BFT Consensus Mechanism

// Public keys stored on-chain
pub struct PubKey {
    pub hash: String,               // SHA-256 hash of public key
    pub creator: String,            // Node identifier
    pub bytes: Vec<u8>,            // ECDSA P-256 public key
    pub state: String,              // Active (A) or Revoked (R)
    pub time_added: DateTime<Utc>, // When added to chain
    pub is_revoked: bool,          // Revocation status
    pub time_revoked: Option<DateTime<Utc>>,
    pub add_block_height: usize,   // Block when added
}

// From types/src/crypto.rs:12
pub fn sign_hash(key: &SigningKey, hash: &str) -> String {
    let hash = hex::decode(hash).unwrap();
    let signature: Signature = key.sign(&hash);
    hex::encode(serialize(&signature).unwrap())
}

// From database/src/lib.rs:272
let pub_key = self.get_public_key(&block.signature_pub_key_hash).await?;
let verifier: VerifyingKey = deserialize(&pub_key.bytes).unwrap();
let signature_bytes = hex::decode(&block.hash_signature).unwrap();
let signature: Signature = deserialize(&signature_bytes).unwrap();

// Verify signature matches block hash
verifier.verify(calculated_hash.as_bytes(), &signature).unwrap();

// From types/src/lib.rs:74
pub fn new(
    signer: &BlockSigner,        // (private_key, public_key, metadata)
    prev_hash: &str,              // Previous block hash
    results: Vec<CandidateResult>,// Election data
    height: usize,                // Block number
    merkle_root: [u8; 32],       // Merkle tree root
) -> Self {
    // Sign previous hash to prove chain continuity
    let prev_hash_signature = sign_hash(&signer.0, prev_hash);
    
    // Create signature public key hash for validator identification
    let sigkey_hash = sha256_digest(&signer.1);
    
    // Build block header
    let header = ElectionBlockHeader {
        previous_hash: hex::decode(prev_hash).unwrap()
            .as_slice().try_into().unwrap(),
        merkle_root,
        timestamp: Utc::now().timestamp() as i64,
        block_number: height as i64,
        validator_signature: sigkey_hash.clone(),
    };
    
    // Hash and sign the block
    let hash = crypto::hash_block(&header);
    let hash_signature = sign_hash(&signer.0, &hash);
    
    Self {
        hash,
        hash_signature,
        inner: BlockType::Result(results),
        height,
        merkle_root,
        timestamp: Utc::now(),
        prev_hash: prev_hash.to_string(),
        signature_pub_key_hash: sigkey_hash.to_string(),
        prev_hash_signature,
        version: VERSION,
        creator: signer.2.creator.clone(),
        creator_pub_key: sha256_digest(&signer.1),
    }
}

// From database/src/lib.rs:93
pub async fn add_public_key(
    &self,
    pub_key: &[u8],
    creator: &str,
    pubkey_hash: &str,
    block_height: i32,
) -> Result<i64, sqlx::Error> {
    let sql = "INSERT INTO pubkeys(
        pubkey_hash, creator, pubkey, state, time_added, block_height
    ) VALUES (?, ?, ?, ?, ?, ?)";
    
    sqlx::query(sql)
        .bind(pubkey_hash)
        .bind(creator)
        .bind(hex::encode(pub_key))
        .bind("A")  // Active state
        .bind(Utc::now().timestamp())
        .bind(block_height)
        .execute(&mut *pool)
        .await
}

n = 10 validators
f = 3 malicious nodes tolerated
2f + 1 = 7 honest nodes needed for consensus

// From database/src/lib.rs:237
pub async fn is_valid(&self) -> Result<bool, sqlx::Error> {
    let height = self.get_height().await?;
    
    for index in 0..height {
        let block = self.get_block_by_height(index).await?;
        
        // 1. Verify chain linkage
        let prev_hash = if index == 0 {
            [0u8; 32]
        } else {
            self.get_block_by_height(index - 1)
                .await?
                .hash
                .as_bytes()
                .try_into()
                .unwrap()
        };
        
        // 2. Reconstruct header with stored merkle_root
        let header = ElectionBlockHeader {
            block_number: block.height as i64,
            merkle_root: block.merkle_root,
            previous_hash: prev_hash,
            validator_signature: block.signature_pub_key_hash.clone(),
            timestamp: block.timestamp.timestamp() as i64,
        };
        
        // 3. Re-hash header and compare
        let calculated_hash = crypto::hash_block(&header);
        if calculated_hash != block.hash {
            return Err(sqlx::Error::Protocol(
                format!("Block hash mismatch at index {}", index).into(),
            ));
        }
        
        // 4. Verify signature
        let pub_key = self.get_public_key(&block.signature_pub_key_hash).await?;
        let verifier: VerifyingKey = deserialize(&pub_key.bytes).unwrap();
        let signature: Signature = deserialize(&signature_bytes).unwrap();
        verifier.verify(calculated_hash.as_bytes(), &signature).unwrap();
        
        // 5. Verify chain linkage
        if block.prev_hash != hex::encode(prev_hash) {
            return Err(sqlx::Error::Protocol(
                format!("Previous hash mismatch at index {}", index).into(),
            ));
        }
    }
    
    Ok(true)
}

// From blockchain/src/lib.rs:318
if chain_height > our_height {
    // Peer has longer chain, sync from them
    self.request_chain_sync(peer_addr, stream).await?;
}