From 0f67a942b6ae66e5105e1d4b965241aaae6cd31c Mon Sep 17 00:00:00 2001 From: swrup Date: Fri, 27 Feb 2026 20:28:56 +0100 Subject: [PATCH] add verify_signature.ml --- src/denomination.ml | 17 ++++++++++++ src/http_management.ml | 58 ++++++--------------------------------- src/keys.ml | 35 ++++++++++++++++------- test/validate_response.ml | 18 ++---------- 4 files changed, 52 insertions(+), 76 deletions(-) diff --git a/src/denomination.ml b/src/denomination.ml index 710f8921..e1aabbc8 100644 --- a/src/denomination.ml +++ b/src/denomination.ml @@ -16,6 +16,23 @@ type t = { master_sig: Signatures.DenominationKeyValidity.t; } +let verify_denomination_key_validity ~key dn = + let open Signatures.DenominationKeyValidity in + verify key dn.master_sig + { + R.master= key; + start= dn.stamp_start; + expire_withdraw= dn.stamp_expire_withdraw; + expire_spend= dn.stamp_expire_deposit; + expire_legal= dn.stamp_expire_legal; + value= dn.value; + fee_withdraw= dn.fee_withdraw; + fee_deposit= dn.fee_deposit; + fee_refresh= dn.fee_refresh; + fee_refund= dn.fee_refund; + denom_hash= dn.h_pub; + } + let make_denom_group_sorted denominations = let open Syntax in (* use hashtbl to re-group denoms *) diff --git a/src/http_management.ml b/src/http_management.ml index f1ef75b6..6aa0da10 100644 --- a/src/http_management.ml +++ b/src/http_management.ml @@ -16,68 +16,26 @@ module Keys_get = struct end module Keys_post = struct - let verify_fdn (module Keys : Keys.S) - DenomSignature.{ h_denom_pub; master_sig } = - let open FutureDenom in - let open Signatures.DenominationKeyValidity in - let* fdn = Keys.find_future_denomination h_denom_pub in - verify Config.master_public_key master_sig - { - R.master= Config.master_public_key; - start= fdn.stamp_start; - expire_withdraw= fdn.stamp_expire_withdraw; - expire_spend= fdn.stamp_expire_deposit; - expire_legal= fdn.stamp_expire_legal; - value= fdn.value; - fee_withdraw= fdn.fee_withdraw; - fee_deposit= fdn.fee_deposit; - fee_refresh= fdn.fee_refresh; - fee_refund= fdn.fee_refund; - denom_hash= h_denom_pub; - } - - let verify_fsk (module Keys : Keys.S) SignKeySignature.{ key; master_sig } = - let open Signatures.ExchangeSigningKeyValidity in - let* fsk = Keys.find_future_signkey key in - verify Config.master_public_key master_sig - { - R.start= fsk.stamp_start; - expire= fsk.stamp_expire; - end_= fsk.stamp_end; - signkey_pub= key; - } - - let verify keys MasterSignatures.{ denom_sigs; signkey_sigs } = - let* () = list_iter (verify_fsk keys) signkey_sigs in - let* () = list_iter (verify_fdn keys) denom_sigs in + let verify (module Keys : Keys.S) + MasterSignatures.{ denom_sigs; signkey_sigs } = + let* () = list_iter Keys.verify_future_signkey signkey_sigs in + let* () = list_iter Keys.verify_future_denomination denom_sigs in Ok () - let do_ ~db_conn:_ (module Keys : Keys.S) - MasterSignatures.{ denom_sigs; signkey_sigs } = - let* () = - list_iter - (fun SignKeySignature.{ key; master_sig } -> - Keys.certify_future_signkey key master_sig) - signkey_sigs - in - let* () = - list_iter - (fun DenomSignature.{ h_denom_pub; master_sig } -> - Keys.certify_future_denomination h_denom_pub master_sig) - denom_sigs - in + let do_ (module Keys : Keys.S) MasterSignatures.{ denom_sigs; signkey_sigs } = + let* () = list_iter Keys.certify_future_signkey signkey_sigs in + let* () = list_iter Keys.certify_future_denomination denom_sigs in Ok () let jsont = MasterSignatures.jsont let f req server _env = Logs.info (fun m -> m "POST /management/keys/"); - let db_conn = Vif.Server.device Devices.db_connection server in let keys = Vif.Server.device Devices.keys server in let res = let* v = Vif.Request.of_json req |> unwrap_err_msg in let* () = verify keys v in - let* () = do_ ~db_conn keys v in + let* () = do_ keys v in Ok () in Respond.result_no_content res req diff --git a/src/keys.ml b/src/keys.ml index ef67bb0b..2c32e2ae 100644 --- a/src/keys.ml +++ b/src/keys.ml @@ -11,15 +11,11 @@ module type S = sig val find_denomination : denom_hash -> Denomination.t option result val signkeys : unit -> Signkey.t list result val denominations : unit -> Denomination.t list result - val find_future_signkey : eddsa_pub -> Api.FutureSignKey.t result - val find_future_denomination : denom_hash -> Api.FutureDenom.t result val make_future_keys_response : unit -> Api.FutureKeysResponse.t result - - val certify_future_signkey : - eddsa_pub -> Signatures.ExchangeSigningKeyValidity.t -> unit result - - val certify_future_denomination : - denom_hash -> Signatures.DenominationKeyValidity.t -> unit result + val verify_future_signkey : Api.SignKeySignature.t -> unit result + val verify_future_denomination : Api.DenomSignature.t -> unit result + val certify_future_signkey : Api.SignKeySignature.t -> unit result + val certify_future_denomination : Api.DenomSignature.t -> unit result val revoke_signkey : eddsa_pub -> Signatures.MasterSigningKeyRevocation.t -> unit result @@ -277,7 +273,25 @@ module Make (Conn : Pg.CONN) : S = struct master_sig; } - let certify_future_signkey pub master_sig = + let verify_future_signkey Api.SignKeySignature.{ key; master_sig } = + let open Signatures.ExchangeSigningKeyValidity in + let* fsk = find_future_signkey key in + verify Config.master_public_key master_sig + { + R.start= fsk.stamp_start; + expire= fsk.stamp_expire; + end_= fsk.stamp_end; + signkey_pub= key; + } + + let verify_future_denomination Api.DenomSignature.{ h_denom_pub; master_sig } + = + let* fdn = find_future_denomination h_denom_pub in + let dn = dn_of_future_dn fdn h_denom_pub master_sig in + Denomination.verify_denomination_key_validity ~key:Config.master_public_key + dn + + let certify_future_signkey Api.SignKeySignature.{ key= pub; master_sig } = match Sm_eddsa.find_key pub with | None -> Error "future signkey not found" | Some (pub, (t1, t2)) -> ( @@ -295,7 +309,8 @@ module Make (Conn : Pg.CONN) : S = struct m "certified signkey `%s`" (EddsaPublicKey.to_b32 sk.pub)); ()) - let certify_future_denomination h_pub master_sig = + let certify_future_denomination + Api.DenomSignature.{ h_denom_pub= h_pub; master_sig } = match Sm_rsa.find_key h_pub with | None -> Error "future denomination not found" | Some (h_pub, (section_name, pub, t1)) -> ( diff --git a/test/validate_response.ml b/test/validate_response.ml index c1b7795c..068eaa57 100644 --- a/test/validate_response.ml +++ b/test/validate_response.ml @@ -75,24 +75,10 @@ let keys content = let denom_l = v.denominations |> Denomination.denoms_of_denomgroups in let* () = - let open Denomination in denom_l |> list_iter (fun dn -> - let open Signatures.DenominationKeyValidity in - verify v.master_public_key dn.master_sig - { - R.master= v.master_public_key; - start= dn.stamp_start; - expire_withdraw= dn.stamp_expire_withdraw; - expire_spend= dn.stamp_expire_deposit; - expire_legal= dn.stamp_expire_legal; - value= dn.value; - fee_withdraw= dn.fee_withdraw; - fee_deposit= dn.fee_deposit; - fee_refresh= dn.fee_refresh; - fee_refund= dn.fee_refund; - denom_hash= dn.h_pub; - }) + Denomination.verify_denomination_key_validity ~key:v.master_public_key + dn) in let* () = let last_issue_date =