Source-reviewed components
Ballot cryptography
Exponential ElGamal over Ristretto255, homomorphic addition and threshold-combination code exist. Source presence is not proof of a fully secured election pipeline.
SparkGlim SEVA · Pre-release
A security model to examine, not assume.
Read source-backed components alongside integration gaps and planned work. SEVA has no blanket security or election-readiness guarantee.
Read source-backed components alongside integration gaps and planned work. SEVA has no blanket security or election-readiness guarantee.
Security
Cryptography, with clear boundaries.
Understand SEVA’s implemented ballot-encryption and trustee primitives, and the verification work still required before election use.
Make the record inspectable.
How sealed configuration, hash-linked records, signatures and replay controls support SEVA’s intended integrity model.
Separate identity from the ballot.
Review SEVA’s intended identity and ballot separation, blind eligibility credentials, retention considerations and privacy limitations.
Security includes the room.
Evaluate SEVA’s device, operator, transport and recovery boundaries before planning a supervised election environment.
Separate cryptographic components from assurance
Core cryptographic implementations exist. Full artifact-proof and tally verification are incomplete, so component presence must not become an end-to-end integrity claim.
Assess privacy across the workflow
Identity separation is a design objective. Services, logs, timing and device behavior require review before claiming a cast ballot cannot be linked to a voter.
Treat hardware and operations as evidence
Do not advertise completed HSM, FIDO2, hardware WORM or universal network-isolation guarantees from planned architecture. Actual integration and deployment evidence determine what can be stated.
Current readiness
Evidence and limits
Source review confirms that a component exists. It does not establish independent security assurance, completed deployment tests or approval to run an election.
Source-reviewed components
Proof and trustee primitives
Chaum–Pedersen proofs, primitive selection-sum checks and distributed-key-generation components have source tests. These tests were not executed during this website audit.
Source-reviewed components
Eligibility and credential boundaries
Blind credential issuance and spent-nullifier storage are implemented in source. Complete voter identity, reissue and concurrent check-in assurance still requires integration testing.
Source-reviewed components
Explicit lifecycle rules
The core state machine restricts transitions and disallows egress in Open and Paused. Actual session, ceremony and network enforcement must be validated together.
Source-reviewed components
Separated records and audit chains
Role-scoped database grants and hash-linked audit/ballot components support the intended separation of duties. Host trust, custody, logs and recovery remain part of the threat model.
Integration testing required
Independent result verification
The artifact verifier does not yet complete integrated ballot-proof and tally checks. Do not treat a verifier result as complete election assurance.
Integration testing required
Operator identity and key custody
Authentication adapters, signing and hardware-key modules exist, but their full operational integration is unfinished. No universal FIDO2, non-exportable HSM custody or biometric guarantee is claimed.
Integration testing required
Deployment and evidence rehearsals
Hardware lockdown, printing and custody, recovery, integrated mock elections and external review require acceptance evidence. Runbooks and module names are not certification.
Planned or under development
Master and Kiosk product packaging
The two-installed-application direction is proposed. Current source packaging still contains several surfaces and executables; released two-app deployment is not established.
Planned or under development
Additional ballot technologies
Shuffle-based processing and ranked/write-in scenarios remain deferred. A feature flag or roadmap entry does not establish a supported cryptographic protocol or ballot type.
Request consultation
Scope before commitment
Assessment only. Not yet suitable for any live election. Deployment and operation require authorized SparkGlim Security and Technical Teams.
Country context guides the consultation. It does not establish jurisdictional approval, regulatory compliance or product availability.