swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Browse source
This commit is contained in:
swrup 2026-02-03 17:43:50 +01:00
parent e621db57bf
commit 15f4ea1c5f
3 changed files with 151 additions and 146 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/http_keys.ml
View file

@ -194,7 +194,9 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
let* global_fees = let* global_fees =
Pg.get_global_fees db_conn ~start_date:Timestamp.epoch |> unwrap_err_caqti Pg.get_global_fees db_conn ~start_date:Timestamp.epoch |> unwrap_err_caqti
in in
let auditors = (* TODO *) [] in let auditors =
(* TODO /management/auditors + /auditors/$AUDITOR_PUB/$H_DENOM_PUB *) []
in
let extensions = None in let extensions = None in
let extensions_sig = None in let extensions_sig = None in
Ok Ok

25
tools/offline_impl.ml
View file

@ -52,7 +52,7 @@ let sign ~master_key ~input ~output =
Offline_sig.verify_future_keys_response master_pub future_keys_response Offline_sig.verify_future_keys_response master_pub future_keys_response
in in
let master_signatures = let master_signatures =
Offline_sig.make_master_signatures ~master_key future_keys_response Offline_sig.mk_future_keys ~master_key future_keys_response
in in
let* s = Api.encode Api.MasterSignatures.jsont master_signatures in let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
let* () = write_file output s in let* () = write_file output s in
@ -61,18 +61,29 @@ let sign ~master_key ~input ~output =
let revoke_denom ~output ~master_key ~h_denom = let revoke_denom ~output ~master_key ~h_denom =
let* key = read_master_key_file master_key in let* key = read_master_key_file master_key in
let* h_denom = B32.decode h_denom in let* h_denom = B32.decode h_denom in
let h_denom = Bin_type.DenominationHash.of_octets h_denom in let h_denom_pub = Bin_type.DenominationHash.of_octets h_denom in
let denom_revoke = Offline_sig.mk_denom_revoke ~key h_denom in let denom_revoke =
let master_sig =
let open Bin_sig.MasterDenominationKeyRevocation in
sign_f ~f:(Crypto.EddsaSignature.sign ~key) { h_denom_pub }
in
Api.DenomRevocationSignature.{ master_sig }
in
let* s = Api.encode Api.DenomRevocationSignature.jsont denom_revoke in let* s = Api.encode Api.DenomRevocationSignature.jsont denom_revoke in
let* () = write_file output s in let* () = write_file output s in
Ok () Ok ()
let revoke_signkey ~output ~master_key ~signkey = let revoke_signkey ~output ~master_key ~signkey =
let open Crypto in
let* key = read_master_key_file master_key in let* key = read_master_key_file master_key in
let* signkey = EddsaPublicKey.of_b32 signkey in let* exchange_pub = Crypto.EddsaPublicKey.of_b32 signkey in
let v = Offline_sig.mk_signkey_revoke ~key signkey in let signkey_revoke =
let* s = Api.encode Api.SignkeyRevocationSignature.jsont v in let master_sig =
let open Bin_sig.MasterSigningKeyRevocation in
sign_f ~f:(Crypto.EddsaSignature.sign ~key) { exchange_pub }
in
Api.SignkeyRevocationSignature.{ master_sig }
in
let* s = Api.encode Api.SignkeyRevocationSignature.jsont signkey_revoke in
let* () = write_file output s in let* () = write_file output s in
Ok () Ok ()

268
tools/offline_sig.ml
View file

@ -2,116 +2,49 @@ open Crypto
open Bin_type open Bin_type
open Api open Api
let denom_signature ~master_key let verify_future_keys_response =
FutureDenom. let verify_future_denom ~sm_denom_pub
{ FutureDenom.
section_name= _; {
value; section_name;
stamp_start; value= _;
stamp_expire_withdraw; stamp_start;
stamp_expire_deposit; stamp_expire_withdraw;
stamp_expire_legal; stamp_expire_deposit= _;
denom_pub; stamp_expire_legal= _;
fee_withdraw; denom_pub;
fee_deposit; fee_withdraw= _;
fee_refresh; fee_deposit= _;
fee_refund= _; fee_refresh= _;
denom_secmod_sig= _; fee_refund= _;
} = denom_secmod_sig;
let octets = DenominationKey.to_octets denom_pub in } =
let h_denom_pub = DenominationHash.hash octets in let h_denom_pub =
let master_sig = DenominationHash.hash (DenominationKey.to_octets denom_pub)
let open Bin_sig.DenominationKeyValidity in in
let master = EddsaPrivateKey.(pub_of_priv master_key) in let h_section_name = Hash_64_cstr.hash section_name in
sign_f let anchor_time = stamp_start in
~f:(EddsaSignature.sign ~key:master_key) let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
{ let open Bin_sig.DenominationKeyAnnouncement in
master; verify_f
start= stamp_start; ~f:(EddsaSignature.verify ~key:sm_denom_pub)
expire_withdraw= stamp_expire_withdraw; denom_secmod_sig
expire_spend= stamp_expire_deposit; { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
expire_legal= stamp_expire_legal;
value;
fee_withdraw;
fee_deposit;
fee_refresh;
denom_hash= h_denom_pub;
}
in in
DenomSignature.{ h_denom_pub; master_sig } let verify_future_signkey ~sm_signkey_pub
FutureSignKey.
let signkey_signature ~master_key { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
FutureSignKey. let exchange_pub = key in
{ key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } = let anchor_time = stamp_start in
let master_sig = let duration = Timestamp.diff stamp_start stamp_expire in
let open Bin_sig.ExchangeSigningKeyValidity in let open Bin_sig.SigningKeyAnnouncement in
sign_f verify_f
~f:(EddsaSignature.sign ~key:master_key) ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
{ signkey_secmod_sig
start= stamp_start; { exchange_pub; anchor_time; duration }
expire= stamp_expire;
end_= stamp_end;
signkey_pub= key;
}
in in
SignKeySignature.{ key; master_sig }
let make_master_signatures ~master_key fun our_master_public_key
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= _;
denom_secmod_public_key= _;
signkey_secmod_public_key= _;
} =
let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
MasterSignatures.{ denom_sigs; signkey_sigs }
(* - ** - *)
let verify_future_signkey ~sm_signkey_pub
FutureSignKey.
{ key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } =
let exchange_pub = key in
let anchor_time = stamp_start in
let duration = Timestamp.diff stamp_start stamp_expire in
let open Bin_sig.SigningKeyAnnouncement in
verify_f
~f:(EddsaSignature.verify ~key:sm_signkey_pub)
signkey_secmod_sig
{ exchange_pub; anchor_time; duration }
let verify_future_denom ~sm_denom_pub
FutureDenom.
{
section_name;
value= _;
stamp_start;
stamp_expire_withdraw;
stamp_expire_deposit= _;
stamp_expire_legal= _;
denom_pub;
fee_withdraw= _;
fee_deposit= _;
fee_refresh= _;
fee_refund= _;
denom_secmod_sig;
} =
let h_denom_pub =
DenominationHash.hash (DenominationKey.to_octets denom_pub)
in
let h_section_name = Hash_64_cstr.hash section_name in
let anchor_time = stamp_start in
let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
let open Bin_sig.DenominationKeyAnnouncement in
verify_f
~f:(EddsaSignature.verify ~key:sm_denom_pub)
denom_secmod_sig
{ h_denom_pub; h_section_name; anchor_time; duration_withdraw }
let verify_future_keys_response our_master_public_key
FutureKeysResponse. FutureKeysResponse.
{ {
future_denoms; future_denoms;
@ -119,37 +52,96 @@ let verify_future_keys_response our_master_public_key
master_pub; master_pub;
denom_secmod_public_key; denom_secmod_public_key;
signkey_secmod_public_key; signkey_secmod_public_key;
} = }
let open Syntax in ->
let* () = let open Syntax in
match master_pub = our_master_public_key with let* () =
| false -> match master_pub = our_master_public_key with
Fmt.error | false ->
"master public key of the future key response does not match ours" Fmt.error
| true -> Ok () "master public key of the future key response does not match ours"
in | true -> Ok ()
let* () = in
list_iter let* () =
(verify_future_denom ~sm_denom_pub:denom_secmod_public_key) list_iter
future_denoms (verify_future_denom ~sm_denom_pub:denom_secmod_public_key)
in future_denoms
let* () = in
list_iter let* () =
(verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key) list_iter
future_signkeys (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key)
in future_signkeys
Ok () in
Ok ()
let mk_denom_revoke ~key h_denom_pub = let mk_future_keys =
let master_sig = let denom_signature ~master_key
let open Bin_sig.MasterDenominationKeyRevocation in FutureDenom.
sign_f ~f:(EddsaSignature.sign ~key) { h_denom_pub } {
section_name= _;
value;
stamp_start;
stamp_expire_withdraw;
stamp_expire_deposit;
stamp_expire_legal;
denom_pub;
fee_withdraw;
fee_deposit;
fee_refresh;
fee_refund= _;
denom_secmod_sig= _;
} =
let octets = DenominationKey.to_octets denom_pub in
let h_denom_pub = DenominationHash.hash octets in
let master_sig =
let open Bin_sig.DenominationKeyValidity in
let master = EddsaPrivateKey.(pub_of_priv master_key) in
sign_f
~f:(EddsaSignature.sign ~key:master_key)
{
master;
start= stamp_start;
expire_withdraw= stamp_expire_withdraw;
expire_spend= stamp_expire_deposit;
expire_legal= stamp_expire_legal;
value;
fee_withdraw;
fee_deposit;
fee_refresh;
denom_hash= h_denom_pub;
}
in
DenomSignature.{ h_denom_pub; master_sig }
in
let signkey_signature ~master_key
FutureSignKey.
{ key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
let master_sig =
let open Bin_sig.ExchangeSigningKeyValidity in
sign_f
~f:(EddsaSignature.sign ~key:master_key)
{
start= stamp_start;
expire= stamp_expire;
end_= stamp_end;
signkey_pub= key;
}
in
SignKeySignature.{ key; master_sig }
in in
DenomRevocationSignature.{ master_sig }
let mk_signkey_revoke ~key exchange_pub = fun ~master_key
let master_sig = FutureKeysResponse.
let open Bin_sig.MasterSigningKeyRevocation in {
sign_f ~f:(EddsaSignature.sign ~key) { exchange_pub } future_denoms;
in future_signkeys;
SignkeyRevocationSignature.{ master_sig } master_pub= _;
denom_secmod_public_key= _;
signkey_secmod_public_key= _;
}
->
let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
let signkey_sigs =
List.map (signkey_signature ~master_key) future_signkeys
in
MasterSignatures.{ denom_sigs; signkey_sigs }