src/http_management.ml

@@ -69,12 +69,12 @@ module Keys_get = struct
 
   let mk_future_keys_response ~sm =
     let future_signkeys =
-      Secmod.get_signkeys sm
+      Secmod.get_signkeys_data sm
       |> List.filter (fun k -> Option.is_none k.Signkey_data.master_sig)
       |> List.map (fun signkey -> mk_future_signkey ~sm signkey)
     in
     let future_denoms =
-      Secmod.get_denoms sm
+      Secmod.get_denoms_data sm
       |> List.filter (fun k -> Option.is_none k.Denom_data.master_sig)
       |> List.map (fun denom -> mk_future_denom ~sm denom)
     in
@@ -158,7 +158,7 @@ module Keys_post = struct
 
   (* TODO move to test *)
   let check_master_signatures_update ~db_conn ~sm =
-    Secmod.get_denoms sm
+    Secmod.get_denoms_data sm
     |> list_iter (fun denom ->
         let error = Error "update_master_signatures sanity check failure" in
         let* opt =

src/secmod.ml

@@ -9,17 +9,27 @@
 open Syntax
 open Crypto
 
+type signkey = {
+  priv: eddsa_priv;
+  sk_data: Signkey_data.t;
+}
+
+type denom = {
+  priv: rsa_priv;
+  dn_data: Denom_data.t;
+}
+
 type t = {
   lock: Miou.Mutex.t;
   sm_key_priv: eddsa_priv;
   sm_key_pub: eddsa_pub;
-  sk_ht: (eddsa_pub, Signkey_data.t) Hashtbl.t;
+  sk_ht: (eddsa_pub, signkey) Hashtbl.t;
   sk_revoked_ht:
-    (eddsa_pub, Signkey_data.t * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t;
-  dn_ht: (denomination_hash, Denom_data.t) Hashtbl.t;
+    (eddsa_pub, signkey * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t;
+  dn_ht: (denomination_hash, denom) Hashtbl.t;
   dn_revoked_ht:
     ( denomination_hash,
-      Denom_data.t * Bin_sig.MasterDenominationKeyRevocation.t )
+      denom * Bin_sig.MasterDenominationKeyRevocation.t )
     Hashtbl.t;
 }
 
@@ -46,7 +56,7 @@ let verify_with_signkey t ~pub s ~msg =
   Miou.Mutex.protect t.lock @@ fun () ->
   match Hashtbl.find_opt t.sk_ht pub with
   | None -> Error "secmod failure: public key not found."
-  | Some signkey -> EddsaSignature.verify ~key:signkey.pub s ~msg
+  | Some signkey -> EddsaSignature.verify ~key:signkey.sk_data.pub s ~msg
 
 let get_sm_key_pub t = t.sm_key_pub
 
@@ -58,11 +68,21 @@ let get_denoms t =
   Miou.Mutex.protect t.lock @@ fun () ->
   Hashtbl.to_seq_values t.dn_ht |> List.of_seq
 
+let get_signkeys_data t =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  Hashtbl.to_seq_values t.sk_ht |> List.of_seq |> List.map (fun v -> v.sk_data)
+
+let get_denoms_data t =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  Hashtbl.to_seq_values t.dn_ht |> List.of_seq |> List.map (fun v -> v.dn_data)
+
 let find_signkey_data t pub =
-  Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.find_opt t.sk_ht pub
+  Miou.Mutex.protect t.lock @@ fun () ->
+  Hashtbl.find_opt t.sk_ht pub |> Option.map (fun v -> v.sk_data)
 
 let find_denom_data t h_denom =
-  Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.find_opt t.dn_ht h_denom
+  Miou.Mutex.protect t.lock @@ fun () ->
+  Hashtbl.find_opt t.dn_ht h_denom |> Option.map (fun v -> v.dn_data)
 
 let add_signkey_master_signatures conn t l =
   Miou.Mutex.protect t.lock @@ fun () ->
@@ -71,9 +91,10 @@ let add_signkey_master_signatures conn t l =
       match Hashtbl.find_opt t.sk_ht pub with
       | None -> Error "secmod failure: public key not found."
       | Some signkey ->
-          let signkey = { signkey with master_sig= Some master_sig } in
+          let sk_data = { signkey.sk_data with master_sig= Some master_sig } in
+          let signkey = { signkey with sk_data } in
           let* () =
-            Pg.activate_signing_key conn ~master_sig signkey |> unwrap_err_caqti
+            Pg.activate_signing_key conn ~master_sig sk_data |> unwrap_err_caqti
           in
           Hashtbl.replace t.sk_ht pub signkey;
           Ok ())
@@ -86,9 +107,10 @@ let add_denom_master_signatures conn t l =
       match Hashtbl.find_opt t.dn_ht h_denom_pub with
       | None -> Error "secmod failure: denomination hash not found."
       | Some denom ->
-          let denom = { denom with master_sig= Some master_sig } in
+          let dn_data = { denom.dn_data with master_sig= Some master_sig } in
+          let denom = { denom with dn_data } in
           let* () =
-            Pg.add_denomination_key conn ~master_sig denom |> unwrap_err_caqti
+            Pg.add_denomination_key conn ~master_sig dn_data |> unwrap_err_caqti
           in
           Hashtbl.replace t.dn_ht h_denom_pub denom;
           Ok ())
@@ -181,23 +203,24 @@ let load_signkey conn fname =
   match opt with
   | None -> Ok None
   | Some priv ->
-      let* signkey_data = db_lookup_signkey_data conn fname priv in
-      Ok (Some signkey_data)
+      let* sk_data = db_lookup_signkey_data conn fname priv in
+      let signkey = { priv; sk_data } in
+      Ok (Some signkey)
 
 let _store t =
   let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in
   let* () =
     get_signkeys t
-    |> List.mapi (fun i key ->
+    |> List.mapi (fun i (key : signkey) ->
         let fname = Fpath.(dir / string_of_int i) in
-        (fname, key.Signkey_data.priv))
+        (fname, key.priv))
     |> list_iter (fun (fname, key) -> Data_file.write_eddsa fname key)
   in
   let* () =
     get_denoms t
-    |> List.mapi (fun i key ->
+    |> List.mapi (fun i (key : denom) ->
         let fname = Fpath.(dir / string_of_int i) in
-        (fname, key.Denom_data.priv))
+        (fname, key.priv))
     |> list_iter (fun (fname, key) -> Data_file.write_rsa fname key)
   in
   Ok ()
@@ -224,8 +247,9 @@ let load conn =
           | None -> Ok None
           | Some priv ->
               (* todo: could check that coin config match db values *)
-              let* denom_data = db_lookup_denom_data conn ~section_name priv in
-              Ok (Some denom_data))
+              let* dn_data = db_lookup_denom_data conn ~section_name priv in
+              let denom = { priv; dn_data } in
+              Ok (Some denom))
         all_coins
     in
     match Syntax.opt_list l with
@@ -239,13 +263,13 @@ let load conn =
       let lock = Miou.Mutex.create () in
       let sk_ht =
         signkeys
-        |> List.map (fun v -> (v.Signkey_data.pub, v))
+        |> List.map (fun v -> (v.sk_data.pub, v))
         |> List.to_seq
         |> Hashtbl.of_seq
       in
       let dn_ht =
         denoms
-        |> List.map (fun v -> (v.Denom_data.h_pub, v))
+        |> List.map (fun v -> (v.dn_data.h_pub, v))
         |> List.to_seq
         |> Hashtbl.of_seq
       in
@@ -273,7 +297,10 @@ let make_new_signkey () =
   let stamp_end = stamp_expire in
   let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
   let master_sig = None in
+  let sk_data =
     Signkey_data.{ pub; priv; stamp_start; stamp_expire; stamp_end; master_sig }
+  in
+  { priv; sk_data }
 
 let make_new_denom
     Config.Coin.
@@ -305,6 +332,7 @@ let make_new_denom
   let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in
   let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in
   let master_sig = None in
+  let dn_data =
     Denom_data.
       {
         pub;
@@ -323,20 +351,22 @@ let make_new_denom
         h_pub;
         master_sig;
       }
+  in
+  { priv; dn_data }
 
 let make_new () =
   let lock = Miou.Mutex.create () in
   let sm_key_priv, sm_key_pub = Mirage_crypto_ec.Ed25519.generate () in
   let sk_ht =
     [ make_new_signkey () ]
-    |> List.map (fun v -> (v.Signkey_data.pub, v))
+    |> List.map (fun v -> (v.sk_data.pub, v))
     |> List.to_seq
     |> Hashtbl.of_seq
   in
   let dn_ht =
     Config.Coin.all_coins
     |> List.map make_new_denom
-    |> List.map (fun v -> (v.Denom_data.h_pub, v))
+    |> List.map (fun v -> (v.dn_data.h_pub, v))
     |> List.to_seq
     |> Hashtbl.of_seq
   in

src/secmod.mli

@@ -11,8 +11,8 @@ val verify_with_signkey :
   t -> pub:eddsa_pub -> eddsa_sig -> msg:string -> (unit, string) result
 
 val get_sm_key_pub : t -> eddsa_pub
-val get_signkeys : t -> Signkey_data.t list
-val get_denoms : t -> Denom_data.t list
+val get_signkeys_data : t -> Signkey_data.t list
+val get_denoms_data : t -> Denom_data.t list
 val find_signkey_data : t -> eddsa_pub -> Signkey_data.t option
 val find_denom_data : t -> denomination_hash -> Denom_data.t option