[Security] Define the native certifiable provider TOE and assurance contract #4

New Issue

2026-08-04T13:49:44+02:00

zemion commented

2026-08-04 13:49:44 +02:00

Scope

Define the native provider as an isolated Target of Evaluation rather than claiming certification for the whole GovOPlaN platform.

Acceptance criteria

election classes, jurisdiction, attack potential, voting principles, and applicable PP/TR are explicit;
client, server, verifier, tally, bulletin-board, key-ceremony, release, time, and operator boundaries are documented;
supporting GovOPlaN modules are classified as inside or outside the TOE;
Security Target threats, assumptions, objectives, evaluated configuration, and recovery boundary are drafted with a recognized evaluation facility;
provider declarations pin protocol, implementation, certificate authority/reference/evidence, and validity;
research, in-evaluation, certified, expired, and revoked states fail closed as specified;
no provider can acquire external_certified through configuration override.

The first runtime assurance declaration and fail-closed pinning slice is implemented. The external evaluation engagement and final TOE remain open.

## Scope Define the native provider as an isolated Target of Evaluation rather than claiming certification for the whole GovOPlaN platform. ## Acceptance criteria - election classes, jurisdiction, attack potential, voting principles, and applicable PP/TR are explicit; - client, server, verifier, tally, bulletin-board, key-ceremony, release, time, and operator boundaries are documented; - supporting GovOPlaN modules are classified as inside or outside the TOE; - Security Target threats, assumptions, objectives, evaluated configuration, and recovery boundary are drafted with a recognized evaluation facility; - provider declarations pin protocol, implementation, certificate authority/reference/evidence, and validity; - research, in-evaluation, certified, expired, and revoked states fail closed as specified; - no provider can acquire external_certified through configuration override. The first runtime assurance declaration and fail-closed pinning slice is implemented. The external evaluation engagement and final TOE remain open.

zemion added the module/voting

labels 2026-08-04 13:49:44 +02:00

zemion referenced this issue

2026-08-04 13:49:44 +02:00

[Feature] Implement a native end-to-end verifiable ballot engine #5

zemion referenced this issue from GovOPlaN/govoplan-committee

2026-08-04 13:49:47 +02:00

[Feature] Add the first certified Committee ballot provider #1

zemion referenced this issue

2026-08-04 14:38:32 +02:00

[Epic] Establish certified and end-to-end verifiable Voting provider program #2

zemion commented

2026-08-04 14:38:51 +02:00

Codex State: progress

Summary

The first enforceable TOE boundary slice is implemented in Core 2b5c143 and Voting 8cfd6bf.
Provider declarations pin implementation, protocol, assurance profiles, certification authority/reference/evidence and validity; external_certified cannot be enabled by configuration alone.

Changed Files

docs/CERTIFIABLE_VOTING_PROGRAM.md
src/govoplan_voting/backend/service.py

Verification

Voting and Core assurance tests pass

Next / Blocked

Election classes, jurisdiction, applicable PP/TR, detailed component boundary, Security Target and evaluation-facility review remain open.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - The first enforceable TOE boundary slice is implemented in Core 2b5c143 and Voting 8cfd6bf. - Provider declarations pin implementation, protocol, assurance profiles, certification authority/reference/evidence and validity; external_certified cannot be enabled by configuration alone. ### Changed Files - `docs/CERTIFIABLE_VOTING_PROGRAM.md` - `src/govoplan_voting/backend/service.py` ### Verification - `Voting and Core assurance tests pass` ### Next / Blocked - Election classes, jurisdiction, applicable PP/TR, detailed component boundary, Security Target and evaluation-facility review remain open. Suggested status label: `status/in-progress`

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-voting#4