ECIES share encryption lacks AEAD context binding

[p0mvn]

The ECIES layer derives k = SHA256(E_compressed || S.x) and calls
ChaCha20-Poly1305.Seal(..., aad=nil) with a zero nonce. Fresh ephemeral
scalars make nonce reuse unlikely in the honest path, but the ciphertext is not
authenticated to round_id, sender, recipient, or the contributor commitment
digest. Envelope replay or recipient/context substitution is therefore detected
only indirectly by later Feldman verification, not by the AEAD boundary.

Remediation: version the envelope KDF/AEAD transcript and bind
round_id || sender_valoper || recipient_valoper || H(feldman_commitments) as
AEAD associated data. Add a KDF domain tag such as svote-ecies-v1.

Evidence:

• crypto/ecies/ecies.go: deriveKey hashes only E and S.x.
• crypto/ecies/ecies.go: Seal and Open pass nil associated data.
• app/prepare_proposal_ceremony.go: callers pass only plaintext share bytes;
  no round/sender/recipient context enters ECIES.

Feldman verification should prevent a replayed/substituted share from being accepted if it does not match the sender’s public commitments for that context.

[p0mvn]

vote-sdk/app/prepare_proposal_ceremony.go

Lines 529 to 541 in cdfffe1

	// Verify the share against the contributor's Feldman commitments.
	ok, err := shamir.VerifyFeldmanShare(G, contribCommitments, shamirIndex, shareSk.Scalar)
	if err != nil {
	zeroScalar(shareSk.Scalar)
	return nil, nil, fmt.Errorf("contributor %s: Feldman verification error: %w",
	contrib.ValidatorAddress, err)
	}
	// If the share does not verify, return an error.
	if !ok {
	zeroScalar(shareSk.Scalar)
	return nil, nil, fmt.Errorf("contributor %s: share failed Feldman verification",
	contrib.ValidatorAddress)
	}

A replayed ciphertext from another round/recipient/index can decrypt, but unless the plaintext scalar matches the contributor’s Feldman commitments at this validator’s current Shamir index, it is rejected before being summed.

In the current system, there is primarily a liveness risk.

[p0mvn]

POC: #318