From 1cb9d3e60b2af915ad00805f620e1600aac794fb Mon Sep 17 00:00:00 2001 From: swrup Date: Fri, 28 Nov 2025 17:30:15 +0100 Subject: [PATCH] + wip sign_future_keys --- tools/dune | 2 +- tools/offline.ml | 65 +++++------------------------ tools/offline_signature.ml | 85 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 97 insertions(+), 55 deletions(-) create mode 100644 tools/offline_signature.ml diff --git a/tools/dune b/tools/dune index 3366e550..acb8c8bb 100644 --- a/tools/dune +++ b/tools/dune @@ -1,5 +1,5 @@ (executable (public_name offline) (name offline) - (modules offline) + (modules offline offline_signature) (libraries cmdliner bos fmt mirage-crypto ptime mte vif)) diff --git a/tools/offline.ml b/tools/offline.ml index 15a9743c..347c5f09 100644 --- a/tools/offline.ml +++ b/tools/offline.ml @@ -15,71 +15,28 @@ let download ~base_url ~output = let setup ~output = let output = Fpath.v output in let () = Mirage_crypto_rng_unix.use_default () in - let priv, _pub = Mirage_crypto_ec.Ed25519.generate () in + let priv, pub = Mirage_crypto_ec.Ed25519.generate () in + Fmt.pr "generated master public key:@\n%s@." + (Mirage_crypto_ec.Ed25519.pub_to_octets pub |> B32.encode); let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in Bos.OS.File.write output priv_data -let _denom_signature master_priv master_pub - Api.FutureDenom. - { - section_name= _; - value; - stamp_start; - stamp_expire_withdraw; - stamp_expire_deposit; - stamp_expire_legal; - denom_pub; - fee_withdraw; - fee_deposit; - fee_refresh; - fee_refund= _; - (* TODO check sigs *) - denom_secmod_sig= _; - } = - let pub_octets = - let denom_pub = - match denom_pub with - | Rsa v -> v - | CS _ -> Fmt.failwith "CS key types are not supported." - in - let pub = denom_pub.Api.RsaDenominationKey.rsa_pub in - Crypto.RsaPublicKey.to_octets pub - in - let h_denom_pub = Api.HashCode.hash pub_octets in - let master_sig = - let open Bin_type in - let open Bin_signature.DenominationKeyValidityPS in - let denom_key_validity = - { - master= master_pub; - start= stamp_start; - expire_withdraw= stamp_expire_withdraw; - expire_spend= stamp_expire_deposit; - expire_legal= stamp_expire_legal; - value; - fee_withdraw; - fee_deposit; - fee_refresh; - denom_hash= DenominationHash.hash pub_octets; - } - in - let data = Bin.to_string bin denom_key_validity in - Crypto.EddsaSignature.sign ~key:master_priv data - in - Api.DenomSignature.{ h_denom_pub; master_sig } - let sign ~input ~output ~master_key = let open Syntax in let open Bos.OS in let open Crypto in let input = Fpath.v input in - let _output = Fpath.v output in + let output = Fpath.v output in let master_key = Fpath.v master_key in let* input = File.read input |> unwrap_err_msg in let* master_key = File.read master_key |> unwrap_err_msg in - let _master_key = EddsaPrivateKey.of_octets master_key in - let* _future_key_response = Api.decode Api.FutureKeysResponse.jsont input in - (* TODO sign *) + let master_key = EddsaPrivateKey.of_octets master_key in + let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in + let master_signatures = + Offline_signature.master_signatures ~master_key future_key_response + in + let* s = Api.encode Api.MasterSignatures.jsont master_signatures in + let* () = File.write output s |> unwrap_err_msg in Ok () (* CLI *) diff --git a/tools/offline_signature.ml b/tools/offline_signature.ml new file mode 100644 index 00000000..c01708b6 --- /dev/null +++ b/tools/offline_signature.ml @@ -0,0 +1,85 @@ +let denom_signature ~master_key + Api.FutureDenom. + { + section_name= _; + value; + stamp_start; + stamp_expire_withdraw; + stamp_expire_deposit; + stamp_expire_legal; + denom_pub; + fee_withdraw; + fee_deposit; + fee_refresh; + fee_refund= _; + (* TODO check sigs *) + denom_secmod_sig= _; + } = + let pub_octets = + let denom_pub = + match denom_pub with + | Rsa v -> v + | CS _ -> Fmt.failwith "CS key types are not supported." + in + let pub = denom_pub.Api.RsaDenominationKey.rsa_pub in + Crypto.RsaPublicKey.to_octets pub + in + let h_denom_pub = Api.HashCode.hash pub_octets in + let master_sig = + let open Bin_type in + let open Bin_signature.DenominationKeyValidityPS in + let master = Crypto.EddsaPrivateKey.(pub_of_priv master_key) in + let denom_hash = DenominationHash.hash pub_octets in + { + master; + start= stamp_start; + expire_withdraw= stamp_expire_withdraw; + expire_spend= stamp_expire_deposit; + expire_legal= stamp_expire_legal; + value; + fee_withdraw; + fee_deposit; + fee_refresh; + denom_hash; + } + |> Bin.to_string bin + |> Crypto.EddsaSignature.sign ~key:master_key + in + Api.DenomSignature.{ h_denom_pub; master_sig } + +let signkey_signature ~master_key + Api.FutureSignKey. + { + key; + stamp_start; + stamp_expire; + stamp_end; + (* TODO check sigs *) + signkey_secmod_sig= _; + } = + let master_sig = + let open Bin_signature.ExchangeSigningKeyValidityPS in + { + start= stamp_start; + expire= stamp_expire; + end_= stamp_end; + signkey_pub= key; + } + |> Bin.to_string bin + |> Crypto.EddsaSignature.sign ~key:master_key + in + Api.SignKeySignature.{ key; master_sig } + +let master_signatures ~master_key + Api.FutureKeysResponse. + { + future_denoms; + future_signkeys; + (* TODO check sigs *) + master_pub= _; + denom_secmod_public_key= _; + signkey_secmod_public_key= _; + } = + let denom_sigs = List.map (denom_signature ~master_key) future_denoms in + let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in + Api.MasterSignatures.{ denom_sigs; signkey_sigs }