo ℓ.** The 32 bytes must decode to a\n scalar in `[0, ℓ)` — `Error::InvalidScalar`. The library refuses\n any \"non-reduced\" encoding (e.g. a value ≥ ℓ but < 2²⁵⁶), because\n that would let two different byte strings designate the same key\n — a classic malleability footgun.\n3. **Non-zero.** The zero scalar is rejected — `Error::InvalidSecretKey`.\n Its derived public key would be the Ristretto identity point, which\n the protocol cannot use as a participant (and which `PublicKey`\n independently refuses with `Error::InvalidIdentityPoint`).\n\n### Cryptographic properties\n\n- **The public key is fully determined by the secret key.** Internally\n `public_key = secret_key · G` where `G` is the Ristretto255 base\n point. Round-tripping a secret through `to_bytes` → `from_bytes`\n derives the **same** public key, so you only need to persist the\n 32-byte secret — the public key (and therefore the ring entry) can\n always be re-derived. There is no separate key-schedule, clamping,\n or hashing step applied to the secret.\n- **Same key, same ring, same election ⇒ same key image.** This is\n what makes double-vote detection possible. The key image is\n `I_e = x · H_p(domain ‖ election_id ‖ x · G)`, so it is fully\n deterministic in `(secret_key, election_id)` and changes between\n elections (see [Election binding](#election-binding)).\n- **Entropy.** `generate_identity` samples from `SysRng` —\n `getrandom(2)` / `getentropy(2)` / `BCryptGenRandom` natively,\n `Crypto.getRandomValues` in the browser. Any uniform value in\n `[1, ℓ)` is a valid secret. **Never** derive a secret from a user\n password without a strong KDF (Argon2id / scrypt) producing 32\n uniform bytes — the protocol's anonymity rests on the secret being\n unguessable.\n- **Memory hygiene.** Inside Rust the scalar lives in a `SecretKey`\n whose `Drop` impl calls `Zeroize`. Every transient buffer that\n touches the secret on the WASM / Extism boundary is wrapped in\n `Zeroizing`. The JS-side `Uint8Array` is the caller's\n responsibility — see [Operation A](#operation-a--generate-an-identity)\n for the wipe pattern. The hex form gives up that last step (a JS\n `String` is immutable), which is why the wasm-bindgen flavour keeps\n the secret as bytes.\n\n### Validating a secret key without constructing one\n\nReading a stored secret back and want a quick \"is this still a usable\nkey?\" check before doing anything else? Two zero-cost helpers apply\nthe three rules above and return a plain `bool`:\n\n```rust\nuse crypto_vote::SecretKey;\n\nlet bytes: [u8; 32] = load_from_disk();\nif !SecretKey::is_valid_bytes(&bytes) {\n return Err(\"stored secret is corrupted\");\n}\n\nassert!(SecretKey::is_valid_hex(\"aabbccdd…\")); // canonical, non-zero\nassert!(!SecretKey::is_valid_hex(\"not hex\")); // bad encoding\nassert!(!SecretKey::is_valid_hex(&\"00\".repeat(32))); // zero scalar\n\n// Same check for the prefixed form (tag + checksum must also be valid):\nassert!(SecretKey::is_valid_prefixed(\"sk_aabbccdd…_1a2b3c4d\"));\n```\n\nThese are the same checks performed implicitly at the start of every\n`sign_vote` call, so calling them up-front is purely a convenience —\nuseful for surfacing a clear UI message before the user has filled in\nthe rest of the form. The WASM and Extism layers expose the same\nhelper (see below).\n\n## Using the command line\n\n```bash\n# Generate an identity (one per voter). Output uses the prefixed format.\n$ cryptovote keygen\nsecret=sk_…_…\npublic=pk_…_…\n\n# Sign a ballot. `ring.txt` is one prefixed public key (`pk_…`) per\n# line. Keep the secret in a file or pass `--secret -` to read it from\n# stdin.\n$ cryptovote sign --secret-file secret.key --vote \"option-A\" \\\n --election-id \"election-2026-05\" --ring ring.txt\nsignature=blsag_…_…\nkey_image=ki_…_…\n\n# Verify. Exit code 0 = valid, 1 = invalid, 2 = bad input. The\n# --signature / --key-image values are prefixed (`blsag_…`, `ki_…`).\n$ cryptovote verify --vote \"option-A\" --election-id \"election-2026-05\" \\\n --signature blsag_…_… --key-image ki_…_… --ring ring.txt\nvalid\n\n# Fingerprint an authorised list (order-independent), to publish next to\n# the ring or to compare against a published value.\n$ cryptovote ring-digest --ring ring.txt\ndigest=ring_…_…\n```\n\nEvery key / signature argument is the prefixed form (`pk_…`,\n`sk_…`, `ki_…`, `blsag_…`); bare hex is rejected. The CLI always prints\nthe prefixed form.\n\n## Vote payload format\n\nThe library treats the vote as **opaque bytes** — `sign_vote` and\n`verify_vote` both take `&[u8]`, with no parsing and no built-in size\nlimit (the host should enforce one; see the [threat model](#threat-model)).\nJSON, Protobuf, raw text, or arbitrary binary all work the same way.\nThe WASM and Extism bindings expose **two entry points** per operation\nto cover this: a *text* one (`vote` as a UTF-8 string) and a *binary*\none (`vote` as a `Uint8Array` in WASM, hex-encoded in Extism). Both\nfunnel into the same `&[u8]` core, so a ballot signed through one is\nverifiable through any of them as long as the bytes match. See those\nsections below.\n\n**The contract for the host:** what you sign is what you store is what\nyou verify, byte-for-byte. If the host re-encodes the payload between\nreceiving it and verifying it — JSON re-serialisation, BOM stripping,\nline-ending normalisation, Unicode normalisation, lowercasing,\nanything — verification *will* fail, because Blake2b is sensitive to\nevery single byte. The safe rule is: persist the raw bytes received\nfrom the voter, and hand those same bytes back to `verify_vote`.\n\nNote that the vote payload is treated as *raw bytes* and is never\nnormalised by the library — unlike `election_id`, which is forced to\nNFC. The asymmetry is deliberate: the election ID is a *label* the\nhost controls and re-emits across encodings, so normalising it makes\nthe API robust; the vote is *content* the host stores verbatim, so\nnormalising it would silently change what was signed.\n\n### Large or structured payloads in the browser\n\nThere are two signing entry points. Pick by ballot type:\n\n- **`sign_vote_str_wasm(secret, voteStr, electionId, ring)`** — `vote`\n is a string. Use it for text ballots (a label, a stringified JSON\n ballot). Most common.\n- **`sign_vote_bytes_wasm(secret, voteBytes, electionId, ring)`** —\n `vote` is a `Uint8Array`. Use it for binary ballots (raw Protobuf,\n any non-UTF-8 bytes).\n\nThe natural pattern for a JSON ballot is to serialise it once on the\nvoter's device and pass that exact string everywhere afterwards:\n\n```js\nconst ballot = JSON.stringify(form); // a string\nconst electionId = \"550e8400-e29b-41d4-a716-446655440000\"; // plain JS string\nconst [sigHex, tagHex] = sign_vote_str_wasm(\n secretBytes, ballot, electionId, ringHex,\n);\n// `secretBytes` is the `Uint8Array` returned by `generate_identity_wasm`\n// (or read back from your store). Wipe it with `secretBytes.fill(0)`\n// as soon as you no longer need it in memory.\n\n// Send `ballot` (the same string), `sigHex` and `tagHex` to the host.\n// The host stores `ballot` verbatim — it must never JSON.parse +\n// JSON.stringify the payload, or the re-serialised string may differ\n// byte-for-byte and verification will fail.\n\n// Binary ballot? Sign the exact bytes and store them verbatim instead:\n// const [sigHex, tagHex] = sign_vote_bytes_wasm(\n// secretBytes, ballotBytes /* Uint8Array */, electionId, ringHex,\n// );\n```\n\n### Large or structured payloads on the CLI\n\nThe `--vote` flag accepts `-` to read the ballot from standard input.\nUse it for anything that exceeds your shell's argv limit, contains\nnewlines, or is binary:\n\n```bash\ncat ballot.json | cryptovote sign \\\n --secret-file secret.hex --vote - --election-id \"election-2026-05\" --ring ring.txt\n\ncat ballot.json | cryptovote verify --vote - \\\n --election-id \"election-2026-05\" \\\n --signature --key-image --ring ring.txt\n```\n\n## Using from JavaScript / WebAssembly\n\nThe library exposes a thin `wasm-bindgen` layer behind the `wasm`\nfeature. The npm package and a self-built bundle are the **same**\n`--target web` artefact: a self-contained ES module that instantiates\nthe WASM itself through an async `init()` default export. It works\nthe same everywhere — a bundler (Vite, Rollup, esbuild), Bun, Node, or\na plain `