swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

functor for master sigs

Browse source
This commit is contained in:
swrup 2026-02-21 22:11:13 +01:00
parent 77d10ee93c
commit 1e1e5719e5
5 changed files with 87 additions and 115 deletions
Download patch file Download diff file Expand all files Collapse all files

48
src/http_management.ml
View file

@ -3,29 +3,13 @@ open Api
open Hash
module Keys_get = struct
let mk_future_keys_response (module Keys : Keys.S) =
let* future_signkeys = Keys.future_signkeys () in
let* future_denoms = Keys.future_denominations () in
let master_pub = Keys.master_pub in
let denom_secmod_public_key = Keys.secmod_rsa_pub in
let signkey_secmod_public_key = Keys.secmod_eddsa_pub in
Ok
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub;
denom_secmod_public_key;
signkey_secmod_public_key;
}
let jsont = FutureKeysResponse.jsont
let f req server _env =
Logs.info (fun m -> m "GET /management/keys/");
let keys = Vif.Server.device Devices.keys server in
let (module Keys : Keys.S) = Vif.Server.device Devices.keys server in
let res =
let* v = mk_future_keys_response keys in
let* v = Keys.make_future_keys_response () in
let s = Api.encode_exn jsont v in
Ok s
in
@ -51,7 +35,7 @@ module Keys_post = struct
denom_hash;
}
in
verify Keys.master_pub master_sig r
verify master_sig r
let verify_denom_sigs (module Keys : Keys.S) denom_sigs =
let* fdn_l = Keys.future_denominations () in
@ -86,7 +70,7 @@ module Keys_post = struct
signkey_pub= key;
}
in
verify Keys.master_pub master_sig r
verify master_sig r
let verify_signkey_sigs (module Keys : Keys.S) signkey_sigs =
let* fsk_l = Keys.future_signkeys () in
@ -137,7 +121,7 @@ module Denom_revoke = struct
let verify (module Keys : Keys.S) h_denom_pub
DenomRevocationSignature.{ master_sig } =
let open Signatures.MasterDenominationKeyRevocation in
verify Keys.master_pub master_sig { h_denom_pub }
verify master_sig { h_denom_pub }
let do_ (module Keys : Keys.S) h_denom_pub
DenomRevocationSignature.{ master_sig } =
@ -163,7 +147,7 @@ module Signkey_revoke = struct
let verify (module Keys : Keys.S) exchange_pub
SignkeyRevocationSignature.{ master_sig } =
let open Signatures.MasterSigningKeyRevocation in
verify Keys.master_pub master_sig { exchange_pub }
verify master_sig { exchange_pub }
let do_ (module Keys : Keys.S) exchange_pub
SignkeyRevocationSignature.{ master_sig } =
@ -196,7 +180,7 @@ module Auditors = struct
validity_start;
} =
let open Signatures.MasterAddAuditor in
verify Keys.master_pub master_sig
verify master_sig
{
start_date= validity_start;
auditor_pub;
@ -243,7 +227,7 @@ module Auditors_disable = struct
let verify (module Keys : Keys.S) auditor_pub
AuditorTeardownMessage.{ master_sig; validity_end } =
let open Signatures.MasterDelAuditor in
verify Keys.master_pub master_sig { end_date= validity_end; auditor_pub }
verify master_sig { end_date= validity_end; auditor_pub }
let do_ ~db_conn auditor_pub
AuditorTeardownMessage.{ master_sig= _; validity_end } =
@ -291,7 +275,7 @@ module Wire_fee = struct
wire_fee;
} =
let open Signatures.MasterWireFee in
verify Keys.master_pub master_sig_wire
verify master_sig_wire
{
h_wire_method= Hash.Cstring.H64.hash wire_method;
start_date= fee_start;
@ -353,7 +337,7 @@ module Global_fees = struct
master_sig;
} =
let open Signatures.GlobalFees in
verify Keys.master_pub master_sig
verify master_sig
{
start_date;
end_date;
@ -426,7 +410,7 @@ module Wire = struct
let debit_restrictions = "" in
let* () =
let open Signatures.MasterWireDetails in
verify Keys.master_pub master_sig_wire
verify master_sig_wire
{
h_wire_details= FullPaytoHash.hash payto_uri;
h_conversion_url= Hash.Cstring.H64.hash conversion_url;
@ -436,7 +420,7 @@ module Wire = struct
in
let* () =
let open Signatures.MasterAddWire in
verify Keys.master_pub master_sig_add
verify master_sig_add
{
start_date= validity_start;
h_wire= FullPaytoHash.hash payto_uri;
@ -492,7 +476,7 @@ module Wire_disable = struct
let verify (module Keys : Keys.S)
WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
let open Signatures.MasterDelWire in
verify Keys.master_pub master_sig_del
verify master_sig_del
{ end_date= validity_end; h_wire= FullPaytoHash.hash payto_uri }
let do_ ~db_conn
@ -535,7 +519,7 @@ module Drain = struct
amount;
} =
let open Signatures.MasterDrainProfit in
verify Keys.master_pub master_sig
verify master_sig
{
wtid;
date;
@ -576,7 +560,7 @@ module AmlOfficer = struct
} =
let open Signatures.MasterAmlOfficerStatus in
let is_active = match is_active with true -> 1_l | false -> 0_l in
verify Keys.master_pub master_sig
verify master_sig
{
change_date;
officer_pub;
@ -616,7 +600,7 @@ module Partners = struct
wad_fee;
} =
let open Signatures.PartnerConfiguration in
verify Keys.master_pub master_sig
verify master_sig
{
partner_pub;
start_date;

18
src/keys.ml
View file

@ -12,11 +12,6 @@ module Make (Conn : Pg.CONN) = struct
let conn = (module Conn : Pg.CONN)
(* - *)
let master_pub = Config.Exchange.master_public_key
let secmod_eddsa_pub = Sm_eddsa.sm_pub
let secmod_rsa_pub = Sm_rsa.sm_pub
(* TODO
error "key not found", either:
- we tried to sign with a key that is not ours
@ -173,6 +168,19 @@ module Make (Conn : Pg.CONN) = struct
in
List.filter_map Fun.id l
let make_future_keys_response () =
let* future_signkeys = future_signkeys () in
let* future_denoms = future_denominations () in
Ok
Api.FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= Config.Exchange.master_public_key;
denom_secmod_public_key= Sm_rsa.sm_pub;
signkey_secmod_public_key= Sm_eddsa.sm_pub;
}
let sk_of_future_sk future_sk master_sig =
let Api.FutureSignKey.
{ key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =

4
src/mod_intf.mli
View file

@ -3,9 +3,6 @@ open Crypto
type 'a result = ('a, string) Result.t
module type KEYS = sig
val master_pub : eddsa_pub
val secmod_rsa_pub : eddsa_pub
val secmod_eddsa_pub : eddsa_pub
val sign : eddsa_pub -> string -> eddsa_sig
val sign_denom : rsa_pub -> string -> rsa_sig
val find_signkey : eddsa_pub -> Signkey.t option result
@ -14,6 +11,7 @@ module type KEYS = sig
val denominations : unit -> Denomination.t list result
val future_signkeys : unit -> Api.FutureSignKey.t list result
val future_denominations : unit -> Api.FutureDenom.t list result
val make_future_keys_response : unit -> Api.FutureKeysResponse.t result
val certify_future_signkey :
eddsa_pub -> Signatures.ExchangeSigningKeyValidity.t -> unit result

36
src/signatures.ml
View file

@ -160,7 +160,6 @@ module type SIGNATURE = sig
val signf : (string -> EddsaSignature.t) -> r -> t
(* todo
- could have another functor with `verify`'s key set to config's master_public_key
- type for unknown/verified signatures? (nk/ok) *)
val verify : EddsaPublicKey.t -> t -> r -> (unit, string) result
val jsont : t Jsont.t
@ -184,14 +183,9 @@ module MK (R : R) : SIGNATURE with type r := R.r = struct
end
module MK_master_sig (R : R) = struct
open Crypto
include MK (R)
let to_string = Bin.to_string R.bin
let verify t r =
EddsaSignature.verify ~key:Config.Exchange.master_public_key t
~msg:(to_string r)
let verify = verify Config.Exchange.master_public_key
end
(* ---- *)
@ -315,7 +309,7 @@ module DenominationKeyValidity = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module ExchangeSigningKeyValidity = struct
@ -342,7 +336,7 @@ module ExchangeSigningKeyValidity = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterDenominationKeyRevocation = struct
@ -360,7 +354,7 @@ module MasterDenominationKeyRevocation = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterSigningKeyRevocation = struct
@ -378,7 +372,7 @@ module MasterSigningKeyRevocation = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterAddAuditor = struct
@ -402,7 +396,7 @@ module MasterAddAuditor = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterDelAuditor = struct
@ -423,7 +417,7 @@ module MasterDelAuditor = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module GlobalFees = struct
@ -478,7 +472,7 @@ module GlobalFees = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterWireDetails = struct
@ -516,7 +510,7 @@ module MasterWireDetails = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterAddWire = struct
@ -558,7 +552,7 @@ module MasterAddWire = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterDelWire = struct
@ -579,7 +573,7 @@ module MasterDelWire = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterDrainProfit = struct
@ -607,7 +601,7 @@ module MasterDrainProfit = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module MasterAmlOfficerStatus = struct
@ -633,7 +627,7 @@ module MasterAmlOfficerStatus = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module PartnerConfiguration = struct
@ -672,7 +666,7 @@ module PartnerConfiguration = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module WadPartnerSignature = struct
@ -748,7 +742,7 @@ module MasterWireFee = struct
|> sealr
end
include MK (R)
include MK_master_sig (R)
end
module ExchangeKeyValidity = struct

66
tools/offline_impl.ml
View file

@ -1,11 +1,19 @@
open Syntax
open Crypto
open Hash
module Future_keys = struct
open Crypto
open Api
let verify =
let verify offline_master_public_key
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub;
denom_secmod_public_key;
signkey_secmod_public_key;
} =
let verify_future_denom ~sm_denom_pub
FutureDenom.
{
@ -44,18 +52,8 @@ module Future_keys = struct
verify sm_signkey_pub signkey_secmod_sig
{ exchange_pub; anchor_time; duration }
in
fun our_master_public_key
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub;
denom_secmod_public_key;
signkey_secmod_public_key;
}
->
let* () =
match master_pub = our_master_public_key with
match master_pub = offline_master_public_key with
| false ->
Fmt.error
"master public key of the future key response does not match ours"
@ -73,8 +71,16 @@ module Future_keys = struct
in
Ok ()
let make =
let denom_signature ~master_key
let make ~master_key
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= _;
denom_secmod_public_key= _;
signkey_secmod_public_key= _;
} =
let denom_signature
FutureDenom.
{
section_name= _;
@ -113,7 +119,7 @@ module Future_keys = struct
in
DenomSignature.{ h_denom_pub; master_sig }
in
let signkey_signature ~master_key
let signkey_signature
FutureSignKey.
{ key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
let master_sig =
@ -129,20 +135,8 @@ module Future_keys = struct
in
SignKeySignature.{ key; master_sig }
in
fun ~master_key
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= _;
denom_secmod_public_key= _;
signkey_secmod_public_key= _;
}
->
let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
let signkey_sigs =
List.map (signkey_signature ~master_key) future_signkeys
in
let denom_sigs = List.map denom_signature future_denoms in
let signkey_sigs = List.map signkey_signature future_signkeys in
MasterSignatures.{ denom_sigs; signkey_sigs }
end
@ -155,7 +149,7 @@ let write_file fname content =
let read_master_key_file filename =
let* master_key = read_file filename in
Crypto.EddsaPrivateKey.of_octets master_key
EddsaPrivateKey.of_octets master_key
let download ~output ~url =
let open Bos in
@ -197,7 +191,6 @@ let setup ~output ~output_pubkey =
Ok ()
let sign ~master_key ~input ~output =
let open Crypto in
let* master_key = read_master_key_file master_key in
let* input = read_file input in
let master_pub = EddsaPrivateKey.pub_of_priv master_key in
@ -214,7 +207,7 @@ let revoke_denom ~output ~master_key ~h_denom =
let denom_revoke =
let master_sig =
let open Signatures.MasterDenominationKeyRevocation in
signf (Crypto.EddsaSignature.sign ~key) { h_denom_pub }
signf (EddsaSignature.sign ~key) { h_denom_pub }
in
Api.DenomRevocationSignature.{ master_sig }
in
@ -227,7 +220,7 @@ let revoke_signkey ~output ~master_key ~signkey =
let signkey_revoke =
let master_sig =
let open Signatures.MasterSigningKeyRevocation in
signf (Crypto.EddsaSignature.sign ~key) { exchange_pub= signkey }
signf (EddsaSignature.sign ~key) { exchange_pub= signkey }
in
Api.SignkeyRevocationSignature.{ master_sig }
in
@ -238,7 +231,6 @@ let revoke_signkey ~output ~master_key ~signkey =
let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
~account_fee ~purse_fee ~history_expiration ~purse_account_limit
~purse_timeout =
let open Crypto in
let* key = read_master_key_file master_key in
let* purse_account_limit =
match
@ -282,7 +274,6 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee
let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
~validity_start =
let open Crypto in
let* key = read_master_key_file master_key in
let master_sig =
let open Signatures.MasterAddAuditor in
@ -302,7 +293,6 @@ let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
Ok ()
let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
let open Crypto in
let* key = read_master_key_file master_key in
let master_sig =
let open Signatures.MasterDelAuditor in
@ -315,7 +305,6 @@ let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
~wire_fee =
let open Crypto in
let* key = read_master_key_file master_key in
let master_sig_wire =
let open Signatures.MasterWireFee in
@ -345,7 +334,6 @@ let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
let drain ~output ~master_key ~debit_account_section ~credit_payto_uri ~wtid
~date ~amount =
let open Crypto in
let* key = read_master_key_file master_key in
let master_sig =
let open Signatures.MasterDrainProfit in