Reject trailing Halo2 proof bytes

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## v0.7.0
+
 ### Documented
 
 - Clarified that the delegation circuit's condition 8 ("Ballot Scaling")
@@ -68,6 +70,11 @@
     reachable under the `unstable-internal-api` Cargo feature for the
     in-tree integration test).
 
+### Security
+
+- Reject Halo2 proofs that verify but leave trailing unread transcript bytes
+  after delegation, vote-proof, or share-reveal verification.
+
 ### Migration
 
 - Drop named imports of removed identifiers

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "voting-circuits"
-version = "0.6.0"
+version = "0.7.0"
 edition = "2021"
 rust-version = "1.86.0"
 description = "Governance ZKP circuits (delegation, vote proof, share reveal) for the Zcash shielded-voting protocol."

src/delegation/prove.rs

@@ -7,13 +7,15 @@ use std::{string::String, vec::Vec};
 
 use halo2_proofs::{
     pasta::EqAffine,
-    plonk::{self, keygen_pk, keygen_vk, verify_proof, SingleVerifier},
+    plonk::{self, keygen_pk, keygen_vk},
     poly::commitment::Params,
-    transcript::{Blake2bRead, Challenge255},
 };
 
 use super::circuit::{Circuit, Instance, K};
-use crate::{prove_error::create_proof_bytes, ProveError};
+use crate::{
+    prove_error::{create_proof_bytes, verify_proof_bytes},
+    ProveError,
+};
 
 // ================================================================
 // Params / key generation
@@ -156,11 +158,7 @@ pub fn verify_delegation_proof(proof: &[u8], instance: &Instance) -> Result<(),
 
     let public_inputs = instance.to_halo2_instance();
 
-    let strategy = SingleVerifier::new(params);
-    let mut transcript = Blake2bRead::<_, EqAffine, Challenge255<_>>::init(proof);
-
-    verify_proof(params, vk, strategy, &[&[&public_inputs]], &mut transcript)
-        .map_err(|e| format!("delegation verification failed: {:?}", e))
+    verify_proof_bytes("delegation", params, vk, proof, &public_inputs)
 }
 
 #[cfg(test)]

src/prove_error.rs

@@ -1,8 +1,8 @@
 use halo2_proofs::{
     pasta::EqAffine,
-    plonk::{self, create_proof},
+    plonk::{self, create_proof, verify_proof, SingleVerifier},
     poly::commitment::Params,
-    transcript::{Blake2bWrite, Challenge255},
+    transcript::{Blake2bRead, Blake2bWrite, Challenge255},
 };
 use pasta_curves::vesta;
 use rand::rngs::OsRng;
@@ -29,6 +29,30 @@ where
     Ok(transcript.finalize())
 }
 
+pub(crate) fn verify_proof_bytes(
+    label: &str,
+    params: &Params<EqAffine>,
+    vk: &plonk::VerifyingKey<EqAffine>,
+    proof: &[u8],
+    public_inputs: &[vesta::Scalar],
+) -> Result<(), String> {
+    let strategy = SingleVerifier::new(params);
+    let mut proof_reader = proof;
+    let mut transcript = Blake2bRead::<_, EqAffine, Challenge255<_>>::init(&mut proof_reader);
+
+    verify_proof(params, vk, strategy, &[&[public_inputs]], &mut transcript)
+        .map_err(|e| format!("{label} verification failed: {:?}", e))?;
+
+    if !proof_reader.is_empty() {
+        return Err(format!(
+            "{label} verification failed: proof has {} trailing unread bytes",
+            proof_reader.len()
+        ));
+    }
+
+    Ok(())
+}
+
 /// Error returned when Halo2 proof creation fails.
 #[derive(Debug)]
 #[non_exhaustive]
@@ -141,4 +165,41 @@ mod tests {
 
         assert!(matches!(err, ProveError::Halo2(plonk::Error::Synthesis)));
     }
+
+    #[test]
+    fn verify_proof_bytes_rejects_trailing_unread_bytes() {
+        let params = Params::<EqAffine>::new(4);
+        let empty_circuit = TinyCircuit {
+            witness: Value::unknown(),
+        };
+        let vk = plonk::keygen_vk(&params, &empty_circuit).expect("tiny keygen_vk should succeed");
+        let pk = plonk::keygen_pk(&params, vk.clone(), &empty_circuit)
+            .expect("tiny keygen_pk should succeed");
+        let public_inputs = [vesta::Scalar::from(1)];
+        let circuit = TinyCircuit {
+            witness: Value::known(public_inputs[0]),
+        };
+        let proof = create_proof_bytes(&params, &pk, circuit, &public_inputs)
+            .expect("tiny proof should succeed");
+
+        verify_proof_bytes("tiny", &params, &vk, &proof, &public_inputs)
+            .expect("canonical proof should verify");
+
+        let mut proof_with_trailing_bytes = proof;
+        proof_with_trailing_bytes.extend_from_slice(b"junk");
+
+        let err = verify_proof_bytes(
+            "tiny",
+            &params,
+            &vk,
+            &proof_with_trailing_bytes,
+            &public_inputs,
+        )
+        .expect_err("proof with trailing bytes must be rejected");
+
+        assert!(
+            err.contains("4 trailing unread bytes"),
+            "unexpected error: {err}"
+        );
+    }
 }

src/share_reveal/prove.rs

@@ -7,13 +7,15 @@ use std::{string::String, vec::Vec};
 
 use halo2_proofs::{
     pasta::EqAffine,
-    plonk::{self, keygen_pk, keygen_vk, verify_proof, SingleVerifier},
+    plonk::{self, keygen_pk, keygen_vk},
     poly::commitment::Params,
-    transcript::{Blake2bRead, Challenge255},
 };
 
 use super::circuit::{Circuit, Instance, K};
-use crate::{prove_error::create_proof_bytes, ProveError};
+use crate::{
+    prove_error::{create_proof_bytes, verify_proof_bytes},
+    ProveError,
+};
 
 // ================================================================
 // Params / key generation
@@ -166,11 +168,7 @@ pub fn verify_share_reveal_proof(proof: &[u8], instance: &Instance) -> Result<()
 
     let public_inputs = instance.to_halo2_instance();
 
-    let strategy = SingleVerifier::new(params);
-    let mut transcript = Blake2bRead::<_, EqAffine, Challenge255<_>>::init(proof);
-
-    verify_proof(params, vk, strategy, &[&[&public_inputs]], &mut transcript)
-        .map_err(|e| format!("share_reveal verification failed: {:?}", e))
+    verify_proof_bytes("share_reveal", params, vk, proof, &public_inputs)
 }
 
 #[cfg(test)]

src/vote_proof/prove.rs

@@ -7,13 +7,15 @@ use std::{string::String, vec::Vec};
 
 use halo2_proofs::{
     pasta::EqAffine,
-    plonk::{self, keygen_pk, keygen_vk, verify_proof, SingleVerifier},
+    plonk::{self, keygen_pk, keygen_vk},
     poly::commitment::Params,
-    transcript::{Blake2bRead, Challenge255},
 };
 
 use super::circuit::{Circuit, Instance, K};
-use crate::{prove_error::create_proof_bytes, ProveError};
+use crate::{
+    prove_error::{create_proof_bytes, verify_proof_bytes},
+    ProveError,
+};
 
 // ================================================================
 // Cached params + keys
@@ -164,11 +166,7 @@ pub fn verify_vote_proof(proof: &[u8], instance: &Instance) -> Result<(), String
 
     let public_inputs = instance.to_halo2_instance();
 
-    let strategy = SingleVerifier::new(params);
-    let mut transcript = Blake2bRead::<_, EqAffine, Challenge255<_>>::init(proof);
-
-    verify_proof(params, vk, strategy, &[&[&public_inputs]], &mut transcript)
-        .map_err(|e| format!("vote proof verification failed: {:?}", e))
+    verify_proof_bytes("vote proof", params, vk, proof, &public_inputs)
 }
 
 #[cfg(test)]