init

tools/dune

@@ -0,0 +1,7 @@
+(executable
+ (public_name offline)
+ (name offline)
+ (modules offline offline_impl offline_bin)
+ (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
+
+; todo depends on curl

tools/offline.ml

@@ -0,0 +1,78 @@
+open Cmdliner
+open Cmdliner.Term.Syntax
+open Offline_impl
+
+let default_master_offline_key_file = "data/master_offline_private_key"
+let default_response_file = "response.json"
+let default_request_file = "request.json"
+
+(*let to_term_ret = function Error e -> `Error (false, e) | Ok () -> `Ok ()*)
+let to_term_ret = Fun.id
+
+let setup_cmd =
+  let doc = "Generate offline master keys" in
+  let output =
+    Arg.(
+      value
+      & opt filepath default_master_offline_key_file
+      & info [ "o"; "output" ] ~doc)
+  in
+  Cmd.make (Cmd.info "setup" ~doc)
+  @@
+  let+ output = output in
+  setup ~output |> to_term_ret
+
+let download_cmd =
+  let doc = "GET /management/keys/" in
+  let man =
+    [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ]
+  in
+  let output =
+    Arg.(
+      value & opt filepath default_response_file & info [ "o"; "output" ] ~doc)
+  in
+  Cmd.make (Cmd.info "download" ~doc ~man)
+  @@
+  let+ output = output in
+  download ~output |> to_term_ret
+
+let upload_cmd =
+  let doc = "POST /management/keys/" in
+  let man =
+    [ `S Manpage.s_description; `P "$(cmd) upload /management/keys." ]
+  in
+  let input =
+    Arg.(value & opt file default_request_file & info [ "i"; "input" ] ~doc)
+  in
+  Cmd.make (Cmd.info "upload" ~doc ~man)
+  @@
+  let+ input = input in
+  upload ~input |> to_term_ret
+
+let sign_cmd =
+  let doc = "Sign FutureKeysResponse." in
+  let master_key =
+    let doc = "Master offline Eddsa private key file." in
+    Arg.(value & opt file default_master_offline_key_file & info [ "key" ] ~doc)
+  in
+  let input =
+    Arg.(value & opt file default_response_file & info [ "i"; "input" ] ~doc)
+  in
+  let output =
+    Arg.(
+      value & opt filepath default_request_file & info [ "o"; "output" ] ~doc)
+  in
+  Cmd.make (Cmd.info "sign" ~doc)
+  @@
+  let+ input = input and+ output = output and+ master_key = master_key in
+  sign ~input ~output ~master_key |> to_term_ret
+
+let cli =
+  let info =
+    let doc = "MTE Offline CLI tool" in
+    Cmd.info "mte-offline" ~doc
+  in
+  Cmd.group info [ setup_cmd; download_cmd; sign_cmd; upload_cmd ]
+
+let main () = Cmd.eval_result cli
+let () = if !Sys.interactive then () else exit (main ())

tools/offline_bin.ml

@@ -0,0 +1,84 @@
+open Crypto
+open Bin_type
+open Api
+
+let denom_signature ~master_key
+    FutureDenom.
+      {
+        section_name= _;
+        value;
+        stamp_start;
+        stamp_expire_withdraw;
+        stamp_expire_deposit;
+        stamp_expire_legal;
+        denom_pub;
+        fee_withdraw;
+        fee_deposit;
+        fee_refresh;
+        fee_refund= _;
+        (* TODO check sigs *)
+        denom_secmod_sig= _;
+      } =
+  let octets = DenominationKey.to_octets denom_pub in
+  let h_denom_pub = HashCode.hash octets in
+  let master_sig =
+    let open Bin_signature.DenominationKeyValidityPS in
+    let master = EddsaPrivateKey.(pub_of_priv master_key) in
+    let denom_hash = DenominationHash.hash octets in
+    {
+      master;
+      start= stamp_start;
+      expire_withdraw= stamp_expire_withdraw;
+      expire_spend= stamp_expire_deposit;
+      expire_legal= stamp_expire_legal;
+      value;
+      fee_withdraw;
+      fee_deposit;
+      fee_refresh;
+      denom_hash;
+    }
+    |> Bin.to_string bin
+    |> EddsaSignature.sign ~key:master_key
+  in
+  DenomSignature.{ h_denom_pub; master_sig }
+
+let signkey_signature ~master_key
+    FutureSignKey.
+      {
+        key;
+        stamp_start;
+        stamp_expire;
+        stamp_end;
+        (* TODO check sigs *)
+        signkey_secmod_sig= _;
+      } =
+  let master_sig =
+    let open Bin_signature.ExchangeSigningKeyValidityPS in
+    {
+      start= stamp_start;
+      expire= stamp_expire;
+      end_= stamp_end;
+      signkey_pub= key;
+    }
+    |> Bin.to_string bin
+    |> EddsaSignature.sign ~key:master_key
+  in
+  SignKeySignature.{ key; master_sig }
+
+let make_master_signatures ~master_key
+    FutureKeysResponse.
+      {
+        future_denoms;
+        future_signkeys;
+        (* TODO check sigs *)
+        master_pub= _;
+        denom_secmod_public_key= _;
+        signkey_secmod_public_key= _;
+      } =
+  let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
+  let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
+  MasterSignatures.{ denom_sigs; signkey_sigs }
+
+let verify_future_key_response _future_key_response =
+  (* TODO *)
+  Ok ()

tools/offline_impl.ml

@@ -0,0 +1,55 @@
+open Syntax
+
+let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg
+
+let write_file fname content =
+  Bos.OS.File.write (Fpath.v fname) content |> unwrap_err_msg
+
+let base_url = Uri.of_string "http://localhost:3434/"
+
+let management_keys_url =
+  Uri.with_path base_url "/management/keys/" |> Uri.to_string
+
+let download ~output =
+  let open Bos in
+  let uri = management_keys_url in
+  OS.Cmd.run Cmd.(v "curl" % "-s" % "-o" % output % "-X" % "GET" % uri)
+  |> unwrap_err_msg
+
+let upload ~input =
+  let open Bos in
+  let uri = management_keys_url in
+  OS.Cmd.run
+    Cmd.(
+      v "curl"
+      % "-i"
+      % "-X"
+      % "POST"
+      % "-H"
+      % "Content-Type: application/json"
+      % "--data"
+      % ("@" ^ input)
+      % uri)
+  |> unwrap_err_msg
+
+let setup ~output =
+  let () = Mirage_crypto_rng_unix.use_default () in
+  let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
+  Fmt.pr "generated master public key:@\n%s@."
+    (Mirage_crypto_ec.Ed25519.pub_to_octets pub |> B32.encode);
+  let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in
+  write_file output priv_data
+
+let sign ~master_key ~input ~output =
+  let open Crypto in
+  let* input = read_file input in
+  let* master_key = read_file master_key in
+  let master_key = EddsaPrivateKey.of_octets master_key in
+  let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
+  let* () = Offline_bin.verify_future_key_response future_key_response in
+  let master_signatures =
+    Offline_bin.make_master_signatures ~master_key future_key_response
+  in
+  let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
+  let* () = write_file output s in
+  Ok ()