dedis / cothority

Scalable collective authority
Other
425 stars 106 forks source link

evoting: hashMap creates wrong hash #2508

Open ineiti opened 1 year ago

ineiti commented 1 year ago

This is another potential security error: the hashMap method here:

https://github.com/dedis/cothority/blob/e0c9afbb847b070e1bda6f54561a4082b803db80/evoting/lib/transaction.go#L109

creates a hash of a map, which is difficult in go, as the map doesn't have an explicit order in go. So it takes all keys, sorts them alphabetically, and then hashes the values.

But: it doesn't add the key to the values.

So the following two maps will have the same hash:

map1 := map[string]string{
    "first": 1,
    "second": 2,
}

map2 := map[string]string{
    "a": 1,
    "b": 2,
}

Fix: also add the key to the hash.