From 054b443e7abfc4d6205b5e524d2f98135d99816a Mon Sep 17 00:00:00 2001 From: swrup Date: Sat, 6 Dec 2025 19:18:53 +0100 Subject: [PATCH] offline tool: verify signature --- src/api_sig.ml | 12 ++++++-- src/management.ml | 16 +++++------ tools/offline_impl.ml | 6 ++-- tools/offline_sig.ml | 64 +++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 83 insertions(+), 15 deletions(-) diff --git a/src/api_sig.ml b/src/api_sig.ml index b90bc52e..b0ab5107 100644 --- a/src/api_sig.ml +++ b/src/api_sig.ml @@ -44,7 +44,9 @@ end) : sig type t val sign : key:Crypto.EddsaPrivateKey.t -> r -> t - val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> bool + + (* Ok () on verification success *) + val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> (unit, string) result val jsont : t Jsont.t end = struct open Crypto @@ -54,7 +56,13 @@ end = struct let bin = R.bin let sign ~key r = EddsaSignature.sign ~key (Bin.to_string bin r) - let verify ~key t r = EddsaSignature.verify ~key t ~msg:(Bin.to_string bin r) + + let verify ~key t r = + let b = EddsaSignature.verify ~key t ~msg:(Bin.to_string bin r) in + match b with + | false -> Error "signature verification failure" + | true -> Ok () + let jsont = EddsaSignature.jsont end diff --git a/src/management.ml b/src/management.ml index c2965eaf..92b53def 100644 --- a/src/management.ml +++ b/src/management.ml @@ -1,7 +1,7 @@ open Api open Devices -let mk_future_denom ~key +let mk_future_denom ~sm_denom_priv ({ pub; priv= _; @@ -31,7 +31,8 @@ let mk_future_denom ~key let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw |> Timestamp.of_span_exn in - sign ~key { h_denom_pub; h_section_name; anchor_time; duration_withdraw } + sign ~key:sm_denom_priv + { h_denom_pub; h_section_name; anchor_time; duration_withdraw } in FutureDenom. { @@ -49,7 +50,7 @@ let mk_future_denom ~key denom_secmod_sig; } -let mk_future_signkey ~key +let mk_future_signkey ~sm_signkey_priv ({ pub; priv= _; stamp_start; stamp_expire; stamp_end; master_sig= _ } : Signkey.t) = let signkey_secmod_sig = @@ -59,7 +60,7 @@ let mk_future_signkey ~key let duration = Timestamp.diff stamp_start stamp_expire |> Timestamp.of_span_exn in - sign ~key { exchange_pub; anchor_time; duration } + sign ~key:sm_signkey_priv { exchange_pub; anchor_time; duration } in FutureSignKey. { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig } @@ -70,15 +71,14 @@ let mk_future_keys_response (secmod_signkey : Secmod_signkey.t) secmod_denom.keys |> List.filter (fun k -> Option.is_none k.Denomination.master_sig) |> List.map (fun denom -> - let key = secmod_denom.sm_key.Signkey.priv in - mk_future_denom ~key denom) + mk_future_denom ~sm_denom_priv:secmod_denom.sm_key.Signkey.priv denom) in let future_signkeys = secmod_signkey.keys |> List.filter (fun k -> Option.is_none k.Signkey.master_sig) |> List.map (fun signkey -> - let key = secmod_denom.sm_key.Signkey.priv in - mk_future_signkey ~key signkey) + mk_future_signkey ~sm_signkey_priv:secmod_signkey.sm_key.Signkey.priv + signkey) in let master_pub = Config.Exchange.master_public_key in let denom_secmod_public_key = secmod_denom.sm_key.pub in diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml index c1b16661..eb3b8364 100644 --- a/tools/offline_impl.ml +++ b/tools/offline_impl.ml @@ -45,10 +45,10 @@ let sign ~master_key ~input ~output = let* input = read_file input in let* master_key = read_file master_key in let master_key = EddsaPrivateKey.of_octets master_key in - let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in - let* () = Offline_sig.verify_future_key_response future_key_response in + let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in + let* () = Offline_sig.verify_future_keys_response future_keys_response in let master_signatures = - Offline_sig.make_master_signatures ~master_key future_key_response + Offline_sig.make_master_signatures ~master_key future_keys_response in let* s = Api.encode Api.MasterSignatures.jsont master_signatures in let* () = write_file output s in diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml index faba9544..3d4e6fd5 100644 --- a/tools/offline_sig.ml +++ b/tools/offline_sig.ml @@ -77,6 +77,66 @@ let make_master_signatures ~master_key let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in MasterSignatures.{ denom_sigs; signkey_sigs } -let verify_future_key_response _future_key_response = - (* TODO *) +(* - ** - *) + +let verify_future_signkey ~sm_signkey_pub + FutureSignKey. + { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } = + let exchange_pub = key in + let anchor_time = stamp_start in + let duration = + Timestamp.diff stamp_start stamp_expire |> Timestamp.of_span_exn + in + let open Api_sig.SigningKeyAnnouncementPS in + verify ~key:sm_signkey_pub signkey_secmod_sig + { exchange_pub; anchor_time; duration } + +let verify_future_denom ~sm_denom_pub + FutureDenom. + { + section_name; + value= _; + stamp_start; + stamp_expire_withdraw; + stamp_expire_deposit= _; + stamp_expire_legal= _; + denom_pub; + fee_withdraw= _; + fee_deposit= _; + fee_refresh= _; + fee_refund= _; + denom_secmod_sig; + } = + let h_denom_pub = + DenominationHash.hash (DenominationKey.to_octets denom_pub) + in + let h_section_name = Hash_64_cstr.hash section_name in + let anchor_time = stamp_start in + let duration_withdraw = + Timestamp.diff stamp_start stamp_expire_withdraw |> Timestamp.of_span_exn + in + let open Api_sig.DenominationKeyAnnouncementPS in + verify ~key:sm_denom_pub denom_secmod_sig + { h_denom_pub; h_section_name; anchor_time; duration_withdraw } + +let verify_future_keys_response + FutureKeysResponse. + { + future_denoms; + future_signkeys; + master_pub= _; + denom_secmod_public_key; + signkey_secmod_public_key; + } = + let open Syntax in + let* () = + list_iter + (verify_future_denom ~sm_denom_pub:denom_secmod_public_key) + future_denoms + in + let* () = + list_iter + (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key) + future_signkeys + in Ok ()