src/crypto.ml

@@ -247,9 +247,18 @@ module RsaPrivateKey = struct
     Jsont.of_of_string ~kind:"RsaPrivateKey" of_b32 ~enc:to_b32
 end
 
-module RsaSignature = struct
+module RsaSignature : sig
+  type t
+
+  val sign : key:RsaPrivateKey.t -> string -> t
+  val jsont : t Jsont.t
+end = struct
   type t = string
 
+  (* decrypt <=> sign *)
+  let sign ~key bmsg =
+    Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key bmsg
+
   let jsont =
     let of_b32 s = B32.decode s in
     let to_b32 t = B32.encode t in

src/fdh_rsa.ml

@@ -72,12 +72,9 @@ let unblind_sig pub ~bks bsig =
   let data = Z.rem (Z.mul data r_inv) pub.n in
   Z_extra.to_octets_be data
 
-(* decrypt <=> sign *)
-let sign ~key bmsg = Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key bmsg
-
 let verify ~key s ~msg =
   let msg_fdh = rsa_full_domain_hash key msg in
-  let s1 = Z_extra.to_octets_be msg_fdh in
+  let s1 = Mirage_crypto_pk.Z_extra.to_octets_be msg_fdh in
   let s2 = Mirage_crypto_pk.Rsa.encrypt ~key s in
   match Eqaf.equal s1 s2 with
   | false -> Fmt.error "RSA signature verification failed"

src/secmod_rsa.ml

@@ -268,7 +268,7 @@ module Make (Fs : Fat.FS) = struct
 
   let sign h_pub msg =
     let+ k = find h_pub in
-    let data = Fdh_rsa.sign ~key:k.priv msg in
+    let data = RsaSignature.sign ~key:k.priv msg in
     data
 
   let revoke h_pub =